October 2002 - Zope - Zope lists

BeforeTraverse and SSLAuth
by Antonio Beamud Montero 09 Oct '02

09 Oct '02

Hello all: I have a product that is an extension of Folder, and I want to include SSL cert. auth when I traverse this extended Folder. I have implemented a method that checks the existence of a user in the acl_user inside my extended Folder, and a __call__ method that uses this other method. but now I don't know how to register this method with BeforeTraverse... Inside BeforeTraverse code I saw: ---------------------> def registerBeforeTraverse(container, object, app_handle, priority=99): """Register an object to be called before a container is traversed. 'app_handle' should be a string or other hashable value that distinguishes the application of this object, and which must be used in order to unregister the object. If the container will be pickled, the object must be a callable class instance, not a function or method. -----------------------> What value I need for 'app_handle'? And for object?, for container I'll put self. Thanks in advance. -- Microsoft merges technologoies: Windows CE + Windows ME + Windows NT = Windows CEMENT ---- Antonio Beamud Montero Agora Systems S.A. http://www.agoratechnologies.com

1 1

LocalFS Security
by Jonathan Stoneman 09 Oct '02

09 Oct '02

Hi, We have a Zope server that out customers can have space on. We provide them with an folder containing a User Folder which contains their user. They can then do whatever they want within this space. We do not want to place any un-necessary limitations on what they can do. The problem is that we want to install the LocalFS product on the server. If the customers have permissions that allow them to create or edit LocalFS objects, then they can access any part of the local file system that the zope user can. We can stop them from creating and editing LocalFS objects by removing the Add Local File Systems and Change Local File System Properties permissions from their roles in the root folder. The customers would then have to contact us to have a LocalFS object created or edited but this would be an acceptable solution. The problem with this solution is that they can change the role that their user has, or change the permissions of their folder. Either way they can get permission to create / edit LocalFS objects. We could stop them from doing this by taking away their Manage Users and Change Permissions permissions, but this is not really acceptable. Is there any other way that we can install the LocalFS product and stop users from creating / editing instances of that object? Thanks... JOn -- Jonathan Stoneman - Programmer - Frontier Internet Services Limited Tel: 02920 820045 Fax: 02920 820038 http://www.frontier.net.uk All statements made are subject to Frontier's Terms and Conditions of Business which are available upon request.

3 2

Access document_src
by Andreas Tille 09 Oct '02

09 Oct '02

Hello, I use a Python Script to set some parameters before calling a Page Template document. The call is done in the following way: if REQUEST is not None: return container['test.zpt'](REQUEST, name=name, title=title) Unfortunately this does not seem to work for anonymous user because I will be presented by a passwort autentification question and if I cancel this I get: Zope has encountered an error while publishing this resource. Error Type: Unauthorized Error Value: You are not allowed to access document_src in this context Any hints how to make this accessible for anonymous user? I see two ways here: 1. Call it the "right way" (but what would it be?) 2. Adapt permissions correctly (but without opening a hole). Kind regards Andreas.

2 2

Re: [Zope] LocalFS Security
by Jaroslav Lukesh 09 Oct '02

09 Oct '02

Hi, Please put that code to LocalFS homepage at http://sourceforge.net/projects/localfs/ or put patch code into Zope members section (product) I am interested in that patch too. Regards J. Lukesh ---------- Odesílatel: Jonathan Stoneman <Jonathan.Stoneman(a)ftech.net> > prevent the user from configuring LocalFS with > ../../../etc/passwd and > that stuff. > Maybe filtering out '..' should do it? > > HTH, > oliver Thanks for your help, I had actually considered doing this, but was hoping there was a simple way of doing it that I had missed. Time to start looking at the LocalFS source then.. :)

1 0

Re: [Zope] WISH LIST - idea of new, DTMLRelation object
by Jaroslav Lukesh 09 Oct '02

09 Oct '02

| Odesílatel: Tino Wildenhain <tino(a)wildenhain.de> | perhaps you want to use <dtml-with rootfolder> ...navigation.. </dtml-with> | | ? | | Rootfolder could be the object you want to be the root (of course) | or in case of ZopeRoot, you get it via REQUEST.PARENT[0] | | However, before beating the dead horse, you should consider | replacing your routine with a python script, which could | also use ZCatalog in place of ObjectValues() - this saves | Memory and time since not all Objects have to be activated. | | This approach would also help you to go the way from | DTML to ZPT which is recommended. | | Greetings Many thanks, I am blind. Sure, it is right solution. I'm very sorry for confusing. Regards JL.

1 0

Accessing the PARENTS of the objects displayed by a DTML-tree
by Pierre Godefroy 09 Oct '02

09 Oct '02

I am reformulating an earlier e-mail, as its wording might be confusing. (I also gave it a sexier subject line... :>) I have the following Python script, which works well, thanks to an earlier suggestion made by Maik Jablonski (it gives the position of an object inside Zope folder hierarchy in the form of a "nested numbers", such as : "3.4.3.2.3") : --------------------------------------------------------------------------------------------------- from string import join res=[] lll=len(context.REQUEST.PARENTS) for i in range(lll-1): xyz=context.REQUEST.PARENTS[i].id a=context.REQUEST.PARENTS[i+1].objectIds().index(xyz) res.append('.'+str(a+1)) res.reverse() fullnumber=join(res) print fullnumber return printed -------------------------------------------------------------------------------------------------------- My problem is : how could I apply a similar mechanism for the objects displayed by a dtml-tree? I would like to have something like : 1 : title 1.1 : title 1.2 : title 2 : title 2.1 : title 2.1.1 : title 2.1.2 : title This could be obtained by : <dtml-tree branches_expr="objectValues(['Folder'])"> <dtml-var my_python_script><dtml-var title> </dtml-tree> BUT, of course then, "context.REQUEST.PARENTS" in my present script is not good as it applies to the main object being called, not to the successive folders which are being retrieved recursively through the dtml-tree. I need to access successively the PARENTS hierarchy of these objects. What should I do? Is there a solution? How should I modify the script (or the DTML-tree itself)? Thanking you all in advance, Pierre Pierre Godefroy 52 rue des Archives 75004 PARIS FRANCE Tél. : +33 (0)1 42 74 46 05

2 1

WISH LIST - idea of new, DTMLRelation object
by Jaroslav Lukesh 09 Oct '02

09 Oct '02

Hi all, I have an idea of new Zope DTML object with specific things. Dear Zope developers, please take attention to following lines: Imagine folder structure as / /folder1 DTMLMethod DTMLDocument DTMLRelation image.gif /folder11 /folder111 /folder112 /folder12 /folder2 /folder21 All three DTML* contains same code: <dtml-in "objectValues('Folder')"> <dtml-var id><br> </dtml-in> <img scr="<dtml-var absolute_URL>/image.gif"> Imagine what is doing that DTML Document or DTML Method are called from inside of /folder11. DTML Document make bad, but still functional (due acquisition) link to image. But DTML Relation will still give that same output, independent from where you call it: folder11 folder12 <img src="http://domain/folder1/image.gif"> Output is still independend from where you calling that DTMLRelation and give you right URL paths (relative or basolute). I think that DTML Relation (or you can call it better) should be very usefull, for example: 1. for navigation structure when you want to have constant navigation buttons what are dynamically generated from folder structure that have strong changes in any folder names 2. for image menus, where it give right path to images folder instead of acquired images etc. (I now, you can specify path with <dtml-var BASE1>/images/image.gif) Many thanks for your kindly attention. If it have simple solution by standard DTML code, let me know that code, please. Best Regards J. Lukesh

2 1

calling dtml method from python script
by Mark Gibson 09 Oct '02

09 Oct '02

I really thought I knew how to do this: context.sendMail(_.None,_) However, it can't resolve the names within the sendmail message: Error Type: KeyError Error Value: MailHost sendMail works fine using the 'View' tab Any ideas? Thanks, Mark

2 1

RE: [Zope] LocalFS Security
by Jonathan Stoneman 09 Oct '02

09 Oct '02

> Jonathan Stoneman wrote: > > Hi, > > > > We have a Zope server that out customers can have space on. We > > provide them with an folder containing a User Folder which contains > > their user. They can then do whatever they want within this space. > > We do not want to place any un-necessary limitations on what they > > can do. > > > > The problem is that we want to install the LocalFS product on the > > server. If the customers have permissions that allow them to create > > or edit LocalFS objects, then they can access any part of the local > > file system that the zope user can. > > > > We can stop them from creating and editing LocalFS objects by > > removing the Add Local File Systems and Change Local File System > > Properties permissions from their roles in the root folder. The > > customers would then have to contact us to have a LocalFS object > > created or edited but this would be an acceptable solution. > > > > The problem with this solution is that they can change the > role that > > their user has, or change the permissions of their folder. Either > > way they can get permission to create / edit LocalFS objects. We > > could stop them from doing this by taking away their Manage Users > > and Change Permissions permissions, but this is not really > > acceptable. > > > > Is there any other way that we can install the LocalFS product and > > stop users from creating / editing instances of that object? > > > > > > Thanks... JOn > > How about modifying the localfs product to not allow arbitrary paths? > Like always prepending /home/yourlocaluseraccount/ to what > they type in, > this is the simplest method coming to my mind. Other involve > chroots and > such stuff which will get very nasty. > But you'll have to seriously think about it, because you'll have to > prevent the user from configuring LocalFS with > ../../../etc/passwd and > that stuff. > Maybe filtering out '..' should do it? > > HTH, > oliver Thanks for your help, I had actually considered doing this, but was hoping there was a simple way of doing it that I had missed. Time to start looking at the LocalFS source then.. :) Thanks again... JOn. -- Jonathan Stoneman - Programmer - Frontier Internet Services Limited Tel: 02920 820045 Fax: 02920 820038 http://www.frontier.net.uk All statements made are subject to Frontier's Terms and Conditions of Business which are available upon request.

1 0

Aquisition
by Oliver Marx 09 Oct '02

09 Oct '02

Dear List I'm looking for a folder like product where I can control the aquisition. Plone Skin has fx a path like property. Do you know of such a product? Thx for your time :) \Oliver

1 0