October 2003 - Zope - Zope lists

About catalog and folder privacy...
by Patrick Gelin 10 Oct '03

10 Oct '03

Hi, I'm looking to modify the catalog (or change the catalog with an other product) which take into account the folder's privacy. For example a public object inside a private folder must not be displayed to a member or anonymous user! My goal is to create sub-workspaces inside my Plone site and I think this is the only way... Thanks.

2 1

RE: [Zope] RDBMS Applications and direct calling of script(python)andsql methods
by Derek S. Wilson 09 Oct '03

09 Oct '03

Says keyerror AUTHENTICATED_USER when I try it. Thanks, Derek Wilson -----Original Message----- From: Erik Myllymaki [mailto:erik.myllymaki@aviawest.com] Sent: Thursday, October 09, 2003 3:54 PM To: zope(a)dylanreinhardt.com; Eric Merritt Cc: Zope Users Subject: Re: [Zope] RDBMS Applications and direct calling of script(python)andsql methods > On Thu, 2003-10-09 at 13:36, Eric Merritt wrote: > > Lets take simple example, assume that each user has > > an id that is keyed to his 'stuff'. The zsql method > > must be passed this id to access his stuff. This is > > all fine and good, A script(python) method could > > provide this to the zsql method behind the scenes > > without any great issue. The problem comes in when the > > user attempts to access this zsql method from via its > > url. Going this route he could pretty easily supply > > and arbitrary id and get access to information that he shouldn't > > have. > > Yes, that would be a problem... so don't do it that way. :-) > > Instead, have Zope provide you the name of the user from its > authentication machinery. That's *much* harder to spoof. > > To get this, cook up a Python script called get_user and use this for > the code: > > ---- > from AccessControl import getSecurityManager > return getSecurityManager().getUser().getUserName() > ---- > > Now include a call to get_user() when you need to pass in the username > as a parameter to your query. Any reason why you shouldn't just use <dtml-var AUTHENTICATED_USER> as a parameter to your SQL query? just curious... _______________________________________________ Zope maillist - Zope(a)zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )

2 1

can't use filter to check permission?
by Milos Prudek 09 Oct '03

09 Oct '03

The following Python script, when invoked in a folder, should list all ZPT methods that the current user can "View. from AccessControl import getSecurityManager checkPermission = getSecurityManager().checkPermission def okPermissionView(item): allowed= 0 try: allowed= checkPermission('View', item) except: pass return allowed objects = context.objectValues('Page Template') objects = filter(okPermissionView,objects) for item in objects: print item.getId() return printed It works for Managers (who can view anything), but it fails with Unauthorized at the "objects = filter(..." line. When I unfold the source so that filter is not used, it works without a hitch. See the "unfolded" source below: from AccessControl import getSecurityManager checkPermission = getSecurityManager().checkPermission objects = context.objectValues('Page Template') for item in objects: allowed= 0 try: allowed= checkPermission('View', item) except: pass if allowed: print item.getId() return printed Does anybody know what's going on here??? -- Milos Prudek _________________ Most websites are confused chintzy gaudy conflicting tacky unpleasant... unusable. Learn how usable YOUR website is! http://www.spoxdesign.com

2 1

Help: Suppress Virtual Host Monster...
by Tiller, Michael (M.M.) 09 Oct '03

09 Oct '03

I've had problems in the past with access rules and site roots and I know how to suppress those. But, I wasn't really able to find any information on how to disable a VHM. I cannot just change the host name because there is a "proxy" in the way that remaps the hostname. Is there a way that I can suppress VHM in the URL itself. I tried something like: http://my.testsite.com/_vh_manage thinking (from the VHM documentation) that this might somehow get me to the management screen at the root. Sadly, it didn't. Any suggestions?!? -- Mike

2 1

Lost connection to MySQL server during query
by Chris Muldrow 09 Oct '03

09 Oct '03

We're getting several ZMySQLDA exceptions in our logs right before one of our ZEO clients locks up. My reading of the errors below is some sort of network interruption, but I wanted to post and see if anyone else had any ideas about what might be happening. 2003-10-09T06:15:30 ERROR(200) ZMySQLDA exception during _begin Traceback (innermost last): File /var/www/zope/ZEOZOPE/lib/python/Products/ZMySQLDA/db.py, line 367, in _begin OperationalError: (2013, 'Lost connection to MySQL server during query') ------ 2003-10-09T06:15:37 INFO(0) ZServer Incoming connection from 12.47.113.36:59502 ------ 2003-10-09T06:15:38 INFO(0) ZServer Successful login. ------ 2003-10-09T06:15:53 ERROR(200) ZODB A storage error occured during transaction abort. This shouldn't happen. Traceback (innermost last): File /var/www/zope/zope262c1/lib/python/ZODB/Transaction.py, line 262, in commit File /var/www/zope/zope262c1/lib/python/ZODB/Transaction.py, line 393, in _commit_error AttributeError: Surrogate instance has no attribute '_p_oid' ------ 2003-10-09T06:15:53 INFO(0) ZODB conflict error at /VirtualHostBase/http/fredericksburg.com:80//VirtualHostRoot/gtl/churches/ (2 conflicts since startup at 2003-10-08T18:09:23) ------ 2003-10-09T06:16:00 ERROR(200) ZMySQLDA exception during _begin Traceback (innermost last): File /var/www/zope/ZEOZOPE/lib/python/Products/ZMySQLDA/db.py, line 367, in _begin OperationalError: (2013, 'Lost connection to MySQL server during query') ------ 2003-10-09T06:16:00 PANIC(300) ZODB A storage error occurred in the last phase of a two-phase commit. This shouldn't happen. Traceback (innermost last): : File /var/www/zope/zope262c1/lib/python/ZODB/Transaction.py, line 401, in _commit_error File /var/www/zope/zope262c1/lib/python/Shared/DC/ZRDB/TM.py, line 60, in abort File /var/www/zope/ZEOZOPE/lib/python/Products/ZMySQLDA/db.py, line 405, in _abort error: release unlocked lock

2 1

Re: Help: Suppress Virtual Host Monster...
by Josef Meile 09 Oct '03

09 Oct '03

--- In zope(a)yahoogroups.com, "Tiller, Michael (M.M.)" <mtiller@f...> wrote: > I've had problems in the past with access rules and site roots and I know how to suppress those. But, I wasn't really able to find any information on how to disable a VHM. > > I cannot just change the host name because there is a "proxy" in the way that remaps the hostname. > > Is there a way that I can suppress VHM in the URL itself. I tried something like: > > http://my.testsite.com/_vh_manage thinking (from the VHM documentation) that this might somehow get me to the management screen at the root. Sadly, it didn't. > What's about the ipaddress of your site? It's mentioned on the documentation of either site roots or access rules. I don't remmember where. Regards, Josef

1 0

press on checkbox execute python script
by Michael Bleijerveld 09 Oct '03

09 Oct '03

Hi, When the checkbox is selected I want to execute the Python script getSelection. The id of the file should then be added to myList for further processing. However when I look into myList nothing is changed. <form action="." method="post"> <dtml-in expr="getFiles()" > <input type="checkbox" name="getSelection(id)" value="id" > <a href=<dtml-var expr="getLink(id)"> /a><dtml-var id><BR> </dtml-in> </form> parameter= file session=context.REQUEST.SESSION l=session.get("myList", []) l.append(file) session["myList"]=l What is wrong ? Kind regards. Michael

2 1

The ballad of Zope and FreeBSD
by Ausum Studio 09 Oct '03

09 Oct '03

I tried all that was currently available. Installed latest ports, tried building Python from source with the mem stack size patch, and also reduced Zope's threads to two (as the previous step to make it single threaded). But Zope@FreeBSD continued to leak memory. Then I realized that it used to happen everytime I opened a management screen where a LocalFS object was going to be showed at the left frame, manage_menu, which is generated by dtml-tree. A glimpse to my windows mirror installation showed no problem at rendering that page (though at the price of twice the regular memory usage during the task), but FreeBSD seemed not to do the job at all. Now I expect fewer Zope&Python crashes, but as I'm not completely sure, I think I'm still in the struggle. Has anyone found a *final solution*? :) Ausum

2 1

Re: [Zope] Localizer and Python 2.2.2
by Dag Nygren 09 Oct '03

09 Oct '03

> Probably LocalFolder, whatever that is. > > Look at the complete traceback in the error message or error_log object. Well, after some hours of studying the messages on the Net I found and fixed the problem: *** LocalFolder.py.orig Thu Oct 9 18:21:42 2003 --- LocalFolder.py Wed Oct 8 11:13:23 2003 *************** *** 53,58 **** --- 53,59 ---- class LocalFolder(LanguageManager, LocalAttributes, Folder): + """_""" meta_type = 'LocalFolder' _properties = ({'id': 'title', 'type': 'string'},) Best Regards -- Dag Nygren email: dag(a)newtech.fi Oy Espoon NewTech Ab phone: +358 9 8024910 Träsktorpet 3 fax: +358 9 8024916 02360 ESBO Mobile: +358 400 426312 FINLAND

1 0

retry <> '' ??
by Florian Lindner 09 Oct '03

09 Oct '03

Hello, if I try to access a object without sufficient permissions cookie crumbler redirects me to my login page with these parameters: http://[...]/login.zpt?came_from=http%3A//[...]/secret.zpt&retry=&disable_cookie_login__=1 If I enter a wrong password retry is iterated: http://[...]/login.zpt?came_from=http%3A//[...]/secret.zpt&retry=1&disable_cookie_login__=1 http://[...]/login.zpt?came_from=http%3A//[...]/secret.zpt&retry=2&disable_cookie_login__=1 ... I want to render a HTML-Code only if retry has a value. Sounds easy, but somehow I didn't get. I tried: <p tal:condition="python: request.retry<>''"> <p tal:condition="exists: request/retry"> <p tal:condition="request.retry"> But none of these works as I want to. Thanks, Florian

2 1