September 2001 - Zope

Change current user
by Juan Garcia Garcia 25 Sep '01

25 Sep '01

Hi, i'm developing a site where there are about nine kind of users. When an user enter to the site, he is an Anonymous User, but i have a button that its purpose is to change of current user to another that exists in an acl_users folder. The user must enter the name and password of the user he wants to login as. This is what i don't know to do, i have read a lot of documentation, and i have tried with the function 'authenticate', but when i show the name of the current user (AUTHENTICATED_USER.getUserName), it appears always the user as i login in the Zope Management Interface. When i was reading documentation, i saw that many people wanted to do this before, but i wrote the examples and they didn't work for me. I know that there are products to solve this problem (like LoginManager), but i prefer to do it without using them. Can anybody help me?

2 1

Re: Zope Splitter
by Dieter Maurer 25 Sep '01

25 Sep '01

We want to have all questions go to the list.... Reply redirected.... Toves,Jenny writes: > I have been tasked with getting our textindex to index words that are all > digits (such as '123'). I saw an archive with a message > (<http://zope.nipltd.com/public/lists/zope-archive.nsf/ByKey/AE534A02934E861 > 2> > ) from you that looks like you have fixed a similar problem. Is modifying > the spliiter code the only way to fix it? Did you get it compiled and > re-installed? Was the HowTo mentioned in the response to your message > helpful? I updated the splitter in order to get UTF-8 strings indexed. Someone else extended the splitter for recognizing numbers and words with less than 3 characters. There have been no problems at all when I modified and recompiled the splitter (under Unix!). I just edited the code and started "make" in the corresponding directory. That was it... Dieter

1 0

Problem with security. Request for authentication pops up unexpectedly
by Robert Rottermann 25 Sep '01

25 Sep '01

Hi There, I created a product. One of its baseclasses is ObjectManager. When I add a file "into" an instance of the product and try to download it an authentication screen pops up and asks for name and password. If I click cancel I can download the file without problem. What could be the reason of this behavior? thanks Robert

3 3

Re: [Zope] Re: [Zope-dev] New: Cross Site Scripting vulnerability
by Oliver Bleutgen 25 Sep '01

25 Sep '01

> [Bill Anderson] >> > umm chris, >> > >> > you're right, but this example >> > >> > > http://www.zope.org/Documentation/<SCRIPT>alert(document.domain)</SCRIPT> >> > >> > executes the script. I don't exactly see why/where but I feel >> >> Perhaps it is a browser thing? It isn't being executed by Galeon. >> >> >> Bill >> > Pasting that URL into IE and Netscape 4.73 in Win2000 didn't execute it > either. > Tom P This is not too suprising, as the code on zope.org was apparently changed not to display alternative links to classic.zope.org:8080/<remainder of url> anymore. At the time the first mail was posted it did, and IE (5.0.whatever) thought it was a good idea to execute that javascipt - don't know if rightly or not. But it really never was a zope problem, for all I can see. cheers, oliver

1 0

Re: [Zope-dev] New: Cross Site Scripting vulnerability
by Oliver Bleutgen 25 Sep '01

25 Sep '01

>> Hello message board. This is a message. >> <SCRIPT>malicious code</SCRIPT> >> This is the end of my message. > I don't really see your point other than a carelessly implemented app may > expose these kind of vulnerabilities. Python (and hence Zope) has a > library > for stripping out this sort of malicious HTML. > Search for Strip-o-Gram or Squishdot on Zope.org for examples of how this > can be used. umm chris, you're right, but this example http://www.zope.org/Documentation/<SCRIPT>alert(document.domain)</SCRIPT> executes the script. I don't exactly see why/where but I feel this really shouldn't happen. As I see it, it's more a problem of zope's standard_error page, which constructs links to the classic zope site. I don't see a zope-specific bug here, too. cheers, oliver

3 2

RE: [Zope] message edit
by Hout, Eric van den 25 Sep '01

25 Sep '01

Hi, Not exactly, I need a way the user can insert a picture somewhere in the text. The pictures does not have to been seen immediately, but he or she does not have to create html/dtml either. Grtx, Eric > -----Oorspronkelijk bericht----- > Van: Chris Withers [mailto:chrisw@nipltd.com] > Verzonden: dinsdag 25 september 2001 15:10 > Aan: Hout, Eric van den > Onderwerp: Re: [Zope] message edit > > > "Hout, Eric van den" wrote: > > > > I'm real new to zope. I'm trying to find out if it's useful > for us, so I > > want to create a small pilot site, without too much > learning. However, I'm a > > bit overwhelmed by the number of info and plugins available > for Zope. > > Off list, 'cos it hardly seems appropriate to post it to the > list, but: > http://www.cbsnewyork.com/missing/ > > ...uses a Zope Product called Squishdot (www.squishdot.org) > and appears to do > exactly what you want... > > cheers, > > Chris >

2 1

Newbie: .authenticate() won't work
by Toh Wanda 25 Sep '01

25 Sep '01

Hi! I'm exploring Zope for only 2 weeks, so I'm quite a Newbie. I worked myself through "The Zope Book" (till they started with Python, I'm keeping that for later) and right now I'm reading the german "Zope" book by beehive. And I get stuck. What I want to do: I want users to be able to change their passwords, but only their own one. So they have to enter their username and password to get to a page with a form where they can enter the new password, if the given password for the username was correct. How: I try to check this (as described in the book) with: <dtml-if expr="acl_users.getUser(REQUEST.form['Name']).authenticate(REQUEST.form['Passwort'],REQUEST)"> Problem: When I'm submit my form (with 'Name' and 'Passwort') I mysteriously get the Zope login popup (although I'm logged in as manager). And even if I enter my Password I get the PopUp again and again. After the third time I get eventually an error saying: Unauthorized: authenticate in the last line. If I view without the "manage" I don't get a Popup but: Error Type: TypeError Error Value: unhashable type rightaway. Excluded problem sources: The variables are there. Spelling is correct. I can do all the other things (getUser, getRoles, etc.) without problems, only the "authenticate" is incooperative. I checked all security and permission tabs, but didn't find anything unnormal. It doesn't matter whether I try to check the Username I am logged in as, or a different one. So, did anyone have similar problems. Has "authenticate()" a special position, needs more permissions than the others? I just don't see why e.g. "getUser()" should be more restricte than "authenticate()". Or am I standing on the Schlauch here ;-) / not getting the point? TIA, have a nice day/morning/night, Toh! _________________________________________________________________ Downloaden Sie MSN Explorer kostenlos unter http://explorer.msn.de/intl.asp

2 1

Parsed XML Problem (we may need the best minds to solve this one :-)
by Adam Warner 25 Sep '01

25 Sep '01

Hi all, I'm calling an external method with this DMTL: <dtml-var "db2onehtml(_.getitem('test.xml'))"> Which works fine so long as I upload "test.xml" as a _file_. If I upload test.xml as Parsed XML I instead receive this error message: Error Type: TypeError Error Value: call of non-function (type string)  It appears Parsed XML items in the Zope database are not objects like files. http://www.zope.org//Wikis/DevSite/Projects/ParsedXML/ParsedXMLIsNotXMLObje… I want to be able to treat Parsed XML as an object. I hope someone can give me a clue where to proceed. I also tried calling a python method which took the XML data from the Parsed XML and converted it to a string. I then tried feeding my external method with the string. But I just receive this error message: 'string' object has no attribute 'id' My Zope details: Zope 2.3.3 (source release, python 1.5.2, linux2) Python Version 1.5.2 (#0, Apr 10 2001, 10:03:44) [GCC 2.95.3 20010219 (prerelease)] System Platform linux2 ParsedXML (Installed product ParsedXML (ParsedXML 1.0)) Thanks everyone, Adam

3 6

NIP Launches Personal Zope Hosting Option
by Chris Withers 25 Sep '01

25 Sep '01

NIP is proud to announce the launch of the Personal Zope Hosting Option. The option includes: - One instance of Zope running on one of our Personal Hosting servers, accessible through a domain name similar to: http://youraccount.personalzope.nipltd.net - Virtual Hosting of a domain name registered with a third-party DNS hosting service. For example: http://www.yourdomain.com --> http://youraccount.personalzope.nipltd.net - The ability to change Zope Versions quickly and easily. - Web-based account management with our Account Management System. - FTP access to your Zope Instance, Products, Extensions and logs. - WebDAV source port access to your Zope Instance. - Access to an SMTP mail server to send outgoing mail using, for example, a Zope MailHost object. The cost is £30 per month (roughly $40 per month). More information can be found at: http://www.nipltd.net/Personal This hosting option complements the Free, Professional and Enterprise Zope Hosting Options already available from http://www.nipltd.net. If you have any hosting-related questions, please send them to hosting(a)zope.nipltd.com. cheers, Chris

1 0

RE: [Zope] message edit
by Hout, Eric van den 25 Sep '01

25 Sep '01

I've seen a lot of that wiki stuff passing by when roaming on zope.org. But never really found out what it's like. Anyone knows what it's like? The structured text thing seems worth to try however, I 'll have a look at it, Thanx. Grtx, Eric

1 0