May 2001 - Zope - Zope lists

[Zope][ANN] ZImporter 0.4
by Farrell, Troy 25 May '01

25 May '01

Hiya folks. I'm more than happy to announce ZImporter v0.4 featuring: * Bug Fixes: It works now :) * XML Import: It works now, too :) * Help files: They've been there, but thanks to the ZDG, I've figured out how to make them show up. Your feedback, both positive and negative is welcome. Please keep death-threats to a minimum :) **Please read the readme and be aware of the security risks involved when using the ZImporter.** http://www.zope.org/Members/tfarrell/ZImporter/ Troy Troy Farrell Video Operations Technician III Williams VYVX Services Business Media Services mailto:troy.farrell@wcg.com

1 0

Disabling anonymous webdav access
by Ivo van der Wijk 25 May '01

25 May '01

Hi All, As someone pointed out on #zope, it is possible to view folder contents using a webdav client as an anonymous user. I.e. download cadaver (http://www.webdav.org/cadaver/) open yourzopeserver:8080 and do ls. Then decide if you want anyone to be able to access this. Eventhough hiding this information may be security by obscurity, there are some things you just don't want everyone to see. This allows you to see, for example, the installed products on the server. A hacker might use this knowledge to exploit some known bug in a zope product if one exists. Most people (like me) probably think it's harmless to let old objects, documents etc linger around as you can't view them in listings through ftp or http. They don't realize webdav is running by default. Actually, it can't even be disabled! (z2.py -X -w80 won't do the trick!) Personally I'd rather see this secured. It's not possible to disable 'view contents information' for anonymous users in zope, as this will ruin your entire site (all anonymous access will then be disabled), so the solution would be to create a new permission for access contents through webdav. And that's what the following (trivial) patch does. After applying you'll get a new permission in your security tab, which is set to manager by default. To get the old behaviour back, just set the permission back to anonymous. Apply it using patch -p1 ../webdav.patch in your SOFTWARE_HOME (i.e. the Zope-2.3.2-src dir). Or just edit lib/python/webdav/Resource.py by hand :) I've tested it with Zope 2.3.2, I can't guarantee it will work with other versions (use at your own risk anyway). -- cut here -- *** Zope-2.3.2-orig/lib/python/webdav/Resource.py Tue Mar 27 21:50:37 2001 --- Zope-2.3.2-src/lib/python/webdav/Resource.py Mon May 14 19:16:46 2001 *************** *** 109,115 **** __ac_permissions__=( ('View', ('HEAD',)), ! ('Access contents information', ('PROPFIND',)), ('Manage properties', ('PROPPATCH',)), ('Delete objects', ('DELETE',)), ) --- 109,115 ---- __ac_permissions__=( ('View', ('HEAD',)), ! ('Access contents information through WebDav', ('PROPFIND',)), ('Manage properties', ('PROPPATCH',)), ('Delete objects', ('DELETE',)), ) -- cut here -- Cheers, Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam -=- Tel: +31-20-4688336 Linux/Web/Zope/SQL Fax: +31-20-4688337 Network Solutions Web: http://www.amaze.nl/ Consultancy Email: ivo(a)amaze.nl -=-

4 4

Re: [Zope] Choosing between ZODB and relational database/filesystem storage
by Casey Duncan 25 May '01

25 May '01

Casey Duncan wrote: > > magnus/Websys(a)websys.no wrote: > > > > > .. 'use ZODB' campaign > > > > Actually my main motivation for using a separate database in many of our > > applications is that it forces me to have a well-documented data structure. > > > > -Magnus > > > > If you use ZClasses or external Python classes, the same is true for the > ZODB. Granted if you just throw standard objects all over the place, it > isn't self-documenting at all. However, I think this is a weak argument for more complexity. -- | Casey Duncan | Kaivo, Inc. | cduncan(a)kaivo.com `------------------>

2 1

Vote for Windowing Toolkit to use for Fat Client
by Chris Withers 25 May '01

25 May '01

Hi, A couple of us here at NIP are playing around with building a fat client for Zope, based on Python and hopefully using a ZEO connection to do most of the interaction. We're looking at both wxPython and Tkinter as possible windowing toolkits. Which one would you choose? Why? ;-) cheers, Chris

20 41

RE: [Zope] Tree tag cookie questions
by Dunigan, Craig 25 May '01

25 May '01

Thanks, Michel. This clears up a lot. Unfortunately, it doesn't clear up the worst problem I have. See below. > On Thu, 24 May 2001, Dunigan, Craig wrote: > > > <dtml-tree expr="REQUEST.resolve_url(BASE3)" > > You shouldn't use REQUEST.resolve_url. Use > restrictedTraverse instead. As an aside, why? And what syntax? When I tried it, Zope complained that it couldn't find 'http:', which I assume means that I have to strip the 'http://' off of BASEx to use restrictedTraverse? > > A user hits /folder1, generates a tree, modifies the tree > state and gets a > > cookie. Then he hits one of the links above, goes to > /folder1/folder2, > > generates a new tree, but with the state saved in the cookie. If he > > modifies the tree state yet again, does he get a new > cookie, obliterating > > the previous tree state, or does the same cookie get > modified, saying "for > > page /folder1/index_html the tree state is 'x', for page > > /folder1/folder2/index_html the tree state is 'y'?" > > The former: the old cookie gets obliterated. There is only > one 'tree-s' > cookie, and it can only hold the state for one tree, the last > tree viewed > by the user. So, under this scheme, I'm right in saying that the tree on /folder1/folder2/index_html gets created using the tree state saved in the last 'tree-s' cookie, which was generated from /folder1/index_html? If that's true, then why, in navigating down a fairly long branch, would the tree suddenly collapse when the last folder is clicked? Wouldn't Folder(x)'s tree get generated using the cookie from Folder(y), if that was the point at which the tree state was last changed? Because I can verify myself that this happens, not consistently, but with some regularity. The only things I can state clearly so far are that it happens more often in IE than Navigator, and it happens _almost_ always if that last folder is empty. I'm doing some more tests, but the users are really pissed that they click through half a dozen folders and, when they hit the last one, everything they just opened closes up again. > I'm sure you could try and extend the tree cookie to be more > all-encompasing as you described above. This would have the upshot of > allowing two trees on the same page. > Nice plug for user contribution! I doubt I'll be able to pick it up, but it makes me wish I could. :)

1 0

[WARNING] ZShell 1.0
by Jerome Alet 25 May '01

25 May '01

Hi, Sorry, but I've forgotten to enable some code which was commented out just for a test before uploading ZShell 1.0 This means that unfortunately the setperms command doesn't check if the user has the "Change permissions" permission before changing permissions, and changes them. I've uploaded a correct version, so for those of you who have already downloaded it, please download it again from: http://cortex.unice.fr/~jerome/zshell The correct version is zshell-1.0.tar.gz dated May 25th 2001, 5:00pm french time, and is 37132 bytes long. Sorry for the inconvenience. Jerome Alet - alet(a)unice.fr

1 0

Can I put XML code directly into an DTML document ???
by Gitte Wange 25 May '01

25 May '01

Is subject possible ? Gitte

2 1

Testing for how an object is called.
by kosh＠aesaeion.com 25 May '01

25 May '01

I have several kludge ways now that do the job but none I entirely like. How can I check for the difference between being called with <dtml-var foo> and being called from foo.com/foo ? This behavior is used for both internal and external behavior of the object. Thanks Designing the webpages of tomorrow http://webme-eng.com Designing the MMORPGS of tomorrow http://worldforge.org

3 3

Re: [Zope-Annce] mod_pcgi2 version 2.0.0
by Oleg Broytmann 25 May '01

25 May '01

Hello! Please note - I am replying to the list, too. On Fri, 25 May 2001, Chris Ryland wrote: > How is this different from/better than the standard FastCGI module? > > > > http://www.zope.org/Members/phd/mod_pcgi2/ > > > > mod_pcgi2 - Apache module for Zope/PCGI - reached version 2.0.0! This > > version compiles and runs under Apache 2.0, as well as Apache 1.3+. Well, not sure about how it is "better", other that exactly the point of announcement - it now works with Apache 2.0. Probably, not many people use Apache 2.0 - it is in early beta stage; I even sent a bug report while debugged my module :) On the other hand, it was not completely ported and tested on Windows. Let's talk about differences. 1. The module implements different protocol - PersistentCGI instead of FastCGI. You don't have to use PCGI with Zope - you can run your own PCGI (but the module was really tested only with Zope). http://starship.python.net/crew/jbauer/persistcgi/index.html 2. The module does its best to be compatible with Zope's SiteAccess. This allow you to configure your virtual hosts with a bit less pain. FastCGI is not very mature in this aspect (though it is good enough). Oleg. ---- Oleg Broytmann http://phd.pp.ru/ phd(a)phd.pp.ru Programmers don't die, they just GOSUB without RETURN.

1 0

Zope folder property manipulation problem
by Bobby Mathew 25 May '01

25 May '01

Hi guys I am struggling with a small part. I passed the following parameter to this python script - fname, newvar, newval, newtype I am trying to change the current variable say memberid which is passed within newvar with a newvalue say 100 which is passed in newval. But its not getting changed. The line indicated below has no effect ------------------------------------ if container.hasProp(fname, newvar): container[fname].manage_changeProperties(newvar = newval) (this line is suppossed to make the change - but no effect) print fname + '-0' else: try: container[fname].manage_addProperty(newvar, newval, newtype) print 1 except: print 0 return printed ----------------------------------- how do i make python understand that i want the value with the newvar to be used and to be set with the value within newval ??? please advice me. thanks bobby

1 0