August 2001 - Zope - Zope lists

RE: [Zope] Forum under Zope 2.4
by Farrell, Troy 15 Aug '01

15 Aug '01

Like squishdot? http://www.squishdot.org/ Troy > -----Original Message----- > From: christophe robert [mailto:christophe.robert6@wanadoo.fr] > Sent: Wednesday, August 15, 2001 5:52 PM > To: zope(a)zope.org > Subject: [Zope] Forum under Zope 2.4 > > > Hello > > > I search a forum, which work under Zope 2.4 > > > thank > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] CoreSessionTracking-based LoginMethod for LoginManager
by Andy Gimblett 15 Aug '01

15 Aug '01

> It's as secure as the key shared by the login method and the object in > the session data. ie, choose it well. :-) > Yeah, although it's really the same thing in this case. > Encrypting the user info with a shared key and storing it in a > cookie isn't really all that much less secure that storing the user > info in a session data object. Although I guess it could be argued Yes, I see that - but I didn't think any of the existing cookie-based products even did that... I thought they just encoded a concatenation of username and password in base64 (which is trivially decodable) and stored that. Was I not looking hard enough? > > Of course, I'm assuming that CST includes checks to guard against > > cookie-hijacking. :-) > > Um... maybe. What kind of checks did you have in mind? ;-) :-) Hmmm, let's see... OK, I've never done this myself but I remember reading that it's a good idea to do this kind of thing to your cookie values to ensure they're not hijacked: 1. Start with the data you want to store 2. Append identifying information, eg the IPs of the client and server, and the current date/time. 3. Make a digest of this plus a secret string which only you know, and append that as a fingerprint. Then when you interpret the cookie, check that the fingerprint is as you'd expect (ie the cookie hasn't been interfered with by a man in the middle) and then check anything else you want to check (eg the IP/date). Once you're happy with the fingerprint, you check that the server IP is the IP of the host box, that the client IP is good too, and that the date/time aren't unreasonably out of date - the idea is to guard against re-use of old cookies or cookies from somewhere else. As I say, I've never done this but it sounds reasonable in principle. Make sense? -Andy -- Andy Gimblett - Programmer - Frontier Internet Services Limited Tel: 029 20 820 044 Fax: 029 20 820 035 http://www.frontier.net.uk/ Statements made are at all times subject to Frontier's Terms and Conditions of Business, which are available upon request.

3 2

The Profiler for measuring Zope calculation times
by Kamon Ayeva 15 Aug '01

15 Aug '01

Hello, I have been using the Profiler from the Control Panel to try to figure ut the bottleneck parts of our site, but I don't really get results I can exploit. It goes too deep in Python for what I need at the moment. What I would need is some indication of the time used to calculate and render specific objects from the ZODB tree. For example the index_html rendering the contents of a specifc folder, or the left_bar_html if there is one called by this index_html. Is there a tool for doing that ? Regards, Kamon eXperts-MD

3 7

Re: [Zope] Hurrah Hosting
by Michel Pelletier 15 Aug '01

15 Aug '01

On Wed, 15 Aug 2001 10:13:24 -0400 "Brian D. Goodwin" <brian(a)fuddmain.com> wrote: > Greetings, > > Searching the archives I ran across two posts > recommending Hurrah > (www.hurrah.com) for Zope hosting. These posts were from > the beginning of > the year and I was hoping for a more current endorsement. > I would > appreciate any information anyone could give regarding > their experiences > with Hurrah. > > They seem to have everything I'm looking for at a great > price. All I need > is some positive feedback from Hurrah customers. I use hurrah for my personal web site and they're great. Best of all, the use the same ISP in the same city as my DSL line, so I'm only five super-fast hops from my site. Still haven't recieved a bill though... ;) -Michel

1 0

Instance of ZClass
by Walter Hupfeld 15 Aug '01

15 Aug '01

I want to build an instance of ZClass like <dtml-call "REQUEST.set('id',REQUEST.form['id_neu'])"> <dtml-with "manage_addProduct['Tauschboerse']"> <dtml-call "SkizzeClass_add(_.None,_, NoRedir=1)"> </dtml-with> <dtml-call "REQUEST.set('meine_skizze',_[REQUEST.form['id_neu']])"> <dtml-call "_['meine_skizze'].propertysheets.Beschreibung.manage_changeProperties({ 'Name':REQUEST.form['Name'], 'Email':REQUEST.form['Email'], 'Sprache':REQUEST.form['Sprache'], ..... where 'Sprache' is the name of a CHECKBOX. It works fine, if all checkboxes are checked. But if not all checkboxes are checked, I will get an keyerror. What can I do? -- ----------- -------------------- Walter Hupfeld --------------------------------

2 1

Zope is good for...
by Ryan Ware 15 Aug '01

15 Aug '01

I am learning Zope and have been lurking for a short period. What kinds of problem spaces have you found zope to be good at solving (types of websites etc)? Thanks, Ryan

1 0

Authorization Help
by Todd Loomis 15 Aug '01

15 Aug '01

Hi: I'm trying to build a file system with access control. So when a user logs in they only see the folders/files they have access to see. Does anybody have any suggestions as I've tried and can't seem to get the Authorization to work, everybody gets to see everything. Thanks, Todd ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Todd Loomis Web Developer (SAIC) Defense Modeling & Simulation Office 1901 N. Beauregard Street, Suite 500 Alexandria, VA 22311 Office: 703.824.3407 Fax: 703.379.3778 tloomis(a)dmso.mil

2 2

CoreSessionTracking-based LoginMethod for LoginManager
by Andy Gimblett 15 Aug '01

15 Aug '01

Hi there Zopers, I'm currently trying to develop a LoginMethod for LoginManager which uses CoreSessionTracking to store/access credentials, rather than Basic HTTP Authorization or Basic Cookie Authorization. Here's why: - Basic HTTP auth is unacceptable because we need form-based login. - I've looked at other user folders which support cookies, and at CookieCrumbler, and at the BasicCookieLogin class bundled with LoginManager, but they all share the problem (in my mind) that they store the username/password encoded in the cookie itself, which isn't very secure - and doesn't extend well into storing other information if I wanted to. - I'd much rather use a token-based scheme where all sensitive information is stored on the server, and the cookie is just a token which can be mapped to that data. This seems to me to be what CoreSessionTracking offers. - The CST documentation mainly talk about CST as a way of tracking anonymous sessions, but I see no reason why it couldn't be used in this way too...? If we assume that the above reasoning is sound and that this is A Good Thing To Do, then I have the following problems: - I haven't written a fully-fledged disk-based product yet. I've looked at the tutorials and howtos but they're pretty basic. Helpful, but basic. I've successfully created a stripped-down do-nothing copy of the BasicCookieLogin class, but it's adding the extra (CST-related) parts that I'm having difficulty with. - If I could do it with a ZClass I reckon I could make it work, but I can't see a way to create a ZClass which LoginManager can use as a LoginMethod. There are subclasses for UserSources, but not LoginMethods. - Ideally I want it to be self-contained, so the LoginMethod instance would contain a SessionIdManager and a SessionDataManager - but I don't know how to do this properly/ morally/legally, or if it's even possible. - Another approach would be to have the LoginMethod pick up a SessionDataManager outside of it, but I'm having problems with this too... I tried hard-coding an expected ID in the LoginMethod and created a SessionDataManager with that ID in the LoginManager, but the acquisition didn't work. Maybe I'm missing something simple? Basically I have too many gaps in my knowledge to pull this together properly on my own, so it's time to ask for help. I'll be happy to expand on any of the above if necessary... I've sure learnt a lot about LoginManager and CST over the last few days, but I don't quite the skills to suit action to intent... :-( I'm assuming that this would be useful to other people if I could get it to fly? If that's the case, I'd love to release it. Similarly, if anyone wants to see the source of what I've tried so far, let me know. Other than that, all input appreciated. Thanks in advance, Andy -- Andy Gimblett - Programmer - Frontier Internet Services Limited Tel: 029 20 820 044 Fax: 029 20 820 035 http://www.frontier.net.uk/ Statements made are at all times subject to Frontier's Terms and Conditions of Business, which are available upon request.

4 3

Attempted hotfix to structured text
by ksmith＠99hats.com 15 Aug '01

15 Aug '01

I'm trying to do a Hotfix to remove the the space between bulleted lists in structured text. Does anyone know why this isn't working as a Hotfix? Thanks, Kevin __init__.py """ Remove P tag from unordered lists""" from StructuredText.StructuredText import HTML def ul(self, before, p, after): """Save some space""" if p: p="%s" % strip(ctag(p)) return ('%s<ul><li>%s\n%s\n</li></ul>\n' % (before,p,after))

3 2

RE: [Zope] CoreSessionTracking-based LoginMethod for LoginManager
by Andy Gimblett 15 Aug '01

15 Aug '01

> Sure. Release early, release often! Definitely! But I'm guessing "release broken" doesn't fit into this scheme. :-) -Andy -- Andy Gimblett - Programmer - Frontier Internet Services Limited Tel: 029 20 820 044 Fax: 029 20 820 035 http://www.frontier.net.uk/ Statements made are at all times subject to Frontier's Terms and Conditions of Business, which are available upon request.

2 1