August 2001 - Zope - Zope lists

how to upload a batch of files????
by Robert Rottermann 02 Sep '01

02 Sep '01

Hi there, I would like to be able to upload a batch of files to Zope. What I have in mind is something like having a textbox where I list the files to be uploaded from where some magical function reads the names and does the upload. Is this feasible or have I to stick with a single file per action approach?? thanks for your ideas Robert www.redcor.ch don't mind my typhos I see them neither

6 15

Trouble uploading with Netscape Composer
by George Nguyen 01 Sep '01

01 Sep '01

I'm trying to upload images to a ZClass that has inherited from ZObjectManager. I created a PUT_factory that assigns images to the ExtImage product. When I try to upload from Netscape Composer, it gives me this Zope error: Error Type: AttributeError Error Value: get and this traceback: Traceback (innermost last): File /data/local/Zope/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /data/local/Zope/lib/python/ZPublisher/Publish.py, line 187, in publish File /data/local/Zope/lib/python/Zope/__init__.py, line 226, in zpublisher_exception_hook (Object: GeorgeTammy.jpg) File /data/local/Zope/lib/python/ZPublisher/Publish.py, line 171, in publish File /data/local/Zope/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: PUT) File /data/local/Zope/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: PUT) File /data/local/Zope/lib/python/webdav/NullResource.py, line 188, in PUT (Object: GeorgeTammy.jpg) File /data/local/Zope-2.4/lib/python/Products/ExtFile/ExtImage.py, line 361, in PUT (Object: CatalogAware) File /data/local/Zope-2.4/lib/python/Products/ExtFile/ExtFile.py, line 411, in PUT (Object: CatalogAware) File /data/local/Zope-2.4/lib/python/Products/ExtFile/ExtImage.py, line 441, in _get_ufn (Object: CatalogAware) File /data/local/Zope-2.4/lib/python/Products/ExtFile/ExtFile.py, line 545, in _get_ufn (Object: CatalogAware) File /data/local/Zope-2.4/lib/python/Products/ExtFile/ExtFile.py, line 560, in _get_new_ufn (Object: CatalogAware) File /data/local/Zope/lib/python/OFS/Traversable.py, line 107, in absolute_url (Object: CatalogAware) AttributeError: (see above) Can anyone help me figure out what's going on? __________________________________________________ Do You Yahoo!? Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger http://im.yahoo.com

2 1

RE: [Zope] zclass add method -- how to get at properties?
by Lee Harr 01 Sep '01

01 Sep '01

restrictedTraverse('/Control_Panel/Products/ZClassTest/ZCTest/propertysheets/common/PS').getProperty('toks') > Thank you Dieter, that is it exactly. I have not used this restrictedTraverse before, but I am trying it in other areas now. Once I get an object (a DTML Method) how do I make it render normally? I do <dtml-var "restrictedTraverse('/path/to/product/method')"> but the html is all coming out entity encoded. ie: <HTML> etc. Thanks for your help! _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

2 1

protecting users from hostile authors
by Kyler B. Laird 01 Sep '01

01 Sep '01

We're in the process of building a cluster (just installed 8 machines) for serving a bunch (tens of thousands) of users. Many/most of these people will also be authors. A single (X.500- based) authentication system will be used for most everything. I'm trying to get a handle on what policy I want to use in order to keep authors from doing Bad Things to authenticated users who visit their pages. Looking around on Zope.org, I realized that this might already be addressed. Is there anything that prevents me (as a Zope community member with authoring privileges on zope.org) from luring users who have already authenticated with Zope.org to come look at my pages, and then running arbitrary commands with their privileges? Anyone else grappling with this situation? I'm trying to decide how to set policy so that users are reasonably safe, but authors still have the freedom to create Cool Stuff. There will most certainly be multiple classes of authors - those who can act with the authenticated user's privileges and those who can not. I'm not quite sure how to implement that yet, though. I'm also concerned about links to Bad Things, like "delete your home directory" disguised as "Get porn here!". Any thoughts? Has this already been hashed out somewhere that I should have found? Thank you. --kyler

6 10

Problem with ZCatalog and Virtual Host Monster
by Yuichiro Sugiura 01 Sep '01

01 Sep '01

Hi, I have a problem to get ZCatalog to work with Virtual Host Monster properly. A wrong path (Object Identifier) is stored when a catalog aware object get cataloged. For example, an object "/a/b/c/d_html" get cataloged as "/b/c/d_html" where "/a" is the root folder for the virtual host. However, correct paths ("/a/b/c/d_html") are stored when a catalog is built from "Find Objects" tab in ZCatalog, . Is this behavior a known bug of the ZCatalog, or could it be caused by misconfigurations of something? Any input would be greatly appreciated. I'm using Zope 2.4.0, by the way. Yuichiro Sugiura -- Yuichiro Sugiura Activewave Technologies Inc.<http://www.awavetech.com/> Serving cyber community and cyber business.

2 2

Re: [Zope] DTML Confusion?
by hamish＠allan.tc 01 Sep '01

01 Sep '01

JZ>I can also JZ> JZ><dtml-var "Util.utility_function(REQUEST=REQUEST)"> JZ> JZ>but that is also a little long-winded. OB>DTML objects are really callable instances of classess. dtml-with calls OB>them automagically, but when you use dtml-var "..." these quotes move you OB>from DTML to Python, and in Python there is no automagical call - you must OB>call the objects yourself. There is no way to avoid it. but <dtml-var "Util.utility_function()">, which is a little less long-winded, should also work. regards, hamish -- Get your firstname@lastname email for FREE at http://Nameplanet.com/?su

2 1

Good Use for Zope?
by Leland Myrick 31 Aug '01

31 Aug '01

I'm new to Zope but I'm excited by its possibilities. I'm going to be doing some contract work to setup a database for a high school resource center. The basic idea is that all the materials available for the teachers to checkout (book sets, vidoes, math materiels, etc.) would be on the database and would be set up with a barcode system and wand for quick checkout, much like any lending library. The nice part is that every teacher is already connected on an ethernet lan, so I want to set it up so that they can search the database from their classrooms without having to trudge across the campus only to find out that what they were looking for isn't in the system or has been checked out. The first ideas of the school personnel were filemaker or access. I definitely am not doing access. The point is, has anyone done a barcode checkout system on zope? Good idea? leland myrick

1 0

strange request
by Andy McKay 31 Aug '01

31 Aug '01

Im investigating a Zope installation that just hung for a while, and looking through the log I found this very strange request: 2001-08-31 01:26:29 151.197.229.183 - 192.168.2.165 80 Content-type: application/x-www-form-urlencoded - 404 265 - None - 0.015000 ie the and cs-method cs-uri-stem were: Content-type: application/x-www-form-urlencoded instead of for example: GET /manage Ughh. Im not sure if this caused the hang, but I was curious if anyone else has seen this...? Cheers. -- Andy McKay.

1 0

Re: OOP Suggestion: allow local roles to restrict and not only extend user's roles.
by Philipp Robbel 31 Aug '01

31 Aug '01

Hi Laurie, thanks for your quick reply. Yes, that is one option I just tried, but - in my case - it has a major drawback (see below). First, here's what i did: - I created a 'test' role with only the permissions to "access contents information" and "view". - I created the researchers in the root folder and gave them the "test" permission. - I protected the critical dtml and sql methods by making them only accessible to test & manager - assigned people. - Then in their specific subfolders I gave the researchers the *local_role* of a Manager. It works but there is one major drawback in my case. I only quickly checked but in my case the /database researcher was able to call the /bioinformatics/show_management_screen and while he couldn't add Documents in the /bioinformatics directory on that screen (a login box popped up) he could execute the database methods that inserted the various data under the /bioinformatics ID just fine. Did you encounter the same problem? PS.: the bioinformatics staff is working at the European Media Laboratory in Heidelberg, Germany (www.eml.org [careful, those pages are old :-) ]) Greetings, Philipp Robbel -----Original Message----- > Hi Philipp - I'm afraid that I don't think I can help you but am struggling > with the same kind of problem - I have different research groups who cannot > see each others data, but have shared information/methods that they need to > execute in context in their respective groups and projects (which also only > some people can see) > My method so far is to define a new role that when the user is created they > are added to 'LabLoggedIn'. Then this role has the appropriate permissions > in the root folder to run the methods that are needed. Then in their own > groups or projects they have the appropriate local roles granted (these are > defined at the root level). We are working on the assumption that the users > wont know enough to hack in but I am trying to do it as though they can. > I don't know if this has helped any, but I am struggling through myself! > Laurie > > PS where is the bioinformatics that you are working with based? I am in the > same kind of lab.

1 0

OOP Suggestion: allow local roles to restrict and not only extend user's roles.
by Philipp Robbel 31 Aug '01

31 Aug '01

Dear everyone, I'm badly stuck with my problem and while I think that I'm using valid OOP design I don't think that Zope currently supports this. Here's a description of my current design: In our company there are different research groups whom I gave their own subfolders. /databases /bioinformatics etc. Within each group there are pseudo-managers defined (i.e. they have most of the full manager role, i.e. can create/delete documents etc., so I'll use "manager" as role when describing my problem.) I want all groups to share a common set of both DTML methods and SQL functions, so I placed them in the root folder. In the root folder there is for example a new management function that - when called like /databases/show_management_screen - will show the management options for the group specified by the containing folder. It will also allow database inserts depending on the containing folder. I do that in my inherited "show_management_screen" dtml method by using statements like: <dtml-call "sqlAddProjects(ResearchGroupName = id, ...)"> which will do: INSERT INTO table (...) VALUES(...) WHERE ResearchGroupName=<dtml-sqlvar id type=nb> It's critical that a manager from /databases is *not* allowed to access the sql method in the /bioinformatics group, else he would be able to insert values under a fake GroupID by calling the method like /bioinformatics/sqlAddProjects directly. Another thing that's critical is that no researcher from any group nor the anonymous user has direct access to this Database method: that's why I not only placed them in the root folder but also restricted the "Access contents information", "Use Database Methods" and "View" permission of that sqlAddProjects Method to Managers. Problem which is solved by that: no anonymous user can access that method. Problem that comes up: no Researcher (i.e. subfolder manager) can access that method either, because root manager is, of course, != subfolder manager. Possible solution for inherited DTML methods: a) Disable that "Access contents information", "Use DB Methods" and "View" permissions protection in root folder. b) Check for permissions in the method itself. <dtml-if "AuthenticatedUser.has_role(this(), ['Manager'])"> as outlined in http://www.zope.org/Members/tseaver/user_settable_passwords. It's supposed to check, whether the accessing user has the Manager Role in the context the DTML method is called on. But this fails for SQL Methods and I'm pretty confident that there should be a simpler way in Zope itself. My idea to fully support this OOP design was the following: Enable local roles not only to extend the user's roles but also restrict them. I.e. in my case I would define all researchers from the various groups in the root acl_users folder as Managers. But - at the same time - change the local roles of the root folder to _not_ give the researchers the Manager role in the root folder (understandable?) In the /databases folder, however, I would give the database-researcher back his "Manager" role, via local roles. This would solve my whole problem: Step 1: restrict again all critical dtml and sql methods in the root folder to managers (as already outlined above: "...but also restricted the "Access contents information", "Use Database Methods" and "View" permission of that sqlAddProjects Method to Managers"). Step 2: If the database researcher calls the "show_management_screen" dtml method like /databases/show_management_screen it would work because a) he is defined as Manager in the root folder (but local roles restrict them there to be a "real" Manager) b) he has the proper local roles set in his /databases folder so that there he finally is a "real" Manager. He couldn't, however, access the function like /show_management_screen (i.e. in the root folder) or like /bioinformatics/show_management_screen: both would be restricted by the local rules. Shouldn't that be valid OOP design? Please let me know what you think or - if I oversaw another solution to my problem - please let me know how to solve it :-) My original problem was outlined in my previous post at http://groups.yahoo.com/group/zope/message/70099 where I unfortunately didn't get any replies. Thanks in advance, Philipp Robbel

2 1