July 2001 - Zope - Zope lists

Puzzling security problem
by Joel Burton 13 Jul '01

13 Jul '01

I have a puzzling security problem w/ZClasses. I have two ZClasses: * JBookReviewer, a folderish class that holds JBooks * JBook, a book-review class w/properties and methods to display a book The site is a book-reviewing site where individual people can become members. I have the coding to allow people to join, become a reviewer, etc. Where I'm having problems is w/ZClasses + ownership. The folder structure is: /books <- regular folder /reviewers <- " " /joel <- JBookReviewer /book1 <- JBook ... <- " /bob <- JBookReviewer /book11 <- JBook I want each to be able to manage her/his JBookReviewer properties and books. Each user is already the owner of their JBookReviewer, so I thought that I could use the "Owner" role of the Reviewer items. Rather than having to change every Reviewer folder's security, I changed the Security for /reviewers so that Owner role is allowed to view management screens, update properties, etc. Unfortunately, even though bob is the owner of Bob's JBookReviewer folder, he's not able to manage it -- security denied. Is there something different I need to do to handle owner privileges for ZClasses? Any pointers would be appreciated. Thanks! -- Joel Burton <jburton(a)scw.org> Director of Information Systems, Support Center of Washington

1 0

from zclasses to zclasses...
by bonnyk 13 Jul '01

13 Jul '01

first, thanx ender for pointing me in the right direction about excel to zclasses conversion now i have to convert quite a lot of zclasses from an old zope (which i definitely don't want to keep) to some new classes on a new zope on another machine how can i do that ? until now, i generated forms to create those classes, but i can't do that for *many* elements i know there must be a way, but right now, i'm in the dark... b

1 0

General Publishing Question
by Nat Harari 13 Jul '01

13 Jul '01

And one more question. :) I'm trying to use Zope here at work to make it easy for everyone to publish to the site. Is there anything out there that can basically make it easy for a moron to publish to his/her part of the site? Nobody her knows what a <P> tag is for, etc...I'm trying to make it so that they simply create a text document, drop it in the right place (a folder) and then it's already up and running in zope, listed et al on the DB, in the search function, dynamically pulled online, etc... Any way to do that? I can't imagine anyone here logging into the Zope GUI and trying to figure out what to do next. I could train them but they don't have time and I don't think they should have to do that, in the end. So...any remarks? :) Thanks. BTW, great list. I'm learning a lot just by reading on here. :) Newbie Nat.

4 5

Fwd: Re: [Zope] External files
by Thomas Olsen 12 Jul '01

12 Jul '01

I just found out that I forgot to cc this to the list: ---------- Forwarded Message ---------- Subject: Re: [Zope] External files Date: Tue, 10 Jul 2001 23:59:33 +0200 From: Thomas Olsen <tol(a)tanghus.dk> To: Dieter Maurer <dieter(a)handshake.de> OK - I'll try to be a bit more clear :-) The File('www/my.jar') was simply my unqualified guess that when you could make a DTMLMethod object using DTMLFile('dtml/editForm', globals()) then maybe you could create a File Object doing something similar ;-} - but that wasn't so... What I wan't to do is to create some File objects using python containing a jar file (application/x-jar) and a java class file (application/x-java). When I do it using the web management screens (Select type to add... => File) everything works ok but I cant find out how to do it programmatically. On Tuesday 10 July 2001 20:30, you wrote: > Thomas Olsen writes: > > This is propably an FAQ but I couldn't find an answer to it: > > I'm extending a product which has a java applet on one of the management > > screens. How do I get the class file and the jar? > > I've tried something like: > > > > --cut------------- > > def my_jar(self, REQUEST): > > return self._my_jar > > > > _my_jar = File('www/my.jar') > > --cut------------- > > > > but that absolutely didn't work... > > And what happened? > > > A few more questions (we need more context): > > * what is the "File" above. Where did you get it from? > > * usually, you should not simply return objects > but rather their content. > > If "_my_jar" is really a "OFS.Image.File" object, > then you may succeed, as ZPublisher will convert > the object returned into a string, which > give the content for a "File" object. > > > Dieter -- Regards Thomas Olsen ------------------------------------------------------- -- Regards Thomas Olsen

2 2

(simple) login question
by Menno 12 Jul '01

12 Jul '01

Hello all, I have a question about a simple login by users via a loginform on the site. I made a loginform which is in my opinion perfectly ok to authenticate a user on a certain page or folder, but yet when I try to login I A: still get the promt for the login, and B: If a user is not authenticated I get the standard zope authentication error instead of the webpage I made that should tell you "login failed etc." Obviously I must be doing something wrong, I'm hoping someone can help me out with this. Below is the code and some specs. The login form : <form action="test" method="POST"> <input type="Text" name="__ac_name" size="40"> <input type="password" name="__ac_password" size="40"> <input type="submit" name="submit" value="Login"> </form> The Authentication script : <dtml-if "REQUEST['AUTHENTICATED_USER'].getUserName() != 'Anonymous User'"> Authenticated, succesfull login <dtml-else> Not Authenticated, No Login </dtml-if> I have a custom role for the user, The security settings are that only this role is able to view the page and can access contents information. I'm running Zope 2.2.4 on a FreeBSD Machine, which is behind an appache server. I really hope someone can help me out with this, because it got me really puzzeld ;) Thanx in advance.... Greetings, Menno

1 0

[Ann] FTP patch: FTP access to objects relying on acquisition magic
by Dieter Maurer 12 Jul '01

12 Jul '01

You will find via URL:http://www.dieter.handshake.de/pyprojects/zope an FTP patch to "OFS.ObjectManager". The patch allows access to "Mirroring Folder"s (for sure) and probably "LocalFS" and ZInstances derived from "ObjectManager" via FTP. It works by removing two acquisition checks. 1. The first one prevented FTP access to objects when any of its ancestors was a wrapped object. I expect that this has been necessary for security reasons in old times. Now, with the much improved Zope 2.2 security, it could probably go away. ATTENTION: I am not sure about this! 2. The second check seems without any sense to me: The comment says, it checks whether "objectValues" was acquired. Such a check is non-sense as "ObjectManager" defines "objectValues" itself and never acquires it. The check was essentially: self.objectValues() == REQUEST.PARENTS[1].objectValues() It raised an exception, because one of the objects was an "FSSession" that did not like to be compared with another object (because it was not initialized). I am sure, it is not a good idea to compare arbitrary objects with one another to check for acquisition properties. Dieter

1 0

[Fwd: Zope Proxy Objects]
by Christian Tismer 12 Jul '01

12 Jul '01

Hi Dieter, vielleicht klappt's dann so. Danke - chris -- Christian Tismer :^) <mailto:tismer@tismer.com> Mission Impossible 5oftware : Have a break! Take a ride on Python's Kaunstr. 26 : *Starship* http://starship.python.net/ 14163 Berlin : PGP key -> http://wwwkeys.pgp.net/ PGP Fingerprint E182 71C7 1A9D 66E9 9D15 D3CC D4D7 93E2 1FAE F6DF where do you want to jump today? http://www.stackless.com/

2 1

from excel to zclasses...
by bonnyk 12 Jul '01

12 Jul '01

hi all, i have a lot of excel data (poor man's database) and would love to somehow transform them into zclasses (yes, it has to be zlasses) automagically. what would be the best approach to look at ? thx T.

2 1

manage_delProperties woes
by Kevin Kuo 12 Jul '01

12 Jul '01

Hi, I have some code that is suppose to delete DC.* properties from all objects that can contain properties in a folder. Right now it's generating an error. See for yourself by taking out the try and except statements. The next step is to generalize this so that is can recursively go through the site. The code is as follows: <dtml-var standard_html_header> <dtml-call "REQUEST.set('DcList',['DC.title','DC.things','DC.happy','DC.Tuesday'])"> <dtml-in objectValues> <dtml-let currentObject=sequence-var-id> <dtml-in propertyItems> <dtml-let currentProperty=sequence-key> <dtml-if expr="_.string.split(currentProperty,'.')[0]=='DC'"> Delete property: <dtml-var currentProperty><br> <dtml-try> <dtml-call expr="manage_delProperties(currentProperty)"> <dtml-except> </dtml-try> </dtml-if> </dtml-let> </dtml-in> </dtml-let> <br> </dtml-in> <dtml-var standard_html_footer> Thanks in advance... kevin kkuo(a)umich.edu

5 4

Changes do not aplie
by Luiz Antonio B. Silva 12 Jul '01

12 Jul '01

Hi, I´ve made this product in ZClass, then it was created a distribution for it. Now, when I change something in the source, the changes are not aplied and has no effect on the product at all. I cant figure out what exactly is happen. Do you have any clue? Thanks Luiz Antonio - Brasil

2 1