June 2000 - Zope - Zope lists

How to init the body of a ZClass herited of DTML Method Class?
by Fr�d�ric Quin 09 Jun '00

09 Jun '00

Hi all, I created a ZClass which herite of the DTML Method Class. Now, I want to init the body of all my objects of ZClass with the same script. How can I acess to this body ? Thanks Fred

1 0

Re: [Zope] Secure storage of credit card info
by Cary O'Brien 09 Jun '00

09 Jun '00

> OK, any of you out there who have thought about ecommerce, cryptography, > and zope, I've got a design question for you. Actually, this question > is independent of zope, but I need to solve it in a zope context. > > You have a ZCommerce site. You accept credit cards, and securely > communicate with a CC processor to verify the transacton. Now, > you want to save the CC# and other info in case something needs > to be done with it later, and probably store the CC# so this > customer doesn't have to type it in again later. Regardless > of whether you are storing this info in a relational database > or in the ZODB, how do you secure that information? Ideally > I'd like it to be encrypted on disk. Now, storing it in a database > probably makes it pretty hard to grep out even if a hacker > manages to snarf the database file, but I'd like to encrypt it. > But if I encrypt it, I have to have a decryption key somewhere. > Where do I store the decryption key so that the cracker who > snarfs the database file can't get it (just in memory somewhere?), > and yet have the system be able to boot itself, including having > the key, without human intervention? It seems to me like > this is a Hard Problem, but I'm not up on the current > cyrptography practice. So if there is a well known general > solution, I'd love to hear about it. Otherwise, does anyone > know what current Best Practice is? > Good question. I was just talking to someone about this a few days back. What they did was to a) create a public/private keypair. Don't leave the private key ANYWHERE except on the CC verification machine (described below) b) encrypt the data using the public key c) store the encrypted data d) ship the encrypted cc information through an internal firewall[1] with one hole to a CC verification back end. This back end is protected as much as possible, accessible by as few people as possible. It uses the private key to decrypt and verify. You are still vulnerable if someone can get in and snarf the CC information during b), but at least you don't have thousands of CC numbers hanging around on your frontend or database machines. The idea is that the CC verification machine is much less likely to be compromised. Best practice? I don't know. But it sounded like a good idea to me. Hope I got this right. (Hi Ramon!) -- cary [1] Which also needs to have limited access.

2 1

Re: [Zope] redirecting from inside a frame
by Rik Hoekstra 09 Jun '00

09 Jun '00

The onlyway I can think off, (which doesn't mean its the only way), is to launch a new window and send a HTML document whose content is JavaScript. It would either rewrite the original frame or the entire window depending on you original input and then close itself. [rh] Hm, even for frames, there is a more zopish way to do this using Phil Harris' method (using target). Suppose you want to make a text and then display it in a frameset (this may not have been your original question, but it is just about the hardest to without javascript) This bugged me for a long time, so I thought i'd write it down: make your frameset look something like this: <html> <head> <title></title> </head> <frameset rows="100px,*" BORDER=0 FRAMEBORDER=0 FRAMESPACING=0> <frame name="title" SRC="page1" SCROLLING=no> <frameset cols="150px,*" BORDER=0 FRAMEBORDER=0 FRAMESPACING=0> <frame name="content" SRC="content" SCROLLING="NO" NORESIZE> <dtml-if input> <frame name="text" SRC="<dtml-var input>"> <dtml-else> <frame name="text" SRC="defaultpage"> </dtml-if> </frameset> </frameset> </html> <form method=post action="some_frameset?input=<dtml-var id>" target="_top"> of course you could complicate this for plain page/frameset etc, but that's the easy part ;-) hth Rik ----- Original Message ----- From: Fusion Group To: zope(a)zope.org Sent: Thursday, June 08, 2000 6:03 PM Subject: [Zope] redirecting from inside a frame I'm attempting to submit a form from inside of a frame, and depending on the information submitted, redirect to a new page which I no longer want displayed inside of that frame. I want the new page to displayed in the full browser window, but not a new window. Any help would be greatly appreciated. Regards, Chad

1 0

zodbc performance question
by julio dinis 09 Jun '00

09 Jun '00

Hi all, Using zodbc, supose we have the following situation. One zodbc_database_connection and lots of zsql methods. Can we say that creating more zodbc_database_connection(with a system dsn for each one, but all pointing to the same database) and thus distribute the zsql methods avoiding to all use the same zodbc_connection, will increase performance. Dont tell me I have to test it, I will but some thougts here will help. Best regards, Júlio Dinis Silva ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

3 2

redirecting from inside a frame
by Fusion Group 09 Jun '00

09 Jun '00

I'm attempting to submit a form from inside of a frame, and depending on the information submitted, redirect to a new page which I no longer want displayed inside of that frame. I want the new page to displayed in the full browser window, but not a new window. Any help would be greatly appreciated. Regards, Chad

3 2

Extended characterset
by ivan＠rcp.co.uk 09 Jun '00

09 Jun '00

Hi, What I want to do is to allow users to be able to enter greek/mathematical symbols into a textbox. I have managed to do this but get the following problem - In the first dtml method the user clicks on a symbol button and that symbol is entered into the textbox. They then click on a submit button and the next dtml method is displayed. This method simply does a <dtml-var REQUEST> so that I can see the value of the previous textbox. The symbol has changed! On the first method I enter a lower case delta symbol and in the second I can see an 'a' with dots above it. If I change my code so that instead of inserting a symbol into the textbox it inserts the code δ then when I get to the second dtml method the correct symbol is displayed. This is not very user friendly though. Is there somekind of encoding variable set in Zope? as if I do the same code in straight html then it works fine. Regards, Ivan

2 1

xmlrpc problem
by Andy Dawkins 09 Jun '00

09 Jun '00

Hi I am having a small probelm with xmlrpc. I am simply trying to create a new object within Zope. For now the object will be a DTMLDocument. I have a DTML Method with the id of createDocument and it reads: <dtml-call "manage_addDTMLDocument('new_document','New Doc',contents)"> Done I also have a xmlrpc python module that reads: import xmlrpclib s=xmlrpclib.Server("http://www.myserver.com/Zope/test/") args={} args=['contents']="This is the contents of the new file" s.createDocument(args) The traceback I get reads: Traceback (innermost last): File "<stdin>" line 1, in ? File "xmlrpclib.py", line 550, in __call__ return self.__send(self.__name, args) File "xmlrpclib.py", line 643, in __request request File "xmlrpclib.py", line 595, in request headers xmlrpclib.ProtocolError: <Protocol Error for www.myserver.com/Zope/test/: 401 Unauthorized> If i change createDocument to read: <dtml-call "manage_addDTMLDocument('new_document','New Doc')"> Done and change the python module to read: import xmlrpclib s=xmlrpclib.Server("http://www.myserver.com/Zope/test/") s.createDocument() Then it successfully creates the document. So how do I successfully pass arguments in to the DTML method so that it can populate the new document with the correct data? Cheers -Andy Dawkins (New Information Paradigms Ltd)

1 0

Re: [Zope] How do you call the string?
by Ian Sparks 09 Jun '00

09 Jun '00

Martin, I'm no Zope expert but if you have a property with an ID of "prop1" of type string with a value "first_value" set on a DTML Document then inside the document you can say : <dtml-var prop1> and "first_value" will be substituted into your code at this point, replacing the "<dtml-var prop1>" declaration. I am not sure why you want to get the title? You only need to know the ID to get the value. Are you trying to find a way of looping through all the properties defined for a document? If yes, I don't know how to do this but ask again to zope(a)zope.org for how to do this. Sorry if this doesn't answer your question. - Ian. ----- Original Message ----- From: "Martin Seehuusen" <martin(a)grenna.net> To: "Ian Sparks" <isparks(a)wmute.u-net.com> Sent: Thursday, June 08, 2000 10:50 AM Subject: Re: [Zope] How do you call the string? Thank you for you help! I think I need to explain a bit more! Sorry for not doing that in the first place! OK, I go into Properties for one of my files! then I choose an ID, say "prop1" Type could be, say "String" then a value, say "first_value". now what I would like is to call the string, and get up the ID and the Value. something like <dtml-var type_command> result: ID: Prop1 Value: First_Value Hope this explains a bit more! ;) Thank you for your help. Best regards Martin Seehuusen

1 0

Re: [Zope] Re: [ZCommerce] Secure storage of credit card info
by Cary O'Brien 09 Jun '00

09 Jun '00

> -> > You have a ZCommerce site. You accept credit cards, and securely > -> > communicate with a CC processor to verify the transacton. Now, > > Besides Bill's suggestion, keep all your servers behind a good > firewall. One option is to use Linux IP Masquerading, having your > webserver *and* database server use 192.168.0.??? IP Addresses. Then, > turn on port forwarding on your Masq server, so that all incoming requests > on port 80 go to (something like) port 8080 on your webserver, which then > responds to the request. > > You could just use an encrypted filesystem on the database server, > although that may be too slow (and possibly overkill?). At that point > --assuming your firewall is secured-- you'd more or less need physical > access to your internal network to see those CC#s. The only real danger > left is a misconfiguration (or bad code) in your webserver software. > (read: don't use IIS :) > I would work from the assumption that, worst case, your web server machines may get rooted, either from external attacks or from internal "human engineering". And that people can modify your software and install sniffers. [1] Especially if you have a lot of people modifying content on that machine. That's why you get the best protection with a separate machine, firewalled off, with limited access, plus Public key encryption. If you get rooted and you don't know about, you've lost the game. If you get rooted and you find out, you've only lost those CC numbers that were processed while you were compromised. My 2 cents. I'd be interested to hear alternate viewpoints. -- cary (who worries alot) [1] Which is why switches (rather than dumb hubs) are nice.

1 0

Announce: Squishdot 0.4.1 Released
by Chris Withers 09 Jun '00

09 Jun '00

Squishdot 0.4.1 is now available from http://www.zope.org/Members/chrisw/Squishdot/ The following major changes were made: - You can now use things like 'site_header' and 'site_footer' in 'showMessage' and 'showError'. - Security has been tightened and a new set of roles introduced. - The bug requiring a 'body' parameter to be supplied to 'search' has been fixed. There are some other small changes and improvements. If you run into problems, remember Squishdot has a mailing list at eGroups and a bug collector on SourceForge. cheers, Chris

1 0