June 2002 - Zope - Zope lists

Best way to impliment ultralight security / restricted access schemes.
by Gary Speer 15 Jun '02

15 Jun '02

Hi - I'm looking for the most expedient way to accomplish the following: We have a project where we want to implement persistent security (if you can call it that) by folder but using annonimous or screenname-only logins. To put it plainly, if you know the secret password for a folder, same password for all coming to the folder, you get access to the folder and all subfolders. Your access is persistent, session to session, at least by machine (cookie) or your list of folder accesses is restored when you login using the same screen name. Each user may have a different combination of folder approvals. I know there are lots of ways to do this with typical html panashe. I'm looking for really cool ideas that use the power of Zope to keep this really simple. The semi-obvious is to make the first-time-access password a property of the folder. Its the remembering you've been there before and automatically letting you back in that we are after via a database record (preferred) or a cookie. All thoughts appreciated. Thanks, gary

2 1

RE: [Zope] How to concatenate variables
by McDonnell, Larry 15 Jun '02

15 Jun '02

Ok, how do you use <dtml-in concat_sub_type_to_part_num(st1,sub_type2)>? I keep getting a key error. Can you use a python script passing variables in a dtml-in statement? -----Original Message----- From: Dieter Maurer [mailto:dieter@handshake.de] Sent: Friday, June 14, 2002 3:05 PM To: McDonnell, Larry Cc: 'Zope@Zope. Org' (E-mail) Subject: Re: [Zope] How to concatenate variables McDonnell, Larry writes: > I am having problems concatenating variables. I have seven pull down menus. > Selecting one from each menu will create a part number. I setup a test to > see if this would work. I have one dtml doc with the menus. After a submit > it calls this dtml doc: > > <form name="form1" method="post" action=""> > <dtml-let pn="' ' "> > <dtml-call concat_sub_type_to_part_num(st1,sub_type2)> > <dtml-var st1>st1<dtml-var sub_type2>st2 > <dtml-var expr="pn==st1+sub_type2"> > <dtml-var pn> pn > </dtml-let> > </form> > > I call a python script concat_sub_type_to_part_num and pass two of the menu > selections in this test. I tried to concat there but no luck. I can only see > the variables I passed. Functions are unable to change strings in the callers context. You need to return the concatenated value. And you must not use "dtml-call" in this case, as it discards the return value. Dieter

2 1

Planning advice
by Charlie Reiman 15 Jun '02

15 Jun '02

I've been working with Zope for a few months now and I'm not really thrilled with what I've got. I have a functioning website and it works and does what I want but I can already see that moving forward is going to be unpleasant. As an engineer this bugs me and I need to evaluate the situation and determine: is it me or is it Zope? The project has two major goals. First, to create a data reporting site. It's a straightforward display of SQL data as tables. Nothing super-fancy but there are style issues and there's quite a number of reports, all different, and date ranges, etc... Lots of minor issues. The only tricky part is the reporting system needs to support multiple customers, ideally off of the same URL, each seeing different data. The second part is trickier. Each client may have custom or hidden reports and I need to be able to maintain this stuff. Ideally, I won't be maintaining and customizing this, as I'm expensive. A cheaper webmonkey (who is a fully actualized human to whom I intend no disrespect by calling a "webmonkey") will be doing the customization and maintenance. In object parlance, I customer's reports would be subclasses of a generic reporting class, adding and removing functionality as needed. What exactly would be the right approach to this? My original attack was a Python product. This rapidly became a huge pain, as the folderish product contained several ZSQL methods that require constant tweaking. With each tweak, I had to delete existing instances of my product (as they contained instances of old ZSQL methods) and reinstall and reconfigure a new instance. Iterations usually involved bouncing the server as well since it eventually failed to work correctly with refresh (I never figured out why). On top of that, subclassing my product to create custom reports is beyond what we expect of our future simian. The current approach consists of a "reports" folder that I mirror via PortableHole to different client folders. This lets clients have custom attributes that the mirrored reports can acquire. This is also unpleasant since it makes it impossible for custom pages in the clients folder to acquire reporting infrastructure data from the reports directory. It also fully exposes my reporting system to the future webmonkey. I will only be able to distract them with bananas for so long before they stick their paws into my juicy code resulting in a sticky mess and an angry monkey. So what would you do? Products look like the right thing, but I'm not sure how to handle the mess of SQL methods and potentially complicated customization I need to do. Just so it's clear, here's what I have now: /clients/one/reports (PortableHole to /reports) /clients/two/reports (PortableHole to /reports) /reports (contains LOTS of stuff, including more folders with ZSQL methods, DTML, Python snippets, images...) I also had a previous solution: /reports/client-one/index.html /reports/client-two/index.html /reports/... All the above mentioned DTML & ZSQL stuff but not organized into subfolders. This solution was unmaintainable since the reports folder was rapidly swelling to huge proportions, making it difficult to work in that folder. What it feels like to me is that Zope's acquisition is clever but insufficient for moderately complicated design. What I want is more like an import or inheritance system, where I explicitly state what I'm trying to use. Obviously, I'm missing something (besides a monkey). Comments?

2 1

Form in ZClass
by Daniel Schmitz 15 Jun '02

15 Jun '02

Hi all, its possible make automatic form in Products/Zclass? Bye _______________________________________________________________________ Copa 2002 Yahoo! - Patrocinador oficial da Copa do Mundo da FIFA 2002 http://br.sports.yahoo.com/fifaworldcup/

2 1

external process
by Micah Martin 15 Jun '02

15 Jun '02

Hi all, I can't seem to get Zope to initiate an external process. I've tried to use External Methods and the Python os library functions spawnv() and fork() with execv()/system(). In each case the functions run and return but nothing else happens. Running the same function calls from Python outside of Zope works fine. Anyone have any ideas why it wont work or how to get it to work? Micah

3 2

sql method call not working
by Kelley, Sean 15 Jun '02

15 Jun '02

Hi, I am trying to call a simple sql method to insert data from a form. Does not work. I have used this same way of doing it before and cannot see the problem. I can test the sql method and that works, but calling it from the html doc does not work. I can comment out the call and insert some html and that works ok also. <dtml-try> <dtml-call name="plancheck_insert"> <dtml-except> <br>Sorry, your IW Plan Check Entry was not added to the database because an error occurred. </dtml-try> I get the exception message. Do you see a reason why this might not work? I looked at persmissions, spelling, etc. Sean Kelley Technology Coordinator Utilities Dept. City of Santa Rosa

3 2

Re: [Zope] Zope 2.5 and TransparentFolder incompatibility
by Joachim Werner 15 Jun '02

15 Jun '02

Hi! Some notes on Transparent Folders (TF): a) We've been using TF heavily and we really regret it. The performance hit is enormous, especially if you have nested TF. We got response times up to 10-15 secs on a fast Athlon server with loads of RAM. That's extremely bad. b) I don't know why TF should not work fine with Zope 2.5.1. We were using OrderedFolder with transparency support enabled, and that worked. Maybe there are issues with plain TF, I don't know. So, yes, eliminating TF in your product will be a major pain, but I'd rather do it anyway (even if you don't HAVE TO eliminate them for compatibility reasons). Some solutions for the problems you mention: a) One idea is putting everything into one large root folder (and do the same for the subfolders). I.e., all the images would not be in an image folder but in the main folder. Then use FolderFilter to create views that only display images, content, etc. With some additional magic you could make sure that your end users don't see the stuff that could irritate them. b) Write a method, e.g. "getImage()", that looks in the local Images folder first and then dives into the hierarchy. This is way more efficient than TF and has a similar effect. I have to admit that dtml syntax becomes rather ugly with that ("<dtml-var "getImage('image.gif')">" instead of just <dtml-var image.gif>), but it works. I perfectly understand your problems, and TF seem to solve them elegantly. Elegantly yes. But not efficiently. That's the problem. I am not Zope3-literate yet, but I was told that Zope3 will offer much better solutions for problems like that. We'd need additional namespaces. E.g., you are using transparent Images folders to make sure that one can overload certain images locally without having to overload all images. What you'd really need is not TF, but an image namespace (let it be represented as a folder or not) that looks up in other image locations if an image is not found locally. That's similiar to what skins do in the Content Management Framework. I guess it would be rather simple to build a folderish object that uses a different way of acquisition (e.g. looks for other folders of its kind in the hierarchy). Joachim

2 2

pdf generator troubles
by Erik Myllymaki 15 Jun '02

15 Jun '02

DTML calls an external method to show a PDF file inline: <dtml-call "RESPONSE.setHeader('content-type','application/pdf')"> <dtml-call "RESPONSE.setHeader('Content-Disposition','inline;filename=somefile.pdf')">< dtml-var expr="pdftest('C:\somefile.pdf')"> external method is like this: -------------------------------------------------- def pdftest(pdf_filename): import sys f=open(pdf_filename) y = f.read() f.close() return y --------------------------------------------------- But I always get a *File is damaged* error no matter what PDF file I give it. Testing the function outside of zope, it returns only part of each PDF. as soon as it hits STREAM it stops...? Zope 2.3.2 on WinNT Server 4.0 Note:tested ONLY with IE 5.5 on win2k

2 2

<dtml-var maimxum length of expression
by p.t. 15 Jun '02

15 Jun '02

Does somebody know the maximum length of an expression in dtml-var? 1024 characters? TIA, p.t.

1 0

Zope 2.6.0a1 download link broken!!!!!
by Joachim Werner 15 Jun '02

15 Jun '02

Hi! Could someone please fix the download link for 2.6 alpha 1? It doesn't work, and seems to contain a trailing whitespace. Cheers Joachim

2 1