May 2001 - Zope - Zope lists

Webdav security(hole?)question.
by Antwan Reijnen 13 May '01

13 May '01

Hi All, I have a weird security problem with my Zope installation. I'm now running Zope 2.3.2 on Windows98, but the problem also occurred in Zope 2.3.1. I installed a Webfolder in my explorer, to gain access via Webdav to the Zope Server. It did'nt require a username/password to gain full access to the server... I tried to change my password from within Zope, but that did'nt change a thing... I can walk in, without authentication needed...! I was worried about this, so I decided to test Webdav on some Windows2000/IIS5 servers on internet too, to see if they required authentication. And a shocking 1 out of 4 servers I tried, where completely open to Webdav... I could retrieve directory listings, and I also had WRITE privileges. Some very important, large websites contain this accesshole. How is this possible???? How can I fix this hole in my Zope installation? Can I disable Webdav access completely, if there is no short term solution? Any help is greatly appreciated. Thanks in advance, greetings, Antwan Reijnen.

4 4

Trailing 'L' after number values
by Neil Blue 13 May '01

13 May '01

Hello, I am getting integer numbers from mysql with a select clause. The values are stored as int types, however when I retrieve them via a Z SQL method and show them on a page, they display with a trailing 'L'. e.g. 12L instead of 12 Does anyone know why this happens. It also occurs when I test an sql statement. However it has only recently started to do this and I am not sure why. Thanks Neil Blue

2 1

ZWN - didn't they say it would be weekly?
by Jason Byron 13 May '01

13 May '01

Didn't they say it would be weekly? Can't get enough of that zope stuff. __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

4 3

Re: [Zope] attribute error?
by Jeff Sasmor 13 May '01

13 May '01

I don't use python scripts, but wouldn't it be correct to use for x in context.shopping_cart.test3(): instead, since test3 appears to be a function.. jeff sasmor -----Original Message----- From: Tom Deprez <tom.deprez(a)village.uunet.be> To: zope(a)zope.org <zope(a)zope.org> Date: Sunday, May 13, 2001 8:57 AM Subject: [Zope] attribute error? Why does the following script returns an attribute error? for x in context.shopping_cart.test3: print x while test3 only contains return [1,2] Tom. _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

attribute error?
by Tom Deprez 13 May '01

13 May '01

Why does the following script returns an attribute error? for x in context.shopping_cart.test3: print x while test3 only contains return [1,2] Tom.

1 0

RE: [Zope] ZCatalog (2.3.1) won't acquire method from parent fold er?
by Oliver Bleutgen 13 May '01

13 May '01

> So, in a slightly different light, here is my problem: if I use one of > these > DTML methods as an index, it has problems evaluating code because it (the > Catalog) runs the method, but it will not successfully obtain the > namespace > of either the object I am trying to catalog / add, or the namespace of the > acquisition parent of the newly created - just about to be indexed - > object. > The implication of this, is that while evaluating the DTML, there is a > NameError raised for ANY call to a method within an object of the class > you > are trying to index; I did not try accessing properties, but I assume that > they would suffer the same fate: evaluation of the DTML, being run by the > Catalog as an agent, would fail to resolve the namespace of the object for > which it is trying to index, and this would mean that any calls to > methods/properties of the object from within the DTML would fail with a > NameError, raising an exception that breaks any Catalog Aware object > attempting to use a DTML method as a text index. I think i have the same problem. I have a method inside a (folderish) zclass instance which calls another method some levels up via dtml-var. This breaks adding the classes via "find objects to catalog" - i.e. I get said name error. I guess this is also the reason why importing the top-level folder, which contains the zcatalog, of that site breaks - I get the same error. cheers, oliver

1 0

get a object using its id inside a pythong script
by alan runyan 13 May '01

13 May '01

retObjs = [] """ this is very inefficient, but works ;( for award in context.assignedAwards: for objId in context.marketingAwards.objectIds(): if award==objId: retObjs.append(objId) """ for award in context.assignedAwards: if award in context.marketingAwards.objectIds(): retObjs.append(context.marketingAwards.award) #get a award Attribute Error.. how do i do this? #appears in DTML you would use teh _.getitem(objId) hack, where is getitem? return retObjs Question 1: how can i please do this efficiently? Question 2: why doesnt ObjectManager have a getObject(self, objectId) method on it? or am i overlooking something? Question 3: abit off topic-- are people generally happy w/ data centric ZClasses? some people scare me with their experiences, but it seems that purely data centric ZClasses (although can be brittle) -- are nonviolatile things. I am pushing ZOPE as a solution and am selling ZClasses very heavy -- nonprogrammers will be maintaing the system after its done. (service oriented objects - I would do in Python) thanks in advance, ~runyaga

2 1

Creating your own list to use with dtml-in
by Tom Deprez 12 May '01

12 May '01

Hi, Can somebody tell me how I can create a list which returns a same list as with an zsqlmethod? for instance the following list {5:{name:'tom', address:'xxx'}, 7:{name:'Lies', address:'xxx'}} Now, I would like to use it as <dtml-in list> <dtml-var address> </dtml-in> Can somebody tell me how to do this? Thanks, Tom

1 0

security questions
by Arkaitz Bitorika 12 May '01

12 May '01

Hi all, I'm learning about the Zope security system, and have a couple of questions that I coulnd't find an answer for: * Even though in my acl_users folder in Root the Anonymous sole has no permissions enabled, I can access as anonymous to any page, why's this? * The Zope Book says that in the security tab there is a text entry that allows adding user defined roles. I don't see that entry, I only get the permissions/roles table. I'm logged in as admin all the time. How can I define a new role? * I will have editors on my site, who should be able to edit/add content, but not to change scripts, or other things. Is it a good idea to define an "editor" role for them and then adjust the pemissions accordingly? Sorry for the number of questions, and I'd appreciate any pointer to info or solutions about them. TIA, Arkaitz.

2 1

[BUG] in OFS/Traversable.py
by Jerome Alet 12 May '01

12 May '01

Hi, there's a bug in OFS/Traversable.py line 169 (on Zope 2.3.0 and 2.3.2) in unrestrictedTravese() there's: --- CUT --- if name[0] == '_': # Never allowed in a URL. raise 'NotFound', name --- CUT --- but when calling restrictedTraverse with only '/' as the path argument the test above raises an IndexError, and it's possible that the rest of the function unrestrictedTraverse doesn't work correcly even when correcting this bug with a "if name and name[0]=='_'" (UNTESTED). Example: make a Python script, which has only the following line: --- CUT --- return repr(context.restrictedTraverse('/')) --- CUT --- Click on the Test tab, that's it ! Theorically and if I understand correctly what restrictedTraverse and unrestrictedTraverse are for, it should return the top level object i.e. the root folder object or application object. hoping this helps Jerome Alet

1 0