September 2000 - Zope

illegal id chars?
by Jason Byron 05 Sep '00

05 Sep '00

Why is it that objects can't be created because the id chosen contains characters that aren't proper in urls? Spaces are allowed and converted to their hex values when you create an object. Why not do this with every illegal url character? I must me missing something here because this seems like this should have been one of the first things designed into Zope. Right? __________________________________________________ Do You Yahoo!? Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/

3 2

That :method thingy.. where's it documented?
by Brad Clements 05 Sep '00

05 Sep '00

I've searched through all the how-toos and documentation on the zope site, but I can't find any reference to :method types.. I know they exist, but searching for "method type" returns too many hits. Can someone remind me where to find this documented? Thanks Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax netmeeting: ils://ils.murkworks.com AOL-IM: BKClements

3 3

External method and stdout
by Sven Hohage 05 Sep '00

05 Sep '00

Hallo, that's the problem: I've made an external method which is working with lists and should return the result to Zope. The python code is working very well, but is sending everything to sys.stdout( I'm using the print-statement).How do I convince Zope to print the result on the html-page. Thanks.

3 3

RE: [Zope] Folder and SQL security
by Chris McDonough 05 Sep '00

05 Sep '00

George, Hi... please continue to respond to the list... Did you clear the acquire permissions settings checkbox for all the permissions in the "wholesale" folder? Does it make any difference? How are you testing this? Are you sure that you aren't logged in as "george" when you visit the wholesale folder? (e.g. are you stopping and restarting the browser to test this?) > I am about one quarter through '6-1-Security.stx'. I printed > all 41 pages. I > also printed the security chapter form the ZB so I am trying > to learn. It's > just that at the moment I need a quick fix. Here is my case in detail: > > My site is located in the folder 'okstudio'. The 'root' > folder also contains > a user folder and me as the only user. I am the manager of > the site(and the > superuser). Several subfolders under folder 'okstudio' > contain files that > can be accessed by anyone. All subfolders except for one have the same > security settings - 'view and access contents'. I also have > an sql method > that I use with <in> and </in> to embed data from my database > in to HTML. > The security settings of that method are - 'view, access contents > information and use database methods'. > There is one subfolder called 'wholesale' that should have restricted > access. No viewing without authorisation. That folder will > contain info for > customers only that should not be seen by anyone else. I > created a user > subfolder in that folder where I listed myself as a > 'manager'. I also took > every permission from 'anonymous' so theoretically > 'anonymous' should not be > able to view the content of that folder. I also created > 'index_html' DTML > document and took all the permissions from anonymous there. I > am still how > ever able to view the index_html as anonymous without any > authorisation. > My question is: Is there a way how to make sure that no one > unauthorised > gets to see any of the contents of 'wholesale' folder??? > > Regards, > > George > > > > -----Original Message----- > > From: Chris McDonough [mailto:chrism@digicool.com] > > Sent: Tuesday, 5 September 2000 10:08 > > To: George Osvald > > Cc: zope(a)zope.org > > Subject: RE: [Zope] Folder and SQL security > > > > > > On Tue, 5 Sep 2000, George Osvald wrote: > > > > > My sql works now and security is satisfactory so thank you. The > > only thing > > > that remains in question is that one subfolder. I created > a user folder > > > inside, set all the security and it does not do what I > want. I want to > > > restrict any access including viewing for nobody. Only > > authorised customers > > > would be able to view the page. After turning off all the > > security options > > > though I am still able to view the pages as nobody. How do I > > prevent that? > > > > Do you have "acquire permissions" set on all the permissions of the > > folder? Have you tried turning it off? > > > > This may be a wild goose chase because I'm sort of guessing at your > > problem. Your message has generalizations like "that one > subfolder" > > (what subfolder? what are its settings?), "set all the security" > > (how?), "does not do what I want" (what do you want? exactly how > > does it fail, can you give a concrete example?) and "the page" (what > > page?). It'd be helpful to define these, because as much > as I try, I > > can't read minds. :-) > > > > HTH, > > > > C > > > > > > > > > > George wrote: > > > > > > > > > > Security in ZOPE is very puzzling. If I have certain rules > > set for the > > > > > root folder, can I set something different for the > sub folders? > > > > > > > > Sure... for general security information see both > > > > http://www.zope.org/Members/michel/ZB (the Zope book > security chapter, > > > > mostly finished) and http://www.zope.org/Members/mcdonc/PDG (security > > > chapter mostly finished). > > > > > > > Any > > > > changes seem to have no effect at all. > > > > > > can you be more specific? > > > > > > > I am especially wandering about > > > > setting for anonymous user. I'd like to give them only 'viewing' > > > > privilege but that does not work. > > > > > > How doesn't it work? > > > > > > > The site is not functional at all and > > > > asks for the password even for the viewing. Then I enable > 'access the > > > > content' and the site works as long as I do not try to use sql. > > > > > > Yes, "access contents information" is equivalent to allowing > the user to > > > list the objects in an object manager. It's given to anonymous by > > > default most of the time, and is probably required for most > operations. > > > > > > > When I > > > > how ever enable 'use sql methods' permission they can access my > > > > database, delete and add entries to it. > > > > > > This should have nothing to do with 'access contents information'. > > > There should be permissions available to restrict the use of sql > > > methods. Have you seen them? > > > > > > > What do I have to do to allow > > > > anonymous viewers to just view the site > > > > > > Give them "view" and "access contents information" permissions. > > > Depending on the products you've got installed and the operations you > > > want the users to be able to carry out, you may need to give > them other > > > permissions. > > > > > > > (keep in mind that I am using a > > > > couple of zsql methods for embedding of data in my html) I > also want to > > > > have one of the sub folders not accessible to any one but me. > > > > Can you help anyone? > > > > > > Chris McDonough > Digital Creations, Publishers of Zope > http://www.zope.org > >

1 0

For the Zope community
by Shane Hathaway 05 Sep '00

05 Sep '00

Zopistas, It has been very rewarding to work with DC and the Zope community. I have learned a lot about software and community spirit. I have never had the opportunity to work with a more enthusiastic and dedicated group of developers. So at this time I'm releasing two new products designed to help Zope users to get their job done more easily. http://www.zope.org/Members/hathawsh/ZDebug/index_html ZDebug is a set of patches to Zope that help in the deciphering of DTML errors and authorization exceptions. Because this is the first release, remember to make a backup before installing. http://www.zope.org/Members/hathawsh/tcpwatch/index_html TCPWatch is a simple Python script that lets you monitor a TCP connection. It does *not* depend on Zope, but it can be especially useful when writing Zope apps for WAP devices because the WAP devices will not display Zope exceptions while TCPWatch will. It's also useful for debugging any TCP/IP-based protocol implementation. Keep up the awesome work! Shane

1 0

Could someone explain this DateTime behaviour to me?
by Dario Lopez-K�sten 05 Sep '00

05 Sep '00

AS in is this the expected/intended behaviour or could this be classified as a bug? --- bobobase_modification_time 2000/09/02 08:49:48.326 GMT+2 bobobase_modification_time().toZone('GMT+2') 2000/09/02 12:49:48.326 GMT+2 bobobase_modification_time fmt="%Y-%m-%d %H:%M" 2000-09-02 12:49 --- Thanks, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario(a)ita.chalmers.se ICQ will yield no hits IT Systems & Services

2 2

Re: [Zope] DTML horror
by JTC Murphy 05 Sep '00

05 Sep '00

They may be available in all installations but they aren't necessarily available to all users )-: Have fun, Murph (who is not actually complaining given the price he has to pay for use of a public Zope server) >>> Rik Hoekstra <rik.hoekstra(a)inghist.nl> 05/09/00 11:51:35 >>> Use Python Methods (http://www.zope.org/Members/4am/PythonMethod) or External Methods (available in all Zope installations RTFM). They will probably not completely replace DTML though.

1 0

Re: [Zope] Images slow rendering problem
by Oliver Bleutgen 05 Sep '00

05 Sep '00

> Hi, > I already posted this message several monthes ago, expecting a new Zope > version would fix the problem, but... > I have some images on my pages (let's say 10 - not a lot), rendered > either by dtml-var or a manual <IMG> tag. > When I render the page on some of my LAN boxes (especially with IE), > some images doesn't load at the first time. I need to reload the page to > make them appear. When I monkeyly hit the 'F5' key, some images do not > show again. Argl. Anoying.... > The problem is worst ever through Internet. Perhaps not the failure you see, but as you mention IE, there is at least one really annoying bug in IE 4 (all versions except SP2) and IE 5 (except 5.01). This may bite people trying to integrate zope into other webservers using redirects. http://support.microsoft.com/support/kb/articles/Q193/4/89.ASP?LN=EN-US&SD=… You might want to check what versions of IE you use. A last resort may be to use a sniffer to capture the http traffic for later analysis. Cheers, oliver

1 0

DTML horror
by Nick Trout 05 Sep '00

05 Sep '00

DTML is pretty horrible. Does anyone have any solutions to allow DTML methods to be generated using a more Pythonesque interface? It seems to me that DTML is a bit of a shoddy half way house between HTML and Python. Cheers, Nick.

3 3

ZODB efficiency
by Nick Trout 05 Sep '00

05 Sep '00

Is using ZODB efficient? Is it better to use ZODB than an external database? What are the benefits of using it? CHeers, Nick

2 1