March 2002 - Zope - Zope lists

finding URL contents for MS behavior
by Mark A. Lilly 22 Mar '02

22 Mar '02

Greetings, For a project i'm doing, i need to use MS Internet Explorer Behaviors. Here's a link for the curious. (http://msdn.microsoft.com/workshop/author/behaviors/behaviors_node_entry.as p). They are mostly Javascript libraries that provide certain functionality. They are called as shown in the snippet here: <STYLE> @media all { IE\:Calendar { behavior: url(http://192.168.1.1:8080/Sputnik/ProjectHQ/calendar.htc) ; width : 33%; } ... The problem is, the code above doesn't work. When i change the url line to point to my apache on Port 80, it works fine. behavior: url(http://192.168.1.1/newsite/calendar.htc) ; How can i make this work in Zope? I tried saving calendar.htc as a DTML document and then a method. Should i use Local File System, or save as a File object or ??? Any thoughts are welcome. Thanks, mark

2 1

Re: [Zope] set accessrule
by jbr＠FIZ-Karlsruhe.DE 22 Mar '02

22 Mar '02

Hello Chris, > From chrism(a)zope.com Fri Mar 22 16:51 MET 2002 > Subject: Re: [Zope] set accessrule > Date: Fri, 22 Mar 2002 10:56:23 -0500 > > There is a simple answer to this question, but I'm not sure you're going to > like it. ;-) Don't solely use access rules for security. Instead, use the > Zope security framework. Protect the folder with a permission. It seems I have only 2 choices: 1.) I don't want to create a zope userid for each web user, because we have a proprietary product for authorization. I will use a generic zope userid for example web1. I protect my folder: only manager and zope user web1 can see this folder My folder has a access rule: It calls our proprietary product for authorization and if it grants access it will give the enduser the role web1. This could be done only if set access rule is done before zope checks for the permission, because otherwise the zope login prompt would appear first. Is that true ? 2.) If all this is not possible, I guess I have to change the sources of set access rule (or to create a product "mysetaccessrule") to enable _SUPPRESS_ACCESSRULE for role of manager only. Would this solve my problem ? 3.) The best would be if set accessrule could be improved to use _SUPPRESS_ACCESSRULE for role manager only. But I don't know if there are design issues making set access rule still not complete secure. I could try to do this, but I dont't know how to submit a proposal for a software change to a zope feature. With kind regards, Juergen Berger > > ----- Original Message ----- > From: <jbr(a)FIZ-Karlsruhe.DE> > To: <zope(a)zope.org> > Sent: Thursday, March 21, 2002 6:38 PM > Subject: Re: [Zope] set accessrule > > > > Hello, > > > > summary of set access rule with zope 2.5.0 > > > > 1.) for a folder testfolder I have set "Set Access Rule" to python script > accessHB > > to limit access > > > > 2.) as Chris McDonough has shown (thanks !) accessHB is working like: > > > > > > > From chrism(a)zope.com Thu Mar 21 19:21 MET 2002 > > > Subject: Re: [Zope] set accessrule > > > Date: Thu, 21 Mar 2002 13:26:28 -0500 > > > > > > Hi, > > > > > > I wouldn't bother to try to pass in REQUEST (the caller for access > rules > > > does not pass any arguments in to the script). Instead, get the > REQUEST > > > from context ala context.REQUEST. I think the test tab populates > REQUEST > > > for you via magic that doesn't happen when an access rule is called. > > > > > > Your script becomes: > > > > > > ----------------------------------------- > > > ## Script (Python) "accessruleHB" > > > ##bind container=container > > > ##bind context=context > > > ##bind namespace= > > > ##bind script=script > > > ##bind subpath=traverse_subpath > > > ##parameters= > > > ##title= > > > > > > if context.REQUEST.SESSION.get('MySessionId') == None: > > > context.REQUEST.RESPONSE.redirect('/rootfolder') > > > ----------------------------------------- > > > > > > > But there is a security problem with "Set Access Rule": > > > > Any user even the unauthorized can get access to the folder (which > > is restricted by set accessrule) if he adds _SUPPRESS_ACCESSRULE to the > url: > > > > http: ... testfolder/_SUPPRESS_ACCESSRULE > > > > gives access to restricted folder testfolder. > > > > This may be a bug or has been done to get access in case of emergency, but > > it makes set accessrule (more or less) useless. > > > > What can I do to prevent Zope to give access by adding > > _SUPPRESS_ACCESSRULE ? > > > > Do I have to modify the programmes which implement set access rule ? > > I even don't know where these programmes are located. > > > > With kind regards, Juergen Berger > >

3 2

Zope Build Failure
by Rengasamy, Samy 22 Mar '02

22 Mar '02

I installed Python-2.2 at /usr/share/apps/Python. I did the following: $ export LD_LIBRARY_PATH=/usr/share/apps/Python/lib/python2.2:$LD_LIBRARY_PATH $ export PATH=/usr/share/apps/Python/bin:$PATH Untarred Zope-2.5.0-src at /usr/share/apps and did: $ python w_pcgi.py The above failed as it could not locate Makefile.pre.in at /usr/share/apps/Python/lib/python2.2/config Then I copied it from /usr/share/apps/Python-2.2/Makefile.pre.in. Now it fails saying target boot not found in the Makefile. Am I missing a step here? Thanks in Advance, Samy Rengasamy.

3 2

Re: [Zope] set accessrule
by jbr＠FIZ-Karlsruhe.DE 22 Mar '02

22 Mar '02

Hello, summary of set access rule with zope 2.5.0 1.) for a folder testfolder I have set "Set Access Rule" to python script accessHB to limit access 2.) as Chris McDonough has shown (thanks !) accessHB is working like: > From chrism(a)zope.com Thu Mar 21 19:21 MET 2002 > Subject: Re: [Zope] set accessrule > Date: Thu, 21 Mar 2002 13:26:28 -0500 > > Hi, > > I wouldn't bother to try to pass in REQUEST (the caller for access rules > does not pass any arguments in to the script). Instead, get the REQUEST > from context ala context.REQUEST. I think the test tab populates REQUEST > for you via magic that doesn't happen when an access rule is called. > > Your script becomes: > > ----------------------------------------- > ## Script (Python) "accessruleHB" > ##bind container=container > ##bind context=context > ##bind namespace= > ##bind script=script > ##bind subpath=traverse_subpath > ##parameters= > ##title= > > if context.REQUEST.SESSION.get('MySessionId') == None: > context.REQUEST.RESPONSE.redirect('/rootfolder') > ----------------------------------------- > But there is a security problem with "Set Access Rule": Any user even the unauthorized can get access to the folder (which is restricted by set accessrule) if he adds _SUPPRESS_ACCESSRULE to the url: http: ... testfolder/_SUPPRESS_ACCESSRULE gives access to restricted folder testfolder. This may be a bug or has been done to get access in case of emergency, but it makes set accessrule (more or less) useless. What can I do to prevent Zope to give access by adding _SUPPRESS_ACCESSRULE ? Do I have to modify the programmes which implement set access rule ? I even don't know where these programmes are located. With kind regards, Juergen Berger

2 1

Re: Error with context.absolute_url() in Python script
by Harry Wilkinson 22 Mar '02

22 Mar '02

I should also mention that although the traceback shows that I'm using Zope 2.5.0, the same thing happens on a CVS checkout.

1 0

[��]�� web�� ٽ�� ˾ƾ� �մϴ�
by INFO 22 Mar '02

22 Mar '02

1 0

help needed about expat
by Benjamin Buffereau 22 Mar '02

22 Mar '02

Hi all, Anybody knows how to get expat to work in the linux binary distribution of Zope 2.5.0? Thanks, Benjamin.

1 0

Re: [Zope] form with mutiple actions?
by jbr＠FIZ-Karlsruhe.DE 22 Mar '02

22 Mar '02

hello, in Zope 2.5.0 there is an Examples folder below the root folder. Perhaps the ShoppingCart example may give you some hint. With kind regards, Juergen Berger > From: Hamzal Kamal <k_hamzat(a)yahoo.com> > To: zope(a)zope.org > Cc: steve(a)spvi.com > Subject: [Zope] form with mutiple actions? > > Hi, > > Is it possible for form to have more than one actions? > > What i have in mind to do is to collect some user info through the > form and store them into table at the same time display this info in > another form for the user to enter the remaining info and then finaly > pass the info into secure form. > > Any idea on the matter will be appreciated. > > ===== > Hamzat kamaldeen Ishola > Dnet Systems Limited > 223 Ikorodu Road, Lagos. > 234 1 7749381, 234 08033011305 > > __________________________________________________ > Do You Yahoo!? > Yahoo! Movies - coverage of the 74th Academy Awards® > http://movies.yahoo.com/ > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

base url is missing port number
by Juergen R. Plasser / Hexagon 22 Mar '02

22 Mar '02

I am using the tool WebStress (http://www.paessler.com/) to test our Zope server performance, but I have a problem with the base url: WebStress gets as base url: <base href="http://195.xxx.yyy.zzz/" /> But IE gets (the correct url): <base href="http://195.xxx.yyy.zzz:8181/" /> The WebStress url is missing the port 8181. Why is this so? Juergen

1 0

Re and answer: Displaying users in acl_users caused error
by Andreas Rippel 22 Mar '02

22 Mar '02

I was reporting the following: we are managing users in the acl_users folder mostly via python. Our applications works, but when we click on individual users within the acl_users folder, we get the following error message: ... Zope has encountered an error while publishing this resource. Error Type: AttributeError Error Value: domains ... File .../lib/python/DocumentTemplate/DT_Util.py, line 160, in eval (Object: user.domains) (Info: user) File <string>, line 0, in ? AttributeError: (see above) Answer: Within our folders we had one named user, which obivously was resolved within the acquisition procedure. After renaming that folder to uppercase, everything works. So never name on object within your zope application user, it might cause unpredictable effects. \Andreas

1 0