August 2001 - Zope - Zope lists

8080
by Brian Pribis 16 Aug '01

16 Aug '01

I have zope working fine, but I am curious as to how to set it up so that people don't have to type in the port number to get to the site? Right now they get a forbidden message if they don't use it. Am I missing something? Also, what docs can someone point me to in making Zope as secure as possible (or just words of advice). I had to install zope as root (zope of course made some things 'nobody'). Is this o.k.? I read a paper by someone that said it should be installed as a normal user. However, after going through all the steps he did, the installation failed in a bad way. Tanks brian-

3 2

Non-manager user administrators?
by Keating, Tim 16 Aug '01

16 Aug '01

I want to give certain users the ability to create, delete and change the password for users in general, without making full-blown managers. Anyone know of a way to do this? You can create a role and restrict its access to the acl_users folder, but since they can create users, they can just create one with the manager role and circumvent the whole thing. Am I stuck with creating a page that uses the Zope API to provide this functionality? Thanks for any input! TK

2 1

Help needed with External Script
by Chris Bruce 16 Aug '01

16 Aug '01

Please Help, I have the following python code as an external script. But when I run it, I get: Error Type: AttributeError Error Value: aq_base But if I comment out the line: obj.propertysheets.ppProperty.manage_editProperties(REQUEST) It works, but of course I have no properties set. Any ideas what the problems are?? Here is the dtml method: <dtml-var standard_html_header> <h2><dtml-var title_or_id> <dtml-var document_title></h2> <p> <dtml-var expr="consultants.ImportData ('PersonalProfile','ppEntry','importData',REQUEST)"></p> <dtml-var standard_html_footer> Here is external python code: import string import csv import Globals from Globals import HTMLFile from AccessControl.User import BasicUserFolder from OFS.ObjectManager import ObjectManager from OFS.PropertyManager import PropertyManager from OFS.SimpleItem import Item from AccessControl.Role import RoleManager from Acquisition import aq_base def importData(self, productName, className, fileName, REQUEST): zfile = getattr( aq_base( self ), fileName, None ) data = "%s"%zfile lines = string.split(data, '\n') p = csv.parser() results ="" for line in lines: r = p.parse(line) if len(r) > 0: results = results + r[0] + ' added.<br>' REQUEST.set('id', r[0]) REQUEST.set('name', r[1] + ' ' + r[2]) REQUEST.set('title', r[1] + ' ' + r[2]) REQUEST.set('expires', '1/21/2002') # REQUEST.set('title', r[3]) REQUEST.set('company', r[4]) REQUEST.set('address', r[5] + ' ' + r[6]) REQUEST.set('city', r[7]) REQUEST.set('state', r[8]) REQUEST.set('zip', r[9]) REQUEST.set('email', r[10]) REQUEST.set('website', r[11]) REQUEST.set('isConsultant', r[12]) intuitcert = [] if r[13]: intuitcert.append('Intuit Pro Advisor') if r[14]: intuitcert.append('Intuit Certified') if r[20]: intuitcert.append('Intuit Certified') REQUEST.set('intuitcert', intuitcert) REQUEST.set('phone', r[15]) REQUEST.set('fax', r[17]) if len(r[22]) > 0: REQUEST.set('expires', r[22]) else: REQUEST.set('expires', '01/01/1970') REQUEST.set('isAssociate', r[23]) REQUEST.set('isCertified', r[24]) product=self.manage_addProduct[productName] zclass=eval('product.'+className) obj=apply(zclass, []) obj._setId(r[0]) obj.propertysheets.ppProperty.manage_editProperties (REQUEST) self._setObject(r[0],obj,set_owner=0) return results Any help would be greatly appreciated. Thanks.

1 0

RE: [Zope] CoreSessionTracking-based LoginMethod for LoginManager
by Andy Gimblett 16 Aug '01

16 Aug '01

> > - The CST documentation mainly talk about CST as a way of tracking > > anonymous sessions, but I see no reason why it couldn't be used > > in this way too...? > > Well... one reason is that there is no failsafe access control on > session data objects (the token key is the only thing required to grab > hold of a session data object and all of its contents via DTML). Nuts - hadn't thought of that. > As a result, the data that is stored in a session data object would > itself need to be encrypted in some way for it to be "secured". > Encrypting it assumes some sort of shared key, so you're back to the > original problem with a layer of indirection. :-( OK... So how about the LoginMethod has the key as a property, defined when it's created (heck, even chosen at random and never visible to any user). Then the raw data from the SessionDataManager is useless, 'cos only the LoginMethod knows the key, but the LoginMethod can decode it and decide if they're logged in or not - right? Or am I missing something - is this still insecure? > Safe authentication is a hard problem. The sessioning machinery might > help in some way, but it's not an answer in and of itself. *nods* - I think I'd still like to use it, because it's a nice way to organise things. Putting any meaningful data on the client side gives me heebie-jeebies. Of course, I'm assuming that CST includes checks to guard against cookie-hijacking. :-) -Andy -- Andy Gimblett - Programmer - Frontier Internet Services Limited Tel: 029 20 820 044 Fax: 029 20 820 035 http://www.frontier.net.uk/ Statements made are at all times subject to Frontier's Terms and Conditions of Business, which are available upon request.

4 3

Roll Your Own vs GUF vs exUserFolder - Why is one better than the other
by Dario Lopez-Kästen 16 Aug '01

16 Aug '01

Hello! I would like to hear from people using GUF and/or exUserFolder and what they think of them, especially why they prefer on over the other, or opinions on why one is better than the other. I've been trying to understand how both products work and AFAICT the main difference is that exUserFolder provides user properties while GUF does not. GUF seems to be better at handling roles thn exUserFolder (in terms of being able to extract them from the database). Any comments insight, corrections of misconceptions are welcome. I need to have a working solution to our problem RSN and I want to use as much of Zope as possible. It won't be possible to solely rely on the zope sec mechanisms but if i can delegate to zope as much as possible it would be a big gain. The last and least desireable option would be to simply ignore the zope sec mechanisms and roll our own sec management. Thank you, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario(a)ita.chalmers.se ICQ will yield no hits IT Systems & Services

1 0

How to transfom an URI into an object (Python script) ?
by Gilles Lenfant 16 Aug '01

16 Aug '01

Thanks from a dead brained man !

2 1

URL Traversal help needed.
by jkinsley 16 Aug '01

16 Aug '01

Greetings.... Assuming I have: /folder/script What do I need to implement within script so that I can call http://www.mysite.com/folder/script/opt/subopt then be able to use opt and subopt within script. I would like opt/subopt to be split at the '/' and available as a tuple or a list. TIA, Jarrod

3 2

how to delete an object from python??
by Robert Rottermann 16 Aug '01

16 Aug '01

Hi there, I wonder how to delete an object from a python script. When I try oName = context.this().getId() f = context.REQUEST.PARENTS[1] f._delObject( oName ) I can not even save the script because zope complains that SyntaxError, Names starting with "_" are not allowed (_delObject). redirect to 'folder_delete' I can not use either, because it tries to call 'folder_contents' which is not possible at the point where I am. Thanks for any help Robert

2 1

Error Type: AttributeError Error Value: __hash__ ??
by Gustav Franzsen 16 Aug '01

16 Aug '01

Have application using LoginManager. Users log in (username and password). Data stored in Mysql. Some users get abovementioned error when attempting to log in, whilst others have no problem. No obvious discernable difference in data in database between users (those that work and those that don't). Not username/password entry problem either. What does this error message mean? Don't see anything in mailinglists on this. Don't know where else to look for this one! We're running: Zope 2.3.3 ZPatterns 0.4.3 LoginManager0.8.8.b1 mysql 3.23.31.win ZMysqlDA 2.0.6 MysqlPython 0.3.5 Using IE5.5 and Opera as browsers Thnx Gustav Franzsen Upfrontsystems Stellenbosch South Africa

2 1

How to find out whether index_html was acquired?
by Hamish Lawson 16 Aug '01

16 Aug '01

I'm wondering whether there is a way to determine whether the index_html method was found in the current folder or was acquired from a folder above. The motivation for this is a situation like so: Suppose there is a folder 'Acme' with subfolders 'Engineering', 'Marketing' and 'Accounts'. I'd like the index_html for the subfolders to be similar, so I would put it in Acme to be acquired. However I want the index_html for the Acme folder itself to be different from the subfolders. Therefore I'm thinking I could rename the index_html for the subfolders to be index_sub_html, create an index_self_html for use by the Acme folder, and then have index_html determine whether it was acquired and show either index_self_html or index_sub_html as appropriate. Would this be the right approach? Hamish Lawson

2 1