November 2001 - Zope

R20 mapping
by sean.upton＠uniontrib.com 27 Nov '01

27 Nov '01

I'll take a look at it; primarily, I guess I'm curious how it maps threads and transactions; does it use a DA to manage that? I guess I can look at the code? Thanks for pointing this out. Sean -----Original Message----- From: Stephan Richter [mailto:srichter@cbu.edu] Sent: Tuesday, November 27, 2001 11:49 AM To: sean.upton(a)uniontrib.com; jacob(a)prisonbooks.org; zope(a)zope.org Subject: RE: [Zope] can I move my zope site off zope? >Best: Python API / abstracted framework for data access, used by Zope Python >product; well documented with UML diagrams of class relationships and >inheritance; ZPT for presentation. Persistent objects in ODB represent >underlying relational data. Reuse of code and patterns on future products. You know there is a tool called DBObjects out there that does the R2O mapping for you... ;-) It is used in some major projects too... Unfortunately, you need to know how to write Python products (just a little bit of it); one day I will use MakeProduct to generate all that automatically as well. Site: http://demo.iuveno-net.de/iuveno/Products/DBObjects >The downside to this is that it makes you do more work than simply using a >DA... but it buys flexibility... DBObjects does not bypass anything... :-) Regards, Stephan -- Stephan Richter CBU - Physics and Chemistry Student Web2k - Web Design/Development & Technical Project Management

2 1

srcipt for permission setting??
by andreas.kahnert＠de.abb.com 27 Nov '01

27 Nov '01

Hello, I have to set the permissions of various roles a lot of folders. How can I automize it. What kind of methode do I have to call from a pythonscript and what are the parameters? Do I have to call the script on the folders themselves or on the acl_uses of that folder? Thanks a lot Andreas

2 1

dtml-tree: how to jump to specific node?
by Stephan Herschel 27 Nov '01

27 Nov '01

Hej, I have a dtml-tree where i want to jump to a specific node, i.e. open the tree down to where this node resides. Is there a simple way to achieve this? (And btw, is there a zope-newsgroup somewhere, i find handling mailing-lists rather complicated ;-) Thanks for all replies, stephan

2 1

How to get a raw image?
by Gregory Dudek 27 Nov '01

27 Nov '01

I need to return a rew image from a URL on my zope server, that is, I want to return a random gif using something like <dtml-var "_.random.choice(....)"> so that a user on another server can call my zope URL as http://myzopeURL.../randomimage.gif INSIDE using their HTML of the form <img src="http://myzopeURL.../randomimage.gif"> Anything I try ends up giving back HTML code of the from <img src="....my image ID..."> instead of the raw image data. Can anybody help? Greg

3 2

Zope and php authorization
by Chris Herrnberger 27 Nov '01

27 Nov '01

Greetings Im at a disadvantage here as Im new to zope programming. What I would like to accomplish is to integrate in one zope site three existing php applications and one zope app that Im just completing. I dont need to have the php tree in zope but I do need to have the main site page secured via a logon prompt and have the same cookie or session authorize the user for access to the existing php applications. I have spend a day reading notes on zope.org on how to authenticate users in zope but there seems little relevance to existing applications (php or other). Can anyone point me to the appropriate references or perhaps possibly comment on the best methods to accomplish this integration/authorization exercise. Best and many thanks Chris H>

2 1

rename via FTP
by Arian de Wit 27 Nov '01

27 Nov '01

Hi All, Maybe I'm thick (fairly likely), but I'm trying to give a user access to renaming images via an FTP connection. I have given them a role with what I thought were reasonable permissions, but the rename keeps failing: > RNFR TUI7.GIF < 350 RNFR command successful. > RNTO TUI7.GIF9 < 550 error renaming file. I then gave the role *all* permissions on the folder's "Security" tab, and still no good. I finally gave the user the "Manager" role instead, and it works fine. What's up with that? FYI, I'm using Zope 2.4.3 on Win2K SP2. Any insight would be much appreciated, even if it confirms that I am indeed thick. Thanks a lot, Arian ------------------------------------------------------------------ Arian de Wit Information Systems Integration Manager NIWA (National Institute of Water & Atmospheric Research) Gate 10 Silverdale Road, Box 11-115, Hamilton, New Zealand 2001 Phone (+64) 7-856 1769 Fax (+64) 7-856 0151 Web http://www.niwa.co.nz ------------------------------------------------------------------

2 1

Login forms and selective dtml display
by Paul Merrill 27 Nov '01

27 Nov '01

Dear All, I'm looking for a little help on constructing a simple login/hidden section application. What I want to do is thus: 1. User visits my site anonymously and sees a list of links, like A, B, C. 2. Because they are anonymous they don't see the D link (I've put some dtml code around the D link so it will only display if they are authenticated). 3. On the left hand border, there is a username, password and login button. The user enters his username and password and presses the login button. The system checks the login and logs the user in with the standard Zope login process (whatever that is). 4. If the person is now authenticated, then the page re-displays and they see A, B, C, D. I know that I will need to create an input form for the username and password and the Login button will do the submit but once the server side received the information how does one call "zope" to log the person in? I'm assuming it's some python script that will do the job? Can someone point me to a code snip? Thanks, Paul

2 1

using webdav +windows explorer+ zope
by Clark OBrien 27 Nov '01

27 Nov '01

Hi: What are the steps to make zope webdav enabled. I started zope with the -W 7777 option which gave me another instance of the ZServer output below: In the add network place wizard I enter http://localhost:7777 but get the message "the folder you entered does not appear to be valid. Please choose another" 2001-11-27T22:16:00 INFO(0) ZServer HTTP server started at Tue Nov 27 14:16:00 001 Hostname: COBRIEN Port: 777

2 1

Re: [Zope] CoreSessionTracking: Brute-Forcing Web Application Session IDs
by Frank Tegtmeyer 27 Nov '01

27 Nov '01

"Chris McDonough" <chrism(a)zope.com> writes: > This is annoying, of course, but it's not too bad yet. Yes, it's annoying and because it can be made harder easily I recommend to do so. That's the thing I wanted to point out. > casually guess (19 characters, 8 of which are randomly generated), are > there mitigatable risks which have a solution that doesn't depend on > unchanging IP addresses that I'm overlooking? It's very cost effective to integrate a hash and a secret: It does cost nearly nothing for you, the maintainer of CoreSessions and it really costs nothing besides a few CPU cycles for the sites using it. But it makes it *much* harder for potential attackers to go for a session id. So I think it should be done:) Of course you are right to tell the people not to rely on sessions for sensitive data. For that there should be an integrated solution to require SSL for sensitive pages/views. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany

3 2

RE: [Zope] can I move my zope site off zope?
by sean.upton＠uniontrib.com 27 Nov '01

27 Nov '01

Ok, time to put on my advocacy hat... You have indicated you would be using PHP, so let me give you my personal opinion, for what it is worth: Mixing SQL/code/HTML in the same file/module is bad bad bad. After doing a big team-developer project in ASP a few years ago, I see the inherent lack of scalability of this sort of setup; with ZPT, ZSQL methods, etc in Zope, you get true separation of concerns, modularized code you can unit-test (without having to resort to functional software testing). For working with relational data, here's my personal opinions: Fair: ASP/PHP/JSP Good: ASP+COM/PHP+MODULES/JSP+EJB Better: Zope with DA/ZSQL methods / TTW python scripts / ZPT uses the TTW Python scripts Best: Python API / abstracted framework for data access, used by Zope Python product; well documented with UML diagrams of class relationships and inheritance; ZPT for presentation. Persistent objects in ODB represent underlying relational data. Reuse of code and patterns on future products. I don't understand what you mean a DA is hard to set up... for me, "apt-get install zope-mysqlda" worked for me ;) Your app is "distributed?" Lots of PHP apps used shared memory for IPC, or make you broker things like session data and stuff normally done in memory into your RDB if you want to make them cluster-safe. ZEO with Zope is soooooo much easier, and very transparent - it makes the burden of clustering a sysadmin job and NOT a developer job. Use ZPT for the templating, and Python products for your code, and restricted TTW python scripts as glue when necessary. Since you are obviously concerned with application interoperability, why not consider that you are not likely to get stuff like XML-RPC working out of the box with PHP. Also, IHMO, there is a better way to do this in Zope and get the interoperability you desire: a hybrid persistent object+relational storage model. I have an application I'm building now that will store between half-a-million to a million records scattered over several databases and about a dozen tables in a MySQL InnoDB tablespace; all work is handled in an API I built from scratch for this project that maintains thread-safe connections to the database and an abstracted OO API to the data, which handles things like MySQL transactions, database integrity, and data access, bypassing the use of a DA/ZSQL methods altogether. The core API is done in Python using MySQLdb; you create a DB class designed to handle connections and basic operations, as well as a record class for each logical view of your underlying relational database. The key to getting the most out of this setup is that the API is used by a Zope product module that creates proxy objects (subclassed from the previously mentioned record API object, CatalogAware, and SimpleItem) for each of these logical views, and stores them in a container for each view (a container class subclassed from BTreeFolder). The proxy objects do nothing but provide an object-per-record in a view; making these proxy objects persistent allows a useful hybrid storage model, which you can then catalog the data using ZCatalog, and present things like full-text indexes through Zope for any relational data. The downside to this is that it makes you do more work than simply using a DA... but it buys flexibility... The upside to this is that the design pattern works, provides all the key components of a very object-oriented way of doing things; and once you do your first project for relational data this way, you can reuse the same design patterns on your next relational data integration project in a fraction of the time. Doing this really requires you to be able to know your underlying API, and the use of UML class diagrams of your API on your first project is very helpful as a reference for using this design pattern and to apply to later projects using similar techniques. My honest opinion: if you are willing to do things right, for big projects with multiple developers or a need for reusable code and/or patterns, Zope is a better platform than any light-weight template/code hybrid framework like PHP/ASP/JSP, etc. My company uses PHP for lightweight stuff, including some simple task automation, but for any heavy-duty tasks, we use Zope; and there is nothing to preclude using both, if you use relational data or an interoperability standard like XML-RPC. And to be honest, I think the best thing about Zope is this: 6 months from now, if you want to reuse - or for that matter re-read - your own code, Python is going to be far superior to any other language, especially if you have to fight your way through all the HTML in that same module/file with a machete! Sean -----Original Message----- From: Jacob Singh [mailto:jacob@prisonbooks.org] Sent: Tuesday, November 27, 2001 7:35 AM To: zope(a)zope.org Subject: [Zope] can I move my zope site off zope? So I'm considering doing a major product with zope, and I'd like to hear what people think about taking a site off of zope. I know it's a great framework to build in, but I'm really used to Database programming and ma inclined to use that. I know you can have SQL adapters in Zope, but for two reasons I don't want to use them, 1. They can be a hassle to set up and since this is a distributed app, this might be a problem. 2. It doesn't really take advantage of the object oriented nature of zope's content management. It basically then is just an excuse for a good templating engine. What I am worried about though is if I build my product without SQL(it is a task management/portal suite), it will forever live on Zope, and getting to that data from other programs will be next to impossible. Does anybody have any experience/advice on this, please let's hear from the zealots AND the skeptics. I know Zope is awesome, I just want to make sure it doesn't get me in a proprietary bind. Thanx J _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1