June 2000 - Zope - Zope lists

SQL security at row level
by Hung Jung Lu 20 Jun '00

20 Jun '00

Hi, This is a general question. One can protect the ZSQL methods by employing user folders. This offers table-level protection. But what about protecting database information at row level? (This can come from hackers tweaking form variables.) Currently I store some security information (like the owner of row, among other things) on all rows on all tables. When retrieving records from tables (in particular, for "select" and "update" methods), I'd like to verify that the current user indeed has the privilege for accessing a particular row. I know at least two ways for checking this information. (Notice that we may have complicated situations where not only the owner can have access... we may have group privileges, superuser user privileges, etc. Also, I have a few hundreds ZSQL statements, so it's not a small question.) (1) Pre-generate the allowed owner ids, so "select" statements can only select rows with given owner ids... I could put something like: (keeping in mind superusers, team-members, supervisers, etc.) where <dtml-sqltest owner_id column=owner_id type=int> or <dtml-sqltest additional_id1 column=owner_id type=int> or <dtml-sqltest additional_id2 column=owner_id type=int> ..... (2) Use a wrapper for ZSQL methods, and raise an exception when unauthorized rows are retrieved. I guess row-level protection is a very common issue, so I would like to know what other strategies are used. I would appreciate description of actual implementations. regards, Hung Jung ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

2 1

How can I upload files to mySQL
by jensebaer 20 Jun '00

20 Jun '00

Hello, I am using Zope and mySQL and want to load up text and Images to text or blob fields. How can I upload file content to TEXT (plain text) and BLOB (images: jpg, gif) using DTML? Thanks Jens

1 0

sifting through python sub-objects
by ed colmar 20 Jun '00

20 Jun '00

I've succesfully gotten the catalog to work (thanks everyone!), but in doing so, I've created a problem. Squishdot uses this code like this in order to add an item: id=self.createId() # make a datestamp id msg=PromoterPost(id,title) msg=msg.__of__(self) # ??? self.setItem(id,msg) # set the item This code is incompatible with the catalog. As far as I can tell because The catalog likes to see id's as strings, but I don't think the object gets completely added to the zope fs either. After changing the code that does the adding to the zope fs everything related to the catalog seems good. Here's the new code: ob=PromoterPost(id,title) ob.id = id ob.title = title self._setObject(id,ob) self.getCatalog().catalog_object(ob,id) So here's the problem, the methods that squishdot uses to locate sub-objects relies on a BTree() type method, called "data", and is used by a few methods like this: def objectValues(self): """ return list of subobjects """ return map(lambda x, p=self: x.__of__(p), self.data.map(self.ids)) or def is_local_user(self, thisuser): """ returns true with ID if user is a local user based on rev_id_list in squishdot """ rlist = map(None,self.ids) rlist = filter(lambda x,p=self : p.data[x].validated, rlist) rlist = filter(lambda x,p=self : p.data[x].meta_type == 'SRPersonPost', rlist) rlist = filter(lambda x,p=self,s=thisuser : p.data[x].title == s, rlist) return rlist Neither return any results, becuase in the new code, the data object is not getting updated. Do I need to keep a record of all the ids like squishdot does, or can I leave that up to zope? It seems like there should be an easier way than "self.data" to do this... Any ideas?

1 0

Newbie: Listing filesystem objects?
by Andy Gates 19 Jun '00

19 Jun '00

NewbieQ of the moment: So there's a folder on my server, call it \\server\files\logos. I want to list its contents in a drop-down listbox in a form; something like <select name="logo_filename"> <option selected value="default.jpg">default.jpg <option value="file1.jpg">file1.jpg ... </select> Needless to say, I've installed the local filesystem product and created a localfs object called "logos" that maps to the correct folder. And now I'm mired in the docs. I'm thinking that I can just use dtml-in to iterate through the file ids of the objects in that folder, but I'm damned if I can see *how* to do that. Any tips? ---------------------- Andy Gates, Learning and Research Technology Andy.Gates(a)bristol.ac.uk - ICQ#74362415

3 2

html templates?
by cs＠comlounge.net 19 Jun '00

19 Jun '00

Hi! Reading some of the recent mails of the Zope mailing lists I wonder how people would think of the following: Imagine writing simple html templates with some custom tags which are quite abstract like <addresslist>. Then write some Python Product (or there might be one Product to make this happen a little simpler) which implements these tags. Advantages: - people without programming knowledge can change the page - you will be able to override existing tags like <a href...>, e.g. to add a session id as additional parameter on every occurence of an <A>-Tag. Also you will be able to automatically fill in <input>-Fields e.g. if you edit some sort of record. - Separate programming logic from layout. Of course you will have to write the tag implementations in Python but actually I see this as advantage.. ;-) I did this before I used Zope with my own classes, called htmlPARSER (http://heimat.de/mrtopf/htmlparser/ ). I was quite happy with it especially with some unpublished additions which made it very easy to write html forms to add/edit/delete records in an sql database. Most of the work was done automatically, you only had to write one form and specify the fields and tables in the database in a simple list (in addition with my mrDBC module (http://heimat.de/mrtopf/mrdbc/) Now I wonder what people on this list think about such things.. :) (as I sooner or later will implement this also in Python. After fiddling around a bit with ZClasses and generating the forms and error handling by hand..) Some more examples: You might define inner template in your html templates: <template name="adritem"> <tr><td><name></td><td><address></td><td><emaillink></td></tr> </template> and then use it in another tag: <addresslist tmpl='adritem'> This would extract some address record (it's up to the implementing function) and for each address record it will use 'adritem' to format it. So you can use the same method with different layouts. It's also important that <name> is local to that template if you want. Thus you can create templates for different lists and nevertheless use a <name>-Tag in every one of them (if it makes sense). More examples you can find in the htmlPARSER-Distribution. -- christian -- COM.lounge http://comlounge.net/ communication & design info(a)comlounge.net

3 4

Re: brain hurts regarding dynamic fcn args in Python
by Hung Jung Lu 19 Jun '00

19 Jun '00

--- In zope(a)egroups.com, jeff@s... ("Jeff Sasmor") wrote: ><dtml-in >"Catalog.searchResults(meta_type='EventDoc',event_date=[first,last],event_date_usage='range:min:max',sort_on='event_date >')"> > .... > >Now if the 'moderated' property is active I want to add the keyword arg > >reviewed='on' > >to the arg list at the time that the searchResults method is invoked. Hmm... I have had to do something similar recently. But I did not use dynamical argument list. If your choices are simple enough, you could do: ------------------------------------------------------ <dtml-if "moderated == 'active'"> <dtml-in "Catalog.searchResults(meta_type='EventDoc',event_date=[first,last],event_date_usage='range:min:max',review='on',sort_on='event_date >')"> <dtml-var shared_dtml> <dtml-in> <dtml-else> <dtml-in "Catalog.searchResults(meta_type='EventDoc',event_date=[first,last],event_date_usage='range:min:max',sort_on='event_date >')"> <dtml-var shared_dtml> <dtml-in> </dtml-if> ------------------------------------------------------ Yes, the shared_dtml will still have full access to all the "sequence-item" type of variables. If you have to check more than a few properties, then the above construction might not be so good. If you can always pass a value to a keyword argument, then it's best to use an aux variable and preset the value of the argument. <dtml-if "moderated == 'active'"> <dtml-call "REQUEST.set('review', 'on')"> <dtml-else> <dtml-call "REQUEST.set('review', 'off')"> </dtml-if> <dtml-in "Catalog.searchResults(meta_type='EventDoc',event_date=[first,last],event_date_usage='range:min:max',review=review,sort_on='event_date >')"> ... </dtml-in> Hung Jung ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

1 0

YihawDirectory giving error i import
by Rajil Saraswat 19 Jun '00

19 Jun '00

I am trying to install YihawDirectory. I copied the zexp file in the import directory. But when i try to import it an error comes 'The object YihawDirectory' does not support this operation. Please help. Is there any other application which does yahoo like web directory Thanks

1 1

RE: [Zope] brain hurts regarding dynamic fcn args in Python
by Chris McDonough 19 Jun '00

19 Jun '00

Oops, I'm not quite right about this. This FAQ explains it better... http://www.python.org/doc/FAQ.html#4.16 > -----Original Message----- > From: chrism(a)digicool.com [mailto:chrism@digicool.com] > Sent: Monday, June 19, 2000 4:51 PM > To: zope(a)zope.org > Subject: RE: [Zope] brain hurts regarding dynamic fcn args in Python > > > > Is there a (straightforward?) way to dynamically compose function > > argument lists? For example, in C, you can write" > > > > f(arg1, arg2, (conditional expression)?(val for TRUE > > state):(val for FALSE state)). > > This can be emulated in Python by the boolean logic: > > ( ({conditional expression}) and {TRUE val} ) or {FALSE val} > > e.g. > > a = ( ( (x > 1) and "biggerthanone" ) or "smallerthanone" ) > > >>> x = 0 > >>> a = ( (x > 1) and "biggerthanone" ) or "smallerthanone" > >>> a > 'smallerthanone' > > > > > Or one can embed a fcn call within an argument list in order > > to supply a > > needed function parameter. > > > Hrm.. I *think* this will work as a function argment. Sure.. why not? > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) > > > --- > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

ZPatterns DynPersist module for Win32
by Jeff K. Hoffman 19 Jun '00

19 Jun '00

Hello, I just wanted to note that I have built the ZPatterns (0.4.0a1) DynPersist module for Win32 using MSVC. If anyone would like a copy, just e-mail me and I'll be happy to pass it along. --Jeff --- Jeff K. Hoffman 704.849.0731 x108 Chief Technology Officer mailto:jeff.hoffman@goingv.com Going Virtual, L.L.C. http://www.goingv.com/

1 0

Re: [Zope] problem with 2.2.0b1
by Harald Ragger 19 Jun '00

19 Jun '00

Brian, yeah, i'm using Mysql on win2k (ZMySQDA-1-1-4). Harald ----- Original Message ----- From: "Brian Lloyd" <Brian(a)digicool.com> To: "'Harald Ragger'" <h.ragger(a)aon.at> Sent: Monday, June 19, 2000 8:58 PM Subject: RE: [Zope] problem with 2.2.0b1 > > I just tried the new 2.2.0b1, and most imported things from my 2.1.6 > > installation are running fine, including all sql-methods. > > But: > > when I choose one sql-method from the management interface or > > try to add a > > new one, i get the following error-message: > > > > "Warning: There are no SQL database connections. You need to > > add a Zope SQL > > database connection before you can use a Zope SQL Method. " > > > > Thats funny, because I know, that the DB connection is up and running. > > Harald, > > Are you using MySQL by any chance? There is another report similar > to this (where the guy is using MySQL), but I can't reproduce it > using Gadfly connections. That makes me wonder if something could > have changed that is only affecting MySQL for some reason... > > > Brian Lloyd brian(a)digicool.com > Software Engineer 540.371.6909 > Digital Creations http://www.digicool.com > > >

1 0