May 2000 - Zope - Zope lists

redirection in standard_error_message
by Chien-pin Wang 10 May '00

10 May '00

Hi, All: It seems calling the redirect method of RESPONSE object does not work in standard_error_message? I have the following line embedded in standard_error_message: <dtml-call "RESPONSE.redirect('http://www.yahoo.com')"> Zope seems just skip this line. Is it a problem? Thanks for advising. Chien-pin

3 2

Apache ProxyPass and ZServer
by Stuart Foster 10 May '00

10 May '00

Using Apache's ProxyPass with ZServer seems much easier than the CGI modal. Is there any reason not to use this? http://www.zope.org/Members/anser/apache_zserver Stuart Foster MediServe Information Systems > http://www.mediserve.com >

3 2

Server Side Trojan thoughts...
by Evan Gibson 10 May '00

10 May '00

I've been reading the description of this problem and have been wondering about a few things... Mainly I have questions about "Taking Ownership". This permission will need to be kept from almost everyone. For starters since a user gains the "owner role" whenever they take ownership of an object this can be used to gain complete access to absolutely anything they can take ownership of. Does the existing owner lose the "owner role" when another person becomes owner? I don't think so currently. People with the "owner role" are allowed to delegate and give this "owner role" to others, the _exact_ opposite of the model for moving "owner" itself which can only be taken. This is bound to cause even more confusing. Wouldn't it be better to actually dump the whole concept of "owner role" and have a single coherent ownership system? Then there would be no confusion. The whole "owner role" seems to be predominately for delegation, but it _already_ works differently from normal permissions in that the person who has the owner role for any particular object isn't a set property of the user, but rather a mix of the user and the actual object. It would make sense to me to divorce the normal permissions system (in which a user has certain set roles according to their acl_user settings, regardless of where they are in the subtree) from the ownership system (in which the permissions the user has are not absolute). Shouldn't "owner" have to be given away as _well_ as accepted? I understand why it has to be accepted, otherwise you could script your objects to pass themselves to a person with more authority and then run themselves. Acceptance would be difficult in that currently everything to do with ownership is atomic, but if it was introduced there would be no need to have a "Take Permissions" permission that needed to be jealously guarded, you'd return to trusting the people themselves instead of being draconian and paranoid. Mainly I see cases of virtual hosting in which the leader of a certain web-project is leaving and wants to pass on ownership to his successor, someone who's also been working on the project but doesn't have as high permissions. Since it's virtual hosting neither has superuser permissions, neither has "Take permission" permissions. Given the suggested model they would have to petition the superuser to move the ownership over. (I presume that's going to be possible for the superuser?) If you had 500 projects running the superuser shouldn't have to deal with this kind of thing, it should be possible for the people to do themselves without having to have an extremely dangerous permission. Unrelated but still permission stuff... Is management of the permissions planning on changing? It's a different problem, but I was planning on implementing a "project" system in which people were able to become members of projects which would give them specific permissions within the subtree that housed that project. This isn't feasible within the existing security framework as you have to set up every project as a separate role, disallow all access to that role except in the directory given. There is a _lot_ of messing about with checkboxes and you can't automate it easily. With (say) 100 projects you'd have a _lot_ of trouble searching through the permissions screen, especially if you needed to add new roles and they ended up in the middle of all the project specific roles. It'd be very confusing. What I was planning on doing was making a "projects" property for users, just a list of which projects they were members of and then in the header of every dtml page within a project check that that projectname was contained in the list else redirect to a safe page. This would work, but it wouldn't protect non dtml objects. I suppose the proper thing to do would be to create a "project folder" object that checked the users membership of that project as well as using the normal zope security. Anyone got any other suggestions? -- Evan ~ThunderFoot~ Gibson ~ nihil mutatem, omni deletum ~ It doesn't count as intimacy until somebody starts crying.

1 0

Re: Apache ProxyPass and ZServer
by anser 10 May '00

10 May '00

Stuart Foster <stuartf(a)MediServe.com> wrote: > Using Apache's ProxyPass with ZServer seems much easier than the > CGI modal. > Is there any reason not to use this? > http://www.zope.org/Members/anser/apache_zserver Apparently this is a slightly religious issue. Some people use ProxyPass and love it, others swear by the persistent PCGI co-process (or its cousin FastCGI), others just want ZCGI for a few URL's, and some people may even like using raw ZServer for everything. :) The primary reason to use ProxyPass is if you already run Apache and like its flexibility, but you would like to Zope-ify a URL subspace without sacrificing multithreaded performance. A second great reason is if you need to run Zope on a separate (possibly hidden) server farm. The target of the ProxyPass need not be on the same machine, or even the same continent, as the Apache front end. If you use ProxyPass for a full fledged Zope site including management interface and standard DTML page templates involving those nasty absolute URL's, remember to install the latest SiteAccess product.

1 0

creating a print version document
by Eron Lloyd 10 May '00

10 May '00

Can anyone recommend a good way to implement a print version/no frame document switching mechanism? This seems to be widely done, and was wondering how most Web developers would do this using Zope. Thanks in advance, Eron

2 1

RE: [Zope] images are not found when zope is server through IIS
by Eliot Scull 10 May '00

10 May '00

> hello, > > before I bang me head to figure out what is happening, I wonder if one > of you has this problem: > > Zope is running on Windows NT with pcgi through IIS. > I use the LocalFS product to serve images. > > http://mysite.com/Zope.pcgi/FS/photo.gif > > doesn't work: photo.gif is not found. however, > > http://mysite.com:8080/FS/photo.gif > > works as expected: the image is found and displayed correctly. > Note that this seems not to be related to the LocalFS product, as no > images are shown in the management screens, they are not found neither. > the funny part is this problem only occurs for images. All other objects > (methods, documents, etc...) are always found > > Any ideas? Perhaps there is another way, but with IIS you have to make a separate directory (using the same path structure called out in your HTML) and put your images there. You have to change IIS settings so that IIS knows about your directory. Then, your images will be displayed. Hope that helps. Eliot Scull Digital Garage, Inc. http://www.garage.co.jp/ email: eliot(a)garage.co.jp tel: +81-3-5454-7213 fax: +81-3-5454-7218

1 0

RE: Re: [Zope] How to get reportlab running and integrated with Zope
by dale w lance 10 May '00

10 May '00

Thanks guys, However ... Neither suggestion has done what I am expecting. I am using a binary version of Zope and the only python is the one that came with it. I have tried it under the Product directory,lib/python1.5 directory, /usr/local/Zope/lib/python/site-packages/ directory. All give me the same error. I believe I might have an environment variable issue here. I have tried setting them i.e. the start script and setting them as per the instructions (README) from reportlab but it still can't find module reportlab.pdfgen. Shouldn't I be able to run this under the python environ that came with Zope? Dale p.s. all info/updates I garner will of course be cordially sent to the list -----Original Message----- From: tony.mcdonald [mailto:tony.mcdonald@ncl.ac.uk] Sent: Monday, May 08, 2000 4:47 AM To: chrism; d.lance Cc: tony.mcdonald; zope Subject: FW: Re: [Zope] How to get reportlab running and integrated with Zope At 5:17 pm -0400 7/5/00, Chris McDonough wrote: >Dale, I've never used reportlab, but if you change the import statement >to: > >from Products.reportlab import reporlab.pdfgen > >It might work. > >Dale Lance wrote: >> >> Hi all, >> >> I have downloaded Reportlab to my linux box and am trying to go through the >> install >> procedure. I un-tarred into /usr/local/Zope/lib/python/Products making the >> reportlab product >> underneath. This looks good in Zope ... (shows up as product under >> management screen) >> However running the test script (testpdfgen.py) under >> ...reportlab/pdfgen/test/testpdfgen.py >> gives me a module not found error when it tries to import reportlab.pdfgen. >> Any clues as to what I haven't set up? >> Anyone tried this yet? >> >> lost in Zen > > Dale Dale, If you're running a binary version of Zope, you need to put reportlab into lib/python1.5 in your Zope installation. If you're using a source version of Zope, put it in something like /usr/local/lib/python/site-packages/ instead. I think there's some confusion over Zope Products and python packages. AFAIK, you'll need to write some external methods or PythonMethods to access the reportlab functions.... Please let the list know how you get on with reportlab and Zope - I've used it standalone and it's a beautiful package! Tone out. ------ Dr Tony McDonald, FMCC, Networked Learning Environments Project http://nle.ncl.ac.uk/ The Medical School, Newcastle University Tel: +44 191 222 5888 Fingerprint: 3450 876D FA41 B926 D3DD F8C3 F2D0 C3B9 8B38 18A2 _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

7 7

newbie question: Is it possible to search both Zope + static pages at the same time? the same time?
by Chris Beaumont 10 May '00

10 May '00

I have a newbie question. I'm going to be adding a dynamically generated Zope core to a static website (over 5500 HTML documents) and if it's at all possible, I'd like to be able to search both parts of the site from one interface. I was thinking that it would be possible if I could use a spidering web crawler, rather than one that looked at the filesystem. I'm assuming that it wouldnt be possible to use the search engine in Zope to search external content, but I know that since I'm new to Zope, I might be wrong.. I am sure that others have walked this road before me. What were your experiences, what did you use (the platform is debian linux) And is this a valid approach? Thank you! Chris Beaumont cbeaumon(a)msri.org

2 1

RE: [Zope] Zope security alert and 2.2 information
by Paul Everitt 09 May '00

09 May '00

Hello everybody. For what it's worth, I just had a call with Brian Behlendorf (from the Apache Group) about the web-wide aspect in the second issue. He says it is somewhat related to common client side issues, but the involvement of redirect and malicious foreign forms is a deeper wrinkle he hasn't seen before. I would say "patches accepted", but in this case, I'll change it to "prozac accepted". --Paul > -----Original Message----- > From: Brian Lloyd [mailto:Brian@digicool.com] > Sent: Tuesday, May 09, 2000 5:19 PM > To: 'zope(a)zope.org'; 'zope-dev(a)zope.org' > Subject: [Zope] Zope security alert and 2.2 information > > > Hello all - > > We have recently become aware of two important security issues > that managers of Zope sites need to be aware of. Please see the > overview at: > > http://www.zope.org/Members/jim/ZopeSecurity/TrojanIssueOverview > > for further details. > > > > Brian Lloyd brian(a)digicool.com > Software Engineer 540.371.6909 > Digital Creations http://www.digicool.com > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

Sort order of objects in folders
by Jerry Spicklemire 09 May '00

09 May '00

Sean Mcgrath wrote: >Is it possible to influence the sort order of >objects in folders? "Zieve is a product that provides flexible sorting." http://www.zope.org/Members/sspickle/Zieve Later, Jerry S.

1 0