June 2000 - Zope - Zope lists

jcNTUserFolder and trusted domains
by Erik Myllymaki 02 Jun '00

02 Jun '00

I am running Zope on NT without IIS. I installed jcNTUserFolder, but I cannot get users from a trusted domain to log in. I added these users in the *add users from other domains screen*. Any help appreciated. Erik Myllymaki erik(a)pacific-shores.com

1 0

Re: [Zope] security issues
by Anthony Baxter 02 Jun '00

02 Jun '00

>>> Ragnar Beer wrote > Howdy everyone! > > I will soon have a Zope-site ready to go online. How can I make shure > that I did everything (concerning Zope) to stop intruders? Where can > I find information about protecting a Zope-site? Has anyone had > security problems so far? Easiest (most brutal?) fix I've found - hide Zope behind an Apache, and prohibit access to any URLs of the form .*/manage.* If you don't need to use basic auth to the Zope, then use a rewrite rule to strip out any Authentication headers in the requests. Anthony

2 1

Two issues for Z2.2: XHTML & malicious tags
by Alexander Limi 02 Jun '00

02 Jun '00

Zopistas, I have two issues that I think should be rectified before the 2.2 release. I am not very up to date on the goings-on in the list, but a quick search gave me little information on the following: 1. The HTML that Zope outputs is not very standards-compliant (XHTML 1.0) at the moment. Tags like <img /> are rendered as <IMG> etc. I would like to contribute to the cleanup work, but I am a relative newcomer to CVS. How can I participate? Do I just check out the relevant files, modify them and then get somebody that is authorized to review the files and put them back in the CVS? I am not a guru when it comes to Python, but I know enough to not mess up things along the way :) And just to clarify: I'm not talking about a rewrite of the Zope management console here, that will work fine until the Mozilla version comes along - I merely want to make sure that tags are lowercase and terminated, so pages produced by Zope stand a chance when passing through the W3C validator. I always write compliant code when I have the chance, but when using Zope this is impossible, as the tags that are inserted invalidate the page anyway. So, who do I bribe to have a shot at the CVS? :) 2. Malicious HTML tags - is anything being done here? Filtering of these is one of the features Zope 2.2 really shouldn't go without. Most Zope sites have user interaction in some way, and the concept of a post containing a stray </html>, or even worse - script-tags, destroying a page is totally unacceptable IMHO. I'd just like to query what the status is on this, as I think it is one of the most overlooked areas that are lacking in Zope. I know Evan Simpson (malicious tags) and Christopher Petrilli (HTML quality of zope) have been talking about this earlier, any comments? I'm really looking forward to Zope 2.2, the alpha release looks good so far. You guys rock :) Regards, Alexander Limi.

3 3

something missing in my Oracle setup?
by Alexandre A. Drummond Barroso 02 Jun '00

02 Jun '00

I'm having the same kind of problem. This is my environment: RedHat Linux 6.1 Stronghold 2.4.2/Apache1.3.6 Zope 2.1.6 (running as PCGI) DCOracle 1.3.0 ZOracleDA 2.1.0 Oracle 8.1.6 (client with C-Pro environment installed) The environment is properly set: LD_LIBRARY_PATH is correct, ld.so.conf was properly modified and I've already run ldconfig. I've successfully compiled the DCOracle product and tested it with success. But when I try to create a ZOracle connection object, the server gives me the following answer: "Internal Server Error - The server encountered an internal error or misconfiguration and was unable to complete your request". And here is the message I've found in the error log file: "[error] PCGI Error: [503 Service Unavailable] ((116) unable to connect, fd=4) Success". Does anybody know what is happening and how to solve this? TIA, Alexandre. -----Original Message----- From: dworkin(a)ccs.neu.edu [mailto:dworkin@ccs.neu.edu] Sent: Wednesday, May 31, 2000 10:44 AM To: zope(a)zope.org Subject: Re: [Zope] something missing in my Oracle setup? I wanted to thank Jens and Anthony for the pointers. I ended up doing the full server install. The only other thing required was to put $ORACLE_HOME/lib in my ld.so.conf and run ldconfig. Things seem to work fine now, though I haven't really hammered on DCOracle yet. Thanks again, -Justin _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

ZJetDA
by Luis Cortes 02 Jun '00

02 Jun '00

Hi, I hope someone out there is using this. I hope also that you might have seen this error and can tell me how to fix it. IDispatch = pythoncom.CoCreateInstance(IDispatch, None, clsctx, pythoncom.IID_IDispatch) com_error: (-2147221230, 'CLASS_E_NOTLICENSED', None, None ) during my Zope 2.1.6 start up. Does anyone have any clues?? Thanks for any help, Luis.

1 0

Access to parents from Python
by Pete Kazmier 02 Jun '00

02 Jun '00

Got a quick question ... couldn't seem to find an answer in the archives. I have a container object based on a ZClass, lets call it a 'pool', that holds other objects and more of these 'pools'. How do I, in python, traverse up the tree to find the topmost 'pool'? I need to execute a method on the topmost 'pool' object which in turn will recursively update the cache on every pool in the tree. Thanks!! Pete -- Peter Kazmier http://www.kazmier.com PGP Fingerprint 4FE7 8DA3 D0B5 9CAA 69DC 7243 1855 BC2E 4B43 5654

1 1

ZPoPYDA thread safety level 1
by Eric Bianchi 02 Jun '00

02 Jun '00

Dear ZPoPyDA users, Many of you wonder what is the thread level of ZPoPYDA. As specified in the Python DBAPI v2.0, our product is currently being tested to be thread safety level 1 which means that "Threads may share the module, but not connections". Your feedback is welcomed. If you have any comments or suggestions, please use our mailing-list : popy-user(a)lists.mixadlive.com Regards The PoPy team

1 0

newbie Q. DTML syntax
by Brad Moulton 02 Jun '00

02 Jun '00

As a newbie i have tried a few variations on the following but the <dtml-if> never returns true <dtml-in "PARENTS[0].objectValues(['customer'])" sort=lname> <dtml-if "(_['sequence-item'].title == AUTHENTICATED_USER)"> <tr><td>customer </td><td><dtml-var accno></td> .......and other values from "customers" folder with meta type customer </dtml-if> </dtml-in> I have previously modified an add_instance method to store AUTHENTICATED_USER as the "title" viewing the folder shows this to be so. If I display these values they appear the same. I just do not know the correct syntax inside <dtml-if> brad

3 4

Simple function nightmare
by Felipe Alvarez Harnecker 02 Jun '00

02 Jun '00

Hi Zopistas, Hope you can help me .. (I'm hating DTML right now ) Take this dtml document with name: dontWork_dtml <dtml-return "a+'-'+b+'-'+c"> I want de document act like a function that concatenates a,b and c but if at other document i do something like <let a="'1'" b="'2'" c="'3" d=dontWork_dtml > <dtml-call "REQUEST.set('a','2')"> <dtml-var d> </dtml-let> guess what: it renders 2-2-3 That is d is not a string but an expression. The question is How the Fck. can i implement the concatenation of 3 arguments ? Gracias por vuestra paciencia. -- ______________________________________________________ Felipe Alvarez Harnecker. QlSoftware. Tel. 09.874.60.17 e-mail: felipe.alvarez(a)qlsoft.cl Potenciado por Ql/Linux http://www.qlsoft.cl/ ______________________________________________________

2 1

Aquisition questions
by Ian Sparks 02 Jun '00

02 Jun '00

Some time back I had an exchange with Mike Pelletier regarding SQL methods and aquisition. We talked about a URL structure : mysite.com/Users/Fred/Flavor/Cherry/test Users is a SQL method which takes a single parameter (value = Fred here). Flavor is another method which takes a single parameters (value = Cherry here). test is a dhtml method which returns values pulled from the SQL methods. I set this test up and it works fine. One of the effects of aquisition is that the URLs : mysite.com/Users/Fred/Flavor/Cherry/test mysite.com/Flavor/Cherry/Users/Fred/test are functionally identical in my simple DHTML test method but they might not be, for instance if both SQLMethods provided a result column "RowID" then <dtml-var RowID> would contain the ID of whichever SQL method was run last. Suddenly I'm getting a Users RowID when I expected a Flavor RowID. Potentially disasterous. Is there a way to enforce URL's be traversed in a set way? Thus making : mysite.com/Users/Fred/Flavor/Cherry/test valid while mysite.com/Flavor/Cherry/Users/Fred/test becomes invalid. Also, assuming that both SQLMethods provide a "RowID", how do I specify explicitly which one I want, in OO terms : Users.RowID or Flavor.RowID All help appreciated. - Ian Sparks.

2 2