September 2003 - Zope

Re: [Zope] prevent quoting in tal:attributes
by Milos Prudek 13 Sep '03

13 Sep '03

> Yes, that displays the __source__, not the parsed result. When the > browser parses the source, it replaces the entity with its replacement > text. The javascript engine gets the value after that. Tom, You were right, and I was wrong. It turned out that the problem was JavaScript. I included it from another document via <script ... tal:content="here/myscript">, and I should have used <script ... tal:content="structure here/myscript">. Not using "structure" meant that many characters such as "<" and ">" were escaped, and browsers cannot deal with that. To sum it up, HTML entities are allowed and work in HTML attributes, but they are NOT allowed in JavaScript source. Still, the automatic escaping in tal:attributes obfuscates the HTML, and I hate that, but at least it works. Thank you very much, Tom! -- Milos Prudek _________________ Most websites are confused chintzy gaudy conflicting tacky unpleasant... unusable. Learn how usable YOUR website is! http://www.spoxdesign.com

1 0

.doc in zopedb /isa/mitchy
by Isa150183＠aol.com 13 Sep '03

13 Sep '03

If you want to force all browsers to download the document (instead of viewing it) you will need to set some HTTP headers in a script, and have the script pass through the document - instead of linking to the document, you will need to link to that script. how to do this ? thanks a lot mitchy !

3 2

Updating a form's variables through a Python script
by Don Mullins 13 Sep '03

13 Sep '03

Hi, I have a form: <dtml-var standard_html_header> <H1 align="center"> <img src="/images/blockbuster.gif" width=200 height=124> <br>New Customer Add</H1> <a href="/BBI/New Customer Add"><font size="1">Reset</font></a> <HR width="75%"> <P> <form action="." method="POST"> <table align="center" width="100%"> <tr><td>Customer ID:</td><td><input type="text" name="acct" size=20 maxlength=20 value="">&nbsp&nbsp<input type=submit name="Findem:method" value="Find"></td></tr> <tr><td>Home Phone:</td><td><input type="text" name="phone" size="12" maxlength="10" value="">&nbsp&nbsp<input type=submit name="getaddress:method" value="Get Address"></td></tr> <tr><td>Customer Name:</td><td><input type="text" name="name" size="50" maxlength="50" value=""></td></tr> <tr><td>Bill-To Name:</td><td><input type="text" name="bname" size="50" maxlength="50" value=""></td></tr> <tr><td>Address 1:</td><td><input type="text" name="addr1" size="50" maxlength="50" value=""></td></tr> <tr><td>Address 2:</td><td><input type="text" name="addr2" size="50" maxlength="50" value=""></td></tr> <tr><td>City/St/Zip:</td><td><input type="text" name="city" size="50" maxlength="50" value=""></td></tr> <tr><td>Work Phone:</td><td><input type="text" name="wphone" size="12" maxlength="10" value=""></td></tr> <tr><td>Driver's License:</td><td><input type="text" name="dl" size="10" maxlength="10" value=""></td></tr> <tr><td>e-mail address:</td><td><input type="text" name="email" size="40" maxlength="40" value=""></td></tr> <tr><td>Notes:</td><td><textarea rows="3" cols="60" name="notes"></textarea></td></tr> </table> </form> <dtml-var standard_html_footer> And a python script that gets called when a submit button is pushed: from Products.PythonScripts.standard import html_quote request = container.REQUEST RESPONSE = request.RESPONSE session = request.SESSION acct = request.get('acct', '') phone = request.get('phone', '') name = request.get('name', '') bname = request.get('bname', '') addr1 = request.get('addr1', '') addr2 = request.get('addr2', '') city = request.get('city', '') wphone = request.get('wphone', '') dl = request.get('dl', '') email = request.get('email', '') notes = request.get('notes', '') s = container.getaddr(acct, phone, name, bname, addr1, addr2, city, wphone, dl, email, notes) session.set('acct', s[0]) session.set('phone', s[1]) session.set('name', s[2]) session.set('bname', s[3]) session.set('addr1', s[4]) session.set('addr2', s[5]) session.set('city', s[6]) session.set('back_url',request.HTTP_REFERER) if session.has_key('back_url'): back_url = session.get('back_url') #container.New_Customer_Add #return s[4] #return back_url #return request #return RESPONSE.redirect(session.back_url) #return context.New_Customer_Add() #return RESPONSE.redirect('New_Customer_Add?name='+s[2]) return context.New_Customer_Add(context, context.REQUEST, phone=s[4]) #return context.REQUEST.RESPONSE.redirect(context.absolute_url()) Everything works great until I want to send the data back to the form. As you can see I have tried all kinds of possibilites with no success. Any help on how to get the form variables returned would be greatly appreciated. Thanks. Don Mullins ***************************************NOTE******************************************* The information contained in this email message is intended only for use of the individual or entity named above, and may be legally privileged. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender, and delete and destroy the original message. Although this email and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by the sender for any loss or damage arising in any way from its use.

2 1

ZODB conflict error AFTER adding an 'Access Rules'
by Jean Baltus 13 Sep '03

13 Sep '03

Hi all, I've added an 'access rule' to my zope/CMF/plone site. Since then, I'm getting several errors in the console output like this: 2003-09-10T12:28:00 INFO(0) ZODB conflict error at /myroot/museum/share/js /share.js (6 conflicts since startup at 2003-09-10T12:16:58) ------ 2003-09-10T12:28:01 PROBLEM(100) Localizer The thread number 1656 don't has a re quest object associated. My access rule sets an attribute into the session object and changes skin (CMF 1.4 feature) . Any idea? If I remove the access rule, the errors disappear. Regards, -- Jean

3 5

Custom Method to edit PythonScript
by Christoph Landwehr 13 Sep '03

13 Sep '03

Hi, I would like create a custom DTML-Method to edit a python-script within Zope. The reason for this is that I would like to be able to control in certain ways so I don't want to use "ZPythonScriptHTML_editForm". The user must not be able to change the whole script but only parts I let him see. Something like the 'manage_edit' object of DTML-Methods is (more or less) what I need. The result would be a web-form that lets the user edit some parts of the script body, the parameter and some aditional python code is added by a script/method. (I hope this makes sense ...) I am trying understand how the "PythonScript.py" does things but do to my limited knowledge (Zope-Newbie) I get stuck. My idea was to use the read() function to read the body into my custom form an write it back with the write() function. But doing this I don't use the nifty code-checking feature which I would like to use. Could someone please give me a hint if I am totally off-track? Regards Christoph

2 1

PropertySheets in python products
by Richard Jennings 13 Sep '03

13 Sep '03

I am trying to create a product which supports multiple propertysheets and is accessible using the standard ZMI. Following the mxm Easy product (thanks to mxm!) and advice received on this site, I have arrived at the code listed below. This installs a product in its containing folder and when I view the item, I get the page rendered from OFS/dtml/propertysheets.dtml. Spartan, to say the least! I get a reference to webdav (to be expected) and an Add button. Clicking the button returns the error: Error Type: AttributeError Error Value: manage_addPropertySheetForm which is the name of the input control. There is no such method in propertysheets.py. My questions: 1. When I look at the dtml for OFS/dtml/propertysheets.dtml, I have the feeling I'm looking at unfinished business - am I? 2. I expect to see a form listing existing property sheets with controls for adding new ones - does this already exist, if so where? 3. I am I going about this in the right way or have I misunderstood completely? When I have finished, I intend to contibute component 'rpjCompoundItem' as a complement to mxm's mxmSimpleItem - it might help newbies like myself. TIA Richard Jennings --------------------------------------------- from OFS import SimpleItem from OFS.PropertySheets import PropertySheets from Products.ZCatalog.CatalogPathAwareness import CatalogAware from Globals import DTMLFile from DateTime import DateTime class ssCompoundItem(CatalogAware, PropertySheets, SimpleItem.SimpleItem): """A base class for creating compound components""" meta_type = 'ssCompoundItem' manage_options = ( {'label':'propertysheets', 'action': 'manage'}, )+ SimpleItem.SimpleItem.manage_options __ac_permissions__= SimpleItem.SimpleItem.__ac_permissions__ + \ ( ('Manage properties', ('manage_addPropertySheet', 'addPropertySheet', 'delPropertySheet' )), ('Access contents information', ('items', 'values', 'get', ''), ('Anonymous', 'Manager'), ), ('View management screens', ('manage',)), ) def __init__(self, id): "Inits the product with default values" self.id = id manage_addForm = DTMLFile('dtml/manage_addForm', globals()) # # constructor methods for adding component to folder. # def manage_addAction(self, id=None, REQUEST=None): "Add ssCompoundItem to ObjectManager" return addClass(self, id, ssCompoundItem, REQUEST) def addClass(self, id=None, theClass=None, REQUEST=None): "Add an arbitrary class to a folder to a folder." # if no id passed, generate one from the datetime if id == None: id = DateTime().strftime('%Y%m%d_%H%M%S') self._setObject(id, theClass(id)) if REQUEST is not None: getattr(self, id).manage_changeProperties(REQUEST) return self.manage_main(self, REQUEST) constructors = (manage_addForm, manage_addAction)

2 1

VisualCMS - error in adding site
by Jaroslav Lukesh 13 Sep '03

13 Sep '03

Hi all, does somebody try VisualCMS? With recomended dependant products and Zope 2.5.1/Win32 I cannot add site. Thanks, JL. Zope has encountered an error while publishing this resource. Error Type: TALESError Error Value: exceptions.NameError on global name 'HUSER' is not defined in "", at line 2, column 1 Traceback (innermost last): File C:\Program Files\zope-web\lukesh251\lib\python\ZPublisher\Publish.py, line 150, in publish_module File C:\Program Files\zope-web\lukesh251\lib\python\ZPublisher\Publish.py, line 114, in publish File C:\Program Files\zope-web\lukesh251\lib\python\Zope\__init__.py, line 159, in zpublisher_exception_hook File C:\Program Files\zope-web\lukesh251\lib\python\ZPublisher\Publish.py, line 98, in publish File C:\Program Files\zope-web\lukesh251\lib\python\ZPublisher\mapply.py, line 88, in mapply (Object: manage_addSite) File C:\Program Files\zope-web\lukesh251\lib\python\ZPublisher\Publish.py, line 39, in call_object (Object: manage_addSite) File C:\Program Files\zope-web\lukesh251\lib\python\Products\AtlantisBlueCMS\Portal.py, line 70, in manage_addSite File C:\Program Files\zope-web\lukesh251\lib\python\Products\AtlantisBlueCMS\CMSPage.py, line 284, in cmsadmin (Object: atgggg) File C:\Program Files\zope-web\lukesh251\lib\python\Shared\DC\Scripts\Bindings.py, line 252, in __call__ (Object: cms_page_edit) File C:\Program Files\zope-web\lukesh251\lib\python\Shared\DC\Scripts\Bindings.py, line 283, in _bindAndExec (Object: cms_page_edit) File C:\Program Files\zope-web\lukesh251\lib\python\Products\PageTemplates\PageTemplateFile. py, line 95, in _exec (Object: cms_page_edit) File C:\Program Files\zope-web\lukesh251\lib\python\Products\PageTemplates\PageTemplate.py, line 86, in pt_render (Object: cms_page_edit) File C:\Program Files\zope-web\lukesh251\lib\python\TAL\TALInterpreter.py, line 158, in __call__ File C:\Program Files\zope-web\lukesh251\lib\python\TAL\TALInterpreter.py, line 191, in interpret File C:\Program Files\zope-web\lukesh251\lib\python\TAL\TALInterpreter.py, line 523, in do_useMacro File C:\Program Files\zope-web\lukesh251\lib\python\TAL\TALInterpreter.py, line 191, in interpret File C:\Program Files\zope-web\lukesh251\lib\python\TAL\TALInterpreter.py, line 406, in do_setGlobal_tal File C:\Program Files\zope-web\lukesh251\lib\python\Products\PageTemplates\TALES.py, line 247, in evaluate File C:\Program Files\zope-web\lukesh251\lib\python\Products\PageTemplates\ZRPythonExpr.py, line 49, in __call__ (Info: vhroot.browserType(request['HTTP_USER_AGENT'])) File Python expression "vhroot.browserType(request['HTTP_USER_AGENT'])", line 2, in f File C:\Program Files\zope-web\lukesh251\lib\python\Products\AtlantisBlueCMS\CMSPage.py, line 338, in browserType (Object: atgggg) TALESError: (see above)

2 1

Zope Logout Problem
by Praveen Kumar 13 Sep '03

13 Sep '03

Dear All, I have been facing problem with Logout. When I click Logout it is not actually logging out. I'm calling the following code in the Login Script: *********LOGIN SCRIPT*************************** <dtml-call "RESPONSE.setCookie('Login_Name', _.SecurityGetUser().getUserName(), expires='0')"> <dtml-comment> <dtml-call "RESPONSE.setCookie('user_name', _.SecurityGetUser().getUserName(), expires='')"> </dtml-comment> <dtml-if "REQUEST.has_key('Login_Name')"> <dtml-in DateLookup> <dtml-if Reminder_Lookup_By_Login> <form><input style="font-size:15;font-weight:bold" type="button" value="Check Reminders" onClick="JavaScript:PopWindow738401()"></form> </dtml-if> </dtml-in> </dtml-if> In the Logout Page: ********************LOGOUT SCRIPT********************************* <dtml-var la_header>  <p>REQUEST:<br> <dtml-var REQUEST> <br> <p>RESPONSE:<br> <dtml-var RESPONSE> <br>  <dtml-call "RESPONSE.expireCookie('__ac')"> <dtml-call "RESPONSE.expireCookie('session')"> <dtml-call "RESPONSE.expireCookie('*')"> <dtml-call "RESPONSE.expireCookie('Login_Name')"> <dtml-call "RESPONSE.expireCookie('user_name')">   <p>REQUEST:<br> <dtml-var REQUEST> <br> <p>RESPONSE:<br> <dtml-var RESPONSE> <br>  </body> </html> Please suggest me how to solve this problem. -- Regards Praveen Kumar, SoftPro Systems Ltd, Ph: 91-40-23111806

5 9

RE: [Zope] Securing Zope and Special URLs
by Roy Rapoport 13 Sep '03

13 Sep '03

Jamie Heilman wrote: [Zope Security is an oxymoron] > 3) Never use DTML. Why? Also, one other thing -- we're doing the standard thing with database connections -- having zsql methods call zodbc connectors; aforementioned connectors are defined with the username/password needed to connect to the DB. Is it possible to either have the password dealt with dynamically (supplied by whatever it is that's calling the zsql method) and/or obscured somehow? -roy Content-Type: text/plain; charset="iso-8859-1" ------------------------------------------------- PLEASE READ THIS WARNING: All e-mail sent to or from this address will be received or otherwise recorded by the Fisher Investments corporate e-mail system and is subject to archival, monitoring or review by, and/or disclosure to, someone other than the recipient.

4 3

Securing Zope and Special URLs
by Roy Rapoport 13 Sep '03

13 Sep '03

Greetings everyone, As part of a re-engineering of our Zope infrastructure, I'm tasked with finding any documentation out there on how to secure Zope sites in a best-practices sort of way. Anyone got any pointers? Also, we're fronting Zope with Apache using mod_proxy to relay requests through. We'd like to block Zope management-type URLs from coming through the Apache server and hitting the Zope server (we'll do our management directly to the Zope instance). For this, I need to figure out what special patterns signify a Zope management URL. Some patterns I know about already include: /.*/[^/]*manage[^/]*$ (Any URL whose last component (excluding args) includes 'manage') /acl_users/ ^/Control_Panel.* ^manage_addProduct/ ^manage/ Any others? -roy Content-Type: text/plain; charset="iso-8859-1" ------------------------------------------------- PLEASE READ THIS WARNING: All e-mail sent to or from this address will be received or otherwise recorded by the Fisher Investments corporate e-mail system and is subject to archival, monitoring or review by, and/or disclosure to, someone other than the recipient.

3 2