May 2001 - Zope - Zope lists

addressbook security
by Dan Kronstadt 12 May '01

12 May '01

Is anyone using the addressbook by morphex? I am having trouble getting security set up so anyone but the folder owner, or maybe someone with the manager role, can add new contacts. I suspect the problem may actually be with threadsafecounter, rather than with addressbook itself. I have given my users EVERY permission listed on the security page and I still get prompted for a new signon. My users do exist at a higher level in the folder hierarchy than the address book. And I am running this on win2k. Any suggestions appreciated. I am pretty new to ZOPE, but learning fast.

1 0

Concurrency control
by Nils Kassube 12 May '01

12 May '01

Guten Abend. According to the Zope Developer's Guide our favourite web application server prevents dirty reads with his transaction support. Is it possible to prevent non-repeatable reads and phantom reads, too? Or should I use a more appropriate tool like PostgreSQL with support for MVCC? Is there more documentation about Zope's transaction support? (Or is it another case for "Read the source, Luke"?) Cheers, Nils

1 0

ZCatalog (2.3.1) won't acquire method from parent folder?
by sean.upton＠uniontrib.com 12 May '01

12 May '01

Running Zope 2.3.1; A ZCatalog instance that I have won't acquire a method from the parent folder it resides in; I get a NameError on the method. This is very strange. The method is called from another method whose results are supposed to be indexed. +Zope Root +Classifieds (Container, Subclassed from Folder, contains a method called iterateText(self, text, times)) Catalog (ZCatalog) I have a text index set up for a method called searchTextWeighted, which is a DTML template file on disk within a python product. Inside searchTextWeighted, I have the following DTML: <dtml-var expr="iterateText(getTitleExpanded(), 5)"> iterateText is a method of a python class that is subclassed from ZCatalog.CatalogAware and OFS.Folder.Folder: def iterateText(self, text, times): """Repeats output of text times # of lines for # of times""" result='' times=int(times) for item in range(times): result=result+text+'\n' return result I get a name error for iterateText upon trying to add a catalog-Aware class, when index_objects() is run (I just made this class Catalog-aware). This is weird, since, in terms of namespaces, iterateText is in a folder above the Catalog, and also above the item I am trying to ad, so no matter how you look at it, iterateText should be acquired, and not generate a Name Error. In testing this out, I am able to traverse to iterateText via URL in a browser with no problems. I assume that this is not related to the ZCatalog bug in 2.3.1 where the Catalog won't run a method requiring arguments. The method in the index, searchTextWeighted, passes all the arguments needed by iterateText in the DTML. So I am a bit confused here. Traceback is below. ------------------------ Traceback (innermost last): File /usr/lib/zope/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /usr/lib/zope/lib/python/ZPublisher/Publish.py, line 187, in publish File /usr/lib/zope/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook File /usr/lib/zope/lib/python/ZPublisher/Publish.py, line 171, in publish File /usr/lib/zope/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: manage_addAdItem) File /usr/lib/zope/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: manage_addAdItem) File /usr/lib/zope/lib/python/Products/DailyClassifieds/item.py, line 251, in manage_addAdItem File /usr/lib/zope/lib/python/OFS/ObjectManager.py, line 302, in _setObject (Object: Traversable) File /usr/lib/zope/lib/python/Products/ZCatalog/CatalogAwareness.py, line 114, in manage_afterAdd (Object: CatalogAware) File /usr/lib/zope/lib/python/Products/ZCatalog/CatalogAwareness.py, line 184, in index_object (Object: CatalogAware) File /usr/lib/zope/lib/python/Products/ZCatalog/ZCatalog.py, line 429, in catalog_object (Object: Traversable) File /usr/lib/zope/lib/python/Products/ZCatalog/Catalog.py, line 448, in catalogObject File /usr/lib/zope/lib/python/SearchIndex/UnTextIndex.py, line 323, in index_object File /usr/lib/zope/lib/python/App/special_dtml.py, line 127, in __call__ (Object: searchTextWeighted) File /usr/lib/zope/lib/python/DocumentTemplate/DT_String.py, line 538, in __call__ (Object: searchTextWeighted) File /usr/lib/zope/lib/python/DocumentTemplate/DT_Util.py, line 334, in eval (Object: iterateText(getTitleExpanded(), 5)) (Info: iterateText) File <string>, line 0, in ? NameError: (see above) ---------------------- Sean ========================= Sean Upton Senior Programmer/Analyst SignOnSanDiego.com The San Diego Union-Tribune 619.718.5241 sean.upton(a)uniontrib.com =========================

4 4

Re: [Zope] my solution to #include in DocumentTemplate
by Dieter Maurer 12 May '01

12 May '01

Lance E Sloan writes: > ... > What I was looking for was > something like: > >  > > in a DTML file to include another DTML file, recursively. I > ended up doing this: > >  >  >  Interesting that "DocumentTemplate" is exposed this way. Will hopefully not work inside Zope (potential security risk). > It works well. The only problem is that for every object I want > to pass to the included document must be specified individually > (x = x). I tried these but they didn't work: You should learn about the two (optional) positional arguments of "DocumentTemplate.HTMLFile.__call__". One source is the DTML section of URL:http://www.dieter.handshake.de/pyprojects/zope/book/chap3.html If you pass "_" as second parameter: <dtml-var expr="incDoc(_.None,_,x=x)"> or simply use <dtml-var incDoc> then your incDoc should have access to the name in the calling namespace. Dieter

1 0

Re: [Zope] Disappearing images in python product...
by Dieter Maurer 12 May '01

12 May '01

sean.upton(a)uniontrib.com writes: > I have a class in a python product that defines the following: > manage_admain = Globals.HTMLFile('dtml/editForm', globals()) > editad_image = Globals.ImageFile('images/editad.png', globals()) > > Within dtml/editForm.dtml: > <dtml-var editad_image> > > I used this to display an image within a managment interface page I had set > up. > > The image won't load (it is missing). This used to work, but at some point > recently became broken. I'm not sure why; I can't pinpoint exactly when it > happened. At some point, I changed the meta-type of this class, but I think > that is all I have really done... If you apply "dtml-var" on an image object, it should produce an "<img src='...'>" tag. Did you look at this tag (in the HTML source)? Is it correct? If not, then the way it is wrong, can give you a hint. If it would be correct, one would need to understand why URL traversal can no longer reach it. I assume, it is part of your product class? Then it should be accessible by "<URL for your product instance>/editad_image". Try to access it this way directly (entering the URL in the browser directly). This should give you quite a good problem message.. Dieter

1 0

Postgres and transactions
by John Morton 12 May '01

12 May '01

I'm attempting to use a ZSQL method to create a new user in a postgresql database (in the CREATE USER... sense), using Popy and postgres 7.0. The problem is that CREATE USER throws an error if you use it inside an explicit transaction. So: Does any know how to explicity turn off transactions for a particular ZSQL method? Do any of the other postgresql adapters work any better? (I'd test them, but I've had build troubles with the others.) Can I get away with just inserting the appropriate data into pg_user or is CREATE USER doing some other magic? I'd be grateful for any clues anyone has. John

2 2

page templates - render all of request?
by Jason Byron 12 May '01

12 May '01

How do you get page templates to render the request without escaping the html? If I use this: <div tal:replace="request"/> I get the request table html all html_quoted like. I guess "un_html_quote" is what I want. Any ideas? __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

2 1

sign 'o the times
by Jason Cunliffe 12 May '01

12 May '01

While browsing this afternoon, I picked out of the the rack the June copy of British computer magazine 'PCPLUS' [www.pcplus.co.uk] The magazine is sealed in a glitzy silver foil bag,and emblazoned with crude red and black promo typography: OVER 4,000 POUNDS of FULL Softare with this isse. 2 X CD BONANZA - Migrografix Picture Publisher - ASP Edit 2000 - Perl LEditor 2.2 - Access Payroll - Ashampoo Uninstaller - LINUX (includes Nautilus 1.0 and Zope) ./Jason ___________________________________________________________ Jason CUNLIFFE = NOMADICS['Interactive Art and Technology']

1 0

Re: [Zope] addtional property in dtml-tree?
by Tim Cook 12 May '01

12 May '01

Klaus Herrmann wrote: > > On Fri, 11 May 2001 08:33:26 -0500, Tim Cook said: > > > Klaus Herrmann wrote: > > > > > > Hi! > > > > > > I have the following problem: > > > i have a dtml-tree listing the directory structure. but i want to be able > to > > > define a property called "hidden" (bool) on folders. these hidden folders > > > mustn't appear in the tree. any ideas how this could be done? > > > > > > thank in advance! > > > > UNTESTED, stab at it: > > > > <dtml-tree branches_expr="objectValues(['Folder']) AND NOT > > is_hidden"> > > doesn't work: "invalid syntax (line 1)" (when trying to save the dtml doc). > if i write "and not" instead of "AND NOT", the tree doesn't have any branches > anymore :-( This works, but may not be exactly what you are looking for though? --------------------------------- <dtml-var standard_html_header> Normal Tree<br> <dtml-tree branches_expr="objectValues(['Folder'])"> <dtml-var id> </dtml-tree> Hidden Folder Test<br> <dtml-tree branches_expr="objectValues(['Folder'])"> <dtml-if expr="not is_hidden"><dtml-var id></dtml-if> </dtml-tree> <dtml-var standard_html_footer> --------------------------------- There may be a way to get it to work in the branches_expr??? -- Tim Cook, President - FreePM,Inc. http://www.FreePM.com Office: (731) 884-4126 ONLINE DEMO: http://www.freepm.org:8080/FreePM

1 0

Re: [Zope] manage permissions
by dave＠kovach.com 12 May '01

12 May '01

Thanks for the tip on the product. Will look into it. I need to dive into the security issues, but I have moved alot of my stuff to a hosting environment that definately has more experience with this stuff. That way I can focus on developing more and admin'ing less. But, the security seems alittle lax with Zope. With the flip of a checkbox - anyone can then get into my backend. Not good. And to do it on error is I think even worse. Would never fly in corporate land. But Zope rocks none the less. Thanks David On Fri, 11 May 2001, Flynt wrote: > > Charlie Blanchard wrote: > > > > On Fri, May 11, 2001 at 01:58:50PM -0600, Casey Duncan wrote: > > [snippity snip snip] > > > > > > It sounds like your Anonymous role has the View management > > > screen permission set somewhere (like at the root). Check it in > > > the security tab of your root folder. > > > > > After reading this post I felt the need to check my server to > > double check my settings and wonder if there is some source of > > info about some of the permissions that I'm overlooking. > > For instance, just what is it that allowing "Access contents > > information" permits or blocks? And what baseline permissions > > should be enabled/disabled on a 'live production' server as a > > matter of good practice? Any info that someone can provide or > > point to would be very welcome indeed... > > > > tia, > > -- > > Hi Charlie, hi Dave > > There is product by Tres Seavers, which at least helps, to get a better > look into a Zope installations actual security settings. I just mention > it, in case you don't know: > > http://www.zope.org/Members/tseaver/ZopeSecurityAudit > > Maybe, this is of some help for you. It was for me. > > Flynt

2 1