May 2002 - Zope - Zope lists

RE: Security Assertions, maybe time to change SimpleItem?!
by Pierce, Scott 21 May '02

21 May '02

Exactly, the fact that I could still access them is what caused me to abandon the feature 4 weeks ago not realizing the other effect. Trust me, I have likely read that element of the ZDG 5 times if not more. Although I believe in RTFM, with something as esoteric as Zope you gotta lighten up. Zope needs a mentoring program. The docs just aren't there yet. It honestly was not my intention to threaten anything. I was simply scared that I was going to have to jump ship with only a week and a half to go. Hmmm... my class was explicitly inheriting SimpleItem.SimpleItem so I wouldn't have to bother with the order in which I inherited. Another Zope lesson learned. Unfortunately, I only have some much cranial capacity to spare. I'm afraid I am going to have to drop a few birthdays and an anniversary to make room. Scott -----Original Message----- From: Chris Withers [mailto:chrisw@nipltd.com] Sent: Tuesday, May 21, 2002 8:02 AM To: Pierce, Scott Cc: 'zope(a)zope.org' Subject: Security Assertions, maybe time to change SimpleItem?! "Pierce, Scott" wrote: > > OK, I'll publicly humilate myself now. Not entirely, other than not really reading the bit about security in the ZDG ;-) > my own oversight. I incorrectly believed that having turned off permission > acquisition and limiting 'View' access to a few select roles would be > sufficient regarding DTMLFiles. I assume you're developing a Python Product here? The answer is that it probably should, but you got caught out by a peice of history. It is documented that if you make no security assertions about a method in a python product that nothing will be able to access them, which is what you should have been experiencing, and which would have told you much more quickly that you had forgotten to make any security assertions. However, this policy was only(?!) introduced back in Zope 2.2 and so, for fear of breaking lots of code, a class called SimpleItem has an __access_unprotected_subobjects__=1 assertion. This basically makes unprotected stuff anonymously viewable, which was the old policy. Sadly, prettymuch everything subclasses SimpleItem, so the documented security policy isn't realyl adhered to much, hence when you forgot to make security assertions, the methods became anonymously viewable, which, from your poitn of view, sux ass. > I believe, and am not completely sure, that > this is not the case because they are global having been 'instatiated' via: > index_html = DTMLFile('index_html', globals()) within a product. ...so this isn't quite correct. > frustration/desperation as inappropriate. Zope can be a dark mistress. ...some would say a complete bitch ;-) Maybe it's time to change that assertion in SimpleItem and finally break all the code that peopel should have fixed long ago? cheers, Chris

1 0

always anonymous user despite basic authentication
by Pierce, Scott 21 May '02

21 May '02

(notice I changed the subject line) Well, thanks to all the advice but upgrading to 2.5.1 is still showing 'Anonymous User' though I just authenticate via the browser interface. I could change things around and create the dtml stand-alone but I use extensive use of traverse_subpath. In doing this, for some reason, I lose this REQUEST variable. Scott Pierce Sonopress US - Digital Services 828.658.6157

4 3

Fwd: [Zope] Doubt
by Bernd Kulawik 21 May '02

21 May '02

....oops - I forgot to click on "answer all" :-) > Von: Bernd Kulawik <kulawik(a)biblhertz.it> > Datum: Die, 21. Mai. 2002 14:44:36 Europe/Berlin > An: BZ <bz(a)bwanazulia.com> > Betreff: Re: [Zope] Doubt > > > Am Dienstag den, 21. Mai 2002, um 11:42, schrieb BZ: > >> Not a "good" way. >> >> Go with Mac OSX. Seriously. I used to have to do all my dev work on my >> Linux server now, I have as many versions of Zope running on my >> Powerbook (right next to word, excel, photoshop, iTunes, etc). There >> is a nice package of pre-compiled versions here for OSX (2.3.3 -> >> 2.5.2) >> >> http://opensource.spvi.com/ >> >> You have to use the command line > > not if you look for the 2.4.1 (or was it 2.4.3?) Version for OS X in > the Download-Section at Zope.org: this one comes with an installer and > a "Starter" for the Dock too - very nice :-) > >> , but hey, that is what it is all about. :) > > of course, you're right :-) > This hint was only for people who hesitate to learn more about the > abstract beauty of (for instance): rm -rf * > > :-) > >> >> BZ > > > Bernd >

1 0

eating crow
by Pierce, Scott 21 May '02

21 May '02

OK, I'll publicly humilate myself now. My anonymous user problem was due to my own oversight. I incorrectly believed that having turned off permission acquisition and limiting 'View' access to a few select roles would be sufficient regarding DTMLFiles. I believe, and am not completely sure, that this is not the case because they are global having been 'instatiated' via: index_html = DTMLFile('index_html', globals()) within a product. setting all DTMLFiles within a security.declareProtected('index_html',etc...) did the trick, which of course makes sense in hindsight. The clue I got was that if I came through a management screen the user was being pushed through as expected. So, I apologize to anyone who may have interpreted my frustration/desperation as inappropriate. Zope can be a dark mistress. Scott Pierce Sonopress US - Digital Services 828.658.6157

2 1

RE: [Zope] Strange pdf problem
by Etienne Labuschagne 21 May '02

21 May '02

I've currently got the same problem. I've got Zope 2.4.1 running on a Win2K server box. The machine I am testing from has Windows 2000 Professional running using IE 6.0 as browser. Some PDFs work others don't. On my machine with only Adobe Acrobat Reader, I get the blank screen. On one of my colleagues with the full Adobe installation, we don't get the problem. Only a switch between me and the server. Unfortunately I have no idea at the moment on how to solve the problem! Regards Etienne -----Original Message----- From: Markus Schaber [mailto:markus.schaber@student.uni-ulm.de] Sent: Tuesday, March 12, 2002 10:00 PM To: zope(a)zope.org Subject: Re: [Zope] Strange pdf problem Hi, Derek Simkowiak wrote: > -> > We have a pdf file in our database, and there's a Problem with > -> > displaying it. > > Please descibe the web hosting setup this is being served from. > I.e., what O.S. is the origin server, are there any proxies > involved (and what are their O.S.'s), is there any kind of > caching being done, etc. Also, is Apache anywhere in the chain > (perhaps as a caching proxy)? Are there any load-balancing > routers in the way? It was using IE on Win, Netscape 4.7 on Linux and Mozilla 0.9.8 on Linux. This seems to imply that it's a problem with the acroread plugin, and not with the OS or the Browser. The windows machine was on the same subnet (I think a switch was inbetween, but might be a bridge), the linux client had some routers inbetween, but no load balancing. The server is an debian woody on linux 2.4.17, Apache 1.3.23-1 using mod-rewrite using proxy rules [P] to hide zope 2.4.2-0.2, all the precompiled debian packages. We currently "solved" the problem by putting the file into a directory where it is served directly by apache, and this seems to work. Markus -- "Ihre Meinung ist mir zwar widerlich, aber ich werde mich dafuer totschlagen lassen, dass sie sie sagen duerfen." - Voltaire _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Doubt
by George Schafflor 21 May '02

21 May '02

Dear Sirs, I have a PowerBook Apple MacIntosh computer. Is there a version for this plataform (Mac OS9)? Thanks, George from Brazil

5 4

Acquiring Objects in ZPT
by David Kyte 21 May '02

21 May '02

Hi, I have an application that displays pages from a folder. The List is defined by looping over the objects. If I create a link of the type folder/ObjectID, each time I select the link I end up with a url like Letters/Letters/Letters/.../Letter1 Is there an equivalent of <dtml-with Letters> <dtml-var Letter1> </dtml-with> in ZPT. TIA Dave

2 1

Re: (ZPT) Optimisation fun and games
by Anthony Baxter 21 May '02

21 May '02

>>> Chris Withers wrote > Yeah, it's a shame that such as nice templating language has this limitation, > but ZC are taking the head-in-sand-lets-use-squid-in-front-of-our-'dynamic' > -websites approach :-S I think this is unfair. ZC, like everyone else, has a certain amount of resources, and they need to bring money in to make sure everyone gets to eat. I can't imagine the ZC guys being happy that ZPT is in a known-to-need- speedups state. If it's a drama, "send code". Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

Transfer my ZOPE website
by José Orlando Ribeiro 21 May '02

21 May '02

I did a website , now i'm going to upload it to the webserver i'm paying, what i will need to upload?

3 2

Re: [Zope] Optimisation fun and games
by Anthony Baxter 21 May '02

21 May '02

>>> Chris Withers wrote > Dunno, I've just never conceptually got on with FastCGI, how ever small the > CGI stub is, you're still reading a file from disk and executing it for every > single request... Huh? What you talking bout, Willis? Apache has fcgi builtin. ZServer has fcgi built in. So there's nothing to exec. A request comes in, Apache makes a TCP connection to the ZServer FCGI port (well, to the loadbalancer of the fcgi ports, in our case), and does the request. Same thing that happens for proxy pass, only different port and protocol (http instead of fastcgi). The only difference is that with FCGI, the request _appears_ to be happening as though it had hit the ZServer directly, rather than via a proxy. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1