August 2001 - Zope - Zope lists

RE: [Zope] Newbie questions
by Doyon, Jean-Francois 24 Aug '01

24 Aug '01

Matt, Thanks for the quick reply! As far as the modules are concerned, I read quickly through it, but I'm just concerned about the security implications. The module I need to work with for instance takes a config file as input, normally from the file system. This has been disabled by default for obvious secuity reasons, will I be able to get around it? Actually, if I use Zope specific methods, I suppose I should be able to open the file and pass the object to the module's method instead of the file name and it should work ok? th efurthest I got was to import the module, if I didn't get security errors, I got prompted for passwords, but even the admin password wasn't working, not sure what I was doing wrong, I'm probably moving a bit too fast on this :) As for the database, you have the entore site going on PostgreSQL ? That's what I'd like to do eventually as well. I noticed you can create "connection objects" and so on, but I'd prefer storing the ENTIRE site in an efficient database if possible. I'd be inetersted to know how they go about storing large images in PostgreSQL though, I guess you need post 7.1 in order to have TOAST ? Other binary type objects are just BLOBs I suppose ? If you can point me to any docs concerning this I'd love to see them :) Thanks, J.F. > ---------- > From: Matt Hand[SMTP:matt@bitflip.com] > Sent: Friday, August 24, 2001 5:05 PM > To: Doyon, Jean-Francois > Subject: Re: [Zope] Newbie questions > > Jean-Francois, > > I'm no guru, but I'll try to help where I can. > > On Fri, Aug 24, 2001 at 04:48:18PM -0400, Doyon, Jean-Francois wrote: > > Hello, > > > > - My main issue is the integration of a python module (MapServer) into > Zope. > > This is a module compiled using SWIG, which ends up with a .py, .pyc and > .so > > file. I've allready tried, quickly importing this module but without > > success, I guess I will have to learn more about the security framework > of > > Zope. The big thing is access to the file system. Can I allow it in > any > > way? Can I trick the module into using Zope Objects instead of the file > > system? Or can I override the default built-in security provisions that > > prevent such access? This is crucial to me. The said module reads a > > variety of data from the file system normally, and I need a way to make > it > > work under Zope. I'm allready quite familair with it's perl version. > > You'll need to create a python module which passes calls to and from Zope > and place it > the /path/to/zope/Extensions directory. See the Zope Book at www.zope.org > for > proper syntax in order to import the method into Zope (External Method). I > use > external methods to access a PostgreSQL database and an xmlrpc server and > return > the results to a dtml document or method. > > > - The database where basic content of the site is kept, how stable is > it? > > How big a site can it hold? I noticed that the entire site seems to live > > within one file. The current, standard HTMl/Filesystem site takes > around > > 600MB, how robust is the Zope storage back-end? What about performance > with > > large sites? > > The installed database seems pretty stable and makes rolling back > transactions > very easy; however, I use a Postgres database for production work and use > Zope as a front end. It was a little trickier to set up than I'd > anticipated, > but with some digging and a little help from the zope-list I got it up and > running nicely. > > I hope this helped a little. > > Matt Hand > matt(a)bitflip.com > >

1 0

arguments for myProduct_add?
by Roger Erens 24 Aug '01

24 Aug '01

in taz[...] how-to http://www.zope.org/Members/tazzzzz/addZClasses about adding ZClass instances Programmatically this code ought to be in the myProduct_add constructor: <dtml-if NoRedir> <dtml-else>      </dtml-if> I do not see the point of this: if NoRedir is true, nothing happens; if it is false, again nothing happens. Were the comments not to be used here?

2 3

Newbie questions
by Doyon, Jean-Francois 24 Aug '01

24 Aug '01

Hello, I am new to python and zope, and am evaluating it for possible use as the future contant management system for one of our websites. I was wondering if you could help me out with some presumably simple questions: - My main issue is the integration of a python module (MapServer) into Zope. This is a module compiled using SWIG, which ends up with a .py, .pyc and .so file. I've allready tried, quickly importing this module but without success, I guess I will have to learn more about the security framework of Zope. The big thing is access to the file system. Can I allow it in any way? Can I trick the module into using Zope Objects instead of the file system? Or can I override the default built-in security provisions that prevent such access? This is crucial to me. The said module reads a variety of data from the file system normally, and I need a way to make it work under Zope. I'm allready quite familair with it's perl version. - The database where basic content of the site is kept, how stable is it? How big a site can it hold? I noticed that the entire site seems to live within one file. The current, standard HTMl/Filesystem site takes around 600MB, how robust is the Zope storage back-end? What about performance with large sites? That's it for now :) Thanks in advance! Jean-François Doyon Internet Service Development and Systems Support GeoAccess Division Canadian Center for Remote Sensing Natural Resources Canada http://atlas.gc.ca Phone: (613) 992-4902 Fax: (613) 947-2410

1 0

Inheritance vs. Zope's security model
by Philipp Robbel 24 Aug '01

24 Aug '01

Hi all :-), I have a small (?) problem with Zope's security & inheritance model, but maybe i'm just overlooking something.. Ok, in the root folder i have a dtml-method called "test" that's supposed to be inherited to the subfolders /one and /two and not to be accessible in the root folder itself. In those /one and /two folders I have two people (managers) set up. Again, I want /test (i.e. the test method in the root folder) to be unaccessible to anyone - except of course the root folder managers). And I want /one/test NOT to be available to the manager of the /two folder and vice versa How do i set this up without doing security checks in the test method itself? The Problem is: when restricting the method "test" to "managers", only a manager defined in the root folder can access it, but the managers from /one and /two can't. Can you help me with my problem? Thanks in advance, Philipp

1 0

Catching the print
by Peter Bengtsson 24 Aug '01

24 Aug '01

In Linux I currently use the nohub program. $ nohub ./start & to start Zope. That's good, and in nohub.out I get the messages Zope throws. However, when I sometimes use print "I am here" in External Methods or products, that is also printed to stdout, but not into the nohub. Why?? How do I catch the print messages too? And on windows?

2 3

RE: [Zope] Ruling from the bench regarding 'Hotfixes' :)
by Farrell, Troy 24 Aug '01

24 Aug '01

Works for me. Follows along with the OpenSource love of _terrible_ plays on words. Troy > -----Original Message----- > From: sean.upton(a)uniontrib.com [mailto:sean.upton@uniontrib.com] > Sent: Friday, August 24, 2001 2:13 PM > To: zope(a)zope.org > Subject: RE: [Zope] Ruling from the bench regarding 'Hotfixes' :) > > > Jargon: why not "coolfix" instead? It connotes: > 1 - No severity (cool vs. hot) > 2 - Novelty (cool==neat) > 3 - It does indeed make some changes to the core, but nothing > crucial > 4 - It doesn't require you to feed it bananas ;) > > Sean

1 0

RE: [Zope] RE: [Zope] Request regarding 'Hotfixes'
by Farrell, Troy 24 Aug '01

24 Aug '01

Gee, topics such as these make it tough to sign with 'Cheers' :) I'm really not interested in piggybacking on ZC's usage of the work Hotfix, but I choose such to describe the method of the change. It isn't a source patch, but a behavioral patch. It uses the Hotfix method per Caseman. I'm not so sure the term "Hotfix" should be associated with Security Changes. Perhaps we need a differentiator. I don't mind changing, but HotPatch doesn't work technically, HotFix - taken, HotMod - too trendy sounding, Monkey Patch - Who'd take that seriously?, PixieDust - too nebulous. Any more Ideas? Troy

1 0

Request regarding 'Hotfixes'
by Bill Anderson 24 Aug '01

24 Aug '01

I would like to ask that people developing patches to Zope that use the same method as ZC Hotfixes _NOT_ call them Hotfixes. It is confusing and misleading, and is causing a bit of a stir around here. Hotfixes should be reserved to ZC fixes to Zope security issues. This is the origin of the use in Zope, and many have already associated a Zope Hotfix with a security fix. Additionally, to those who review announcements/products on Zope.org for publication, could you _please_ not approve those that call themselves Hotfixes, unless of course they come from ZC? I have had a number of people come to me and ask just what security problem there is with Image tags, as a result of the recent Imagetag 'hotfix' announcement on zope.org. It is very important for the distinctin to be made. Consider the new reporter, who has seen ZC/DC issue security fixes, labelling them Hotfixes. Now imagine what happens when they see a list of fifteen, twenty, thirty 'hotfixes', what are they going to assume? Yes, we would hope they would do some research, though we _know_ that in many cases they will not. Next thing you know, Zope has twenty or thirty security exploits you need to fix. We do not need this. Anyway, just thought I would relay that. When I tell people these are not issues, I then get questioned as to why they are labelled as Hotfixes. Unfortunately, I do not have kind words with respect to the announcement/author's naming choice to reply to that with. The-road-to-a-bad-reputation-is-paved-with-mislabelled-hotfixes-ly y'rs Bill Anderson

12 15

Accessing higher namespace
by Karsten Kraus 24 Aug '01

24 Aug '01

Hi there, if got a little problem with dtml-namespaces. I'm using the dtml-in-tag for iterating over the results of a python script. I want to compare the results with the id of the document which calls the python script. My Question is: how can I access the namespace "above" the dtml-in-namespace? Example <dtml-let test="this().getId()"> <dtml-var test> // prints the documents id. <dtml-in "pythonmethod()"> <dtml-var test> // 'test' is not in my namespace anymore! What now? </dtml-in> </dtml-let> Anyone? TIA Karsten

2 2

RE: [Zope] Zope/PostgreSQL/PoPy
by Farrell, Troy 24 Aug '01

24 Aug '01

Who should we talk to that this will be included in future releases? Troy > -----Original Message----- > From: Jim Penny [mailto:jpenny@universal-fasteners.com] > Sent: Friday, August 24, 2001 8:46 AM > To: zope(a)zope.org > Subject: Re: [Zope] Zope/PostgreSQL/PoPy > > > On Thu, Aug 23, 2001 at 03:55:31PM -0500, Matt Hand wrote: > > On Thu, Aug 23, 2001 at 04:30:48PM -0400, Jim Penny wrote: > > > > > With any luck this is just a "me too" message. > > ZPoPyDA 2.0.7 does in fact have a serious problem > with strings. > > Fortunately the fix is extermely easy. > > At about line 25 of PoPy_DA.py, insert a line that says > import string > > I put it right before the line saying > from PoPy_db import DB > > Make sure you are editting the version in > $(ZOPEHOME)/lib/products/python/ZPoPyDA > > Restart zope after you make this edit. > > This will fix the problem both in the test tab and in actual use. > > Jim Penny > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0