September 2003 - Zope

Cookie Crumbler - read Password from login_form
by nicogrubert＠arcor.de 15 Sep '03

15 Sep '03

Hello, I am using Cookie Crumbler for Authentification in Zope. The standard login_form template provides an input text field for username and password whose fieldnames must correspond to the fieldnames set in the cookie crumbler object. these fieldnames (e.g. __ac_name, __ac_password) are not found in the REQUEST when submitting the form "login_form" since they are stored in a cookie called "__ac". my question is: how can I read the password the user entered in the login_form ? Assume, my login_form contains in <form action="myExternalMethod"> instead of "<form action="logged_in"> to call an external method that reads the password from login_form. How can I do that? I tried to decode the string stored in the cookie "__ac" using base64.decodestring(<string>) and got "<username>:x034x213324" where <username> is the username in cleartext the user typed in the __ac_name text field of login_form. How can I read the password in cleartext? background of this issue is that I need to pass the password in cleartext to another application. thank you in advance -nico

4 3

Better Date processing?
by Dustin Mitchell 15 Sep '03

15 Sep '03

I'm using Zope 2.6.1, and lots of the products I'm creating require that dates be entered in web forms and then stored as DateTime objects (since I need to compare them, etc.). However, using the <input .. name="foo:date"> results in user-unintelligible error messages when the format is not correct, and the formats accepted are not very flexible. Is there a better way? Is there a product that does a better job of handling date input/output? Dustin -- Dustin Mitchell dustin@ywlcs.org/djmitche@alumni.uchicago.edu http://people.cs.uchicago.edu/~dustin/ PGP Key: http://people.cs.uchicago.edu/~dustin/pubkey.txt

2 1

RE: [Zope] help with manage_renameObjects
by Passin, Tom 15 Sep '03

15 Sep '03

[grissom(a)qwickconnect.net] > Here is my method rename2: > <dtml-call "manage_renameObjects(ids=[oldlid], > new_ids=[newid])"> > <dtml-call "RESPONSE.redirect('deleteForm2')"> > > and here is the form that calls it deleteform2: > <form action="" method="POST" > enctype="multipart/form-data"> > <dtml-in "objectValues(['File'])"> > <input class="form-element" type="text" name="<dtml-var > id>" size="40" value=" <dtml-var id> "><br> > > </dtml-in> > <input type=hidden name="ids:tokens:default"> > <input class="form-element" type="submit" > name="rename2:method" value=" Save Changes "/> > </form> > > When I submit the form I get the following: > Error Type: NameError > Error Value: global name 'oldlid' is not defined You need to have a form variable named "oldid", and you can reference it as REQUEST.oldid. Similarly for newID. You can arrange that by calling each of the form elements by the same name, "oldid:list" (and similarly for newid, of course). You only need to add ":list" in case you might one time have only one, because it would be returned as a string instead of a list. Then in your method rename2, you would not use brackets to make oldid a list, because it already is one. BTW, you might as well get rid of the old syntax and write <form action="<dtml-var URL0>" It is odd to see the old !--# and the new dtml- mixed together. Cheers, Tom P

1 0

help with manage_renameObjects
by grissom＠qwickconnect.net 15 Sep '03

15 Sep '03

All, I have been trying to build a method around the manage_renameObjects so that I don't have to expose the users of my application to zmi. Here is my method rename2: <dtml-call "manage_renameObjects(ids=[oldlid], new_ids=[newid])"> <dtml-call "RESPONSE.redirect('deleteForm2')"> and here is the form that calls it deleteform2: <form action="" method="POST" enctype="multipart/form-data"> <dtml-in "objectValues(['File'])"> <input class="form-element" type="text" name="<dtml-var id>" size="40" value=" <dtml-var id> "><br> </dtml-in> <input type=hidden name="ids:tokens:default"> <input class="form-element" type="submit" name="rename2:method" value=" Save Changes "/> </form> When I submit the form I get the following: Error Type: NameError Error Value: global name 'oldlid' is not defined How do I define the global name oldid and newid? Am I dooing this right in the first place? Any pointers, examples or urls to docs are welcome. Thanks, Rob

1 0

Re: [Zope] Automatic Restarts?
by prosam＠comcast.net 15 Sep '03

15 Sep '03

Thanks Guys, I will forward this to our programmer since I know diddily squat about what you guys just said. :) Thanks a bunch, Sammy > > >>> prosam(a)comcast.net wrote > > Hi All, > > Zope keeps restarting on its own. Why is it doing this? We are running Zope > > 2.61. It is really becoming a headache since we are running and eCommerce > site. > > Everytime it restarts you get a Proxy error on the site until it is done. You > > can imagine how annoying this would be especially to our customers. > > What platform? Which version of Python? If it's Unix, try running strace or > truss to see why it's exiting. Also, as a stopgap, consider running ZEO, as > the client restarts are a lot faster than a full zope restart (or run > multiple ZEO clients behind pythondirector or pound or suchlike to give > you some failover). > > Zope _shouldn't_ be restarting like this... > > Consider also trying Zope 2.6.2 - there's a whole pile of bugfixes in > it, although nothing off the top of my head that is directly relevant, > unfortunately. :-/ > > > > -- > Anthony Baxter <anthony(a)interlink.com.au> > It's never too late to have a happy childhood. >

3 2

RE: [Zope] ZMySQLDA
by Passin, Tom 15 Sep '03

15 Sep '03

[Joseph F. Dries III] > > Then the mysqp-python binary is probably built for Python > 2.3 and would > > not likely work with Python 2.2. > > No, it is not. I have the mysql-python 0.9.2 binary for > Python 2.1, 2.2 > and 2.3. Too bad, that would have been an easy solution! I originally had the mysql-python binary installed for Python > 2.1, since that is the python that ships with 2.6.2 and Plone 1.0.5. > mysql-python and ZMySQLDA worked fine with the Plone 1.0.5 > and Zope 2.6.2 > installations. I removed both of those completely, installed > Zope 2.7.0 > b2, added the correct registry entries for Python 2.2.3 under > Zope 2.7.0 > b2 so the installer could find the paths, and installed > mysql-python 0.9.2 > for Python 2.2. > > > Which interpreter? Zope's Py2.2 or your Py2.3? > > Zope's Py2.2. I obviously wouldn't test my Py2.3 interpreter > for a working > mysql-python (it is installed, and is working there also)... Sorry, but quite a few people mix the two interpreters up when they test something from the command line. I would try connecting using odbc. You should be able to get an odbc connector for MySQL. I tried it with MySQL several years ago and it worked fine, as I recall. Once things are working, you can follow up trying to get the ZMySQLDA working as well, if you even feel that you need to at that point. Cheers, Tom P

1 0

ZMySQLDA
by Joseph F. Dries III 15 Sep '03

15 Sep '03

> [Joseph F. Dries III] > > I have recently installed Zope 2.7.0 b2, and installed the > > mysql-python 0.9.2 along with ZMySQLDA 2.09b2. I had to > > manually copy the registry entries for my Python.org > > Python 2.3 installation to the 2.2 Python that > > is part of the Zope 2.7.0 b2 binary install. > > Then the mysqp-python binary is probably built for Python 2.3 and would > not likely work with Python 2.2. No, it is not. I have the mysql-python 0.9.2 binary for Python 2.1, 2.2 and 2.3. I originally had the mysql-python binary installed for Python 2.1, since that is the python that ships with 2.6.2 and Plone 1.0.5. mysql-python and ZMySQLDA worked fine with the Plone 1.0.5 and Zope 2.6.2 installations. I removed both of those completely, installed Zope 2.7.0 b2, added the correct registry entries for Python 2.2.3 under Zope 2.7.0 b2 so the installer could find the paths, and installed mysql-python 0.9.2 for Python 2.2. The mysql-python 0.9.2 is also installed in my stand-alone Python 2.3. I have the mysql-python 0.9.3b1 source tarfile, but like I said I have no means to compile it on the Windows 2000 box. There is a line in the readme in 0.9.3b1 that states that it is the suggested version to use for python 2.2 and above. I obviously cannot be the only person running Zope 2.7.0 on Windows connecting to MySQL ... What are the others out there doing? If I need to, I suppose I can download the appropriate development tools to make Zope 2.7.0 and MySQL behave. But this certainly a high barrier to entry. Right now I need a quick solution so I can continue my site development and deployment. > > It looks like that lives in the _mysql.pyd file, which is installed > > correctly. I can fire up the python interpreter and do an > > "import _mysql" > > and it gives me no errors. I can do an "import MySQLdb", create a > > db.connect, and manually execute some SQL. > > Which interpreter? Zope's Py2.2 or your Py2.3? Zope's Py2.2. I obviously wouldn't test my Py2.3 interpreter for a working mysql-python (it is installed, and is working there also)... but the above test also works in Zope's Py2.2 installation. Which is why I'm confused. I saw a message posted on Yahoo's groups to find the self.db.server_capabilities line and remove that and replace it with 0, but I don't like working around something, I like getting it working. Especially when it deals with data integrity. > Cheers, > > Tom P Thanks for the quick response. -- Joseph F. Dries III

1 0

populate CMFCollector with a python script remotely
by anton 15 Sep '03

15 Sep '03

Hi, I have zope 1.6.1+plone 1.04+ CMFCollector running on a linux box. Now I would like to write have a python script on my other Win2K PC, which parses a issue database (could be csv,ascii excel..) and add automatically new items to the collector. The reason: I have an old excel file with bugs, and I would like to transfer them to the collector. Did somebody already a similar thing? .. otherwise any idea?? Thanks,

2 2

RE: [Zope] Re: Re: [Security] How to encrypt a Zope oid ?
by Passin, Tom 15 Sep '03

15 Sep '03

[Edward Muller] > > On Mon, 2003-09-15 at 11:48, Passin, Tom wrote: > [snip] > > > If you > > want the pages to appear only within their intended frame, > a user with > > the right browser can easily defeat that intention unless > you enforce it > > using javascript in the page. > > Which isn't secure at all, since someone who is really dedicated would > just fire up curl, wget, lynx, etc (insert tool of choice here) to > attempt to grab whatever they want anyway, bypassing any javascript on > the page. > Right, if we are going to consider people who can ignore or change the document contents (as opposed to people who just grab the GET parameters or use the browser's context menu). Which just goies to emphasize that the OP has not explained his problem adequately to get a sensible answer. Cheers, Tom P

1 0

RE: [Zope] Re: Re: [Security] How to encrypt a Zope oid ?
by Passin, Tom 15 Sep '03

15 Sep '03

[Sinclair] > Example : a document has url : > $ZOPE/.../document_manager/document_37. > > I wish the displayed url looks like : > $ZOPE/.../document_manager?document=k2316fge54dsgb51v3vsdv4 > > That is the document_manager who translates an unreadable parameter to > document real url. > > What I want to avoid is somebody trying to access manually to > document_38, > document_39, etc., just to add more security... > If I wanted to look at the document, I would just copy and paste that document number. Do you really mean that you do not want people to be able to __guess__ other neraby URLs? Why would you not want that? If you think that an unauthorized person should not be able to view a given page, you need to apply some authorization machinary. An obfuscated URL is not really enough. If that is not what you mean, then presumably you are willing to allow any user to access those pages. Why, then, would you want to make it harder for them to do so? If you want the pages to appear only within their intended frame, a user with the right browser can easily defeat that intention unless you enforce it using javascript in the page. Please explain further why you wish to restrict access to those pages, then maybe you will get more useful suggestions. Cheers, Tom P

3 2