September 2004 - Zope

webdav / IE
by John Hunter 28 Sep '04

28 Sep '04

I have a problem that I have struggled with off and on for weeks without success. Goal: Serve files (mainly msword and excel) with authentication, to Microsoft/IE users supporting the ability to logout, without forcing the user to reauthenticate multiple times. Approach: To support the ability to log out, most reading I've found pointed me to CookieCrumbler, which I'm using. Problem: IE on windows appears to want to use WebDAV, which doesn't understand cookies AFAIK and thus tries to reauthenticate using basic http authentication Proposed Solution: Use the webdav source port, eg 1980. Gripe: I have no trouble with any tested browser / OS combination other than Microsoft Windows with IE. 99% of my users will be on this combination, however. Before I launch into a bunch of techo mumbo jumbo below, I am open to alternative solutions. If there is a better way to do this let me know. It seems to me that it shouldn't be impossible to gracefully serve protected files to Microsoft users while supporting logouts, but maybe it is. In particular, I have no interest in supporting webdav, but as far as I understand, I cannot disable this on server side (if I can, please tell me!!). So a lot of stuff below is targeted at getting webdav to work with cookie crumbler. If I can't figure this out, I'll have to jettison cookie crumbler and logouts. I have created a sandbox at http://crcdocs.bsd.uchicago.edu/test. This area has default permissions, except for the following, which require authenticated|manager|owner privs View Access Contents information Manage WebDAV locks WebDAV Lock items WebDAV Unlock items WebDAV access There are two acl_users 'test' and 'testman'. Both have password '123'. The latter has manager permissions. The 'test' directory has a single msword file 'facepage.doc', and an index_html method that serves this file either over 80 or 1980. I am using a default instantiation of CookieCrumbler 1.2 in that dir. I have the following in my zope.conf to enable webdav <webdav-source-server> # valid keys are "address" and "force-connection-close" address 1980 force-connection-close off </webdav-source-server> When the user clicks on either the port 80 link or the port 1980 link in index_html, even though they've already cookie authenticated when initially loading index_html, they get a basic http authentication dialog. Is there some special trick to serve files over the webdav source port? Perhaps I'm naive in thinking all I need to do is add the above lines to zope.conf, restart zope, and then serve the file over 1980. I installed VerboseSecurity-0.6. When the user clicks on the 1980 link, they are presented with the authentication challenge box 2 times and then can read the file. Subsequent attempts to access the file are successful without additional authentication challenges. 4 error log entries are created during the initial attempt to access the document, summarized in order here. 1st error Time 2004/09/25 12:21:51.553 GMT-5 User Name (User Id) Anonymous User (None) Request URL http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/manage_DAVget Exception Type Unauthorized Exception Value You are not authorized to access this resource. No Authorization header found. 2nd error Time 2004/09/25 12:21:55.570 GMT-5 User Name (User Id) Anonymous User (None) Request URL http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/LOCK Exception Type Unauthorized Exception Value You are not authorized to access this resource. No Authorization header found. 3rd error Time 2004/09/25 12:21:57.156 GMT-5 User Name (User Id) Anonymous User (None) Request URL http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/LOCK Exception Type Unauthorized Exception Value You are not authorized to access this resource. No Authorization header found. 4th error Time 2004/09/25 12:21:57.177 GMT-5 User Name (User Id) test (test) Request URL http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/LOCK Exception Type RuntimeError Exception Value Syntax error at line 9: illegal character in content Included below is the full traceback and REQUEST header from the first error. Please feel free to log to http://crcdocs.bsd.uchicago.edu/test as user 'test' or 'testman' if you are kind enough to help me solve this vexing problem. JDH - Zope 2.7 Exception traceback Time 2004/09/25 12:21:51.553 GMT-5 User Name (User Id) Anonymous User (None) Request URL http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/manage_DAVget Exception Type Unauthorized Exception Value You are not authorized to access this resource. No Authorization header found. Traceback (innermost last): * Module ZPublisher.Publish, line 92, in publish * Module ZPublisher.BaseRequest, line 439, in traverse * Module ZPublisher.HTTPResponse, line 671, in unauthorized Unauthorized: You are not authorized to access this resource. No Authorization header found. Display traceback as text REQUEST form cookies SITESERVER 'ID=38c1d83c249f02a07f0d04cbbf5f1ee5' __ac 'dGVzdDoxMjM%3D' __ac_name 'test' lazy items SESSION <bound method SessionDataManager.getSessionData of <SessionDataManager instance at 2a9bd27350>> other TraversalRequestNameStack [] URL 'http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/manage_DAVget' SERVER_URL 'http://crcdocs.bsd.uchicago.edu:1980' PUBLISHED <bound method File.manage_DAVget of <File instance at 2a9bd7ecb0>> URL0 http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/manage_DAVget URL1 http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc URL2 http://crcdocs.bsd.uchicago.edu:1980/test URL3 http://crcdocs.bsd.uchicago.edu:1980 BASE0 http://crcdocs.bsd.uchicago.edu:1980 BASE1 http://crcdocs.bsd.uchicago.edu:1980 BASE2 http://crcdocs.bsd.uchicago.edu:1980/test BASE3 http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc BASE4 http://crcdocs.bsd.uchicago.edu:1980/test/facepage.doc/manage_DAVget environ HTTP_ACCEPT 'application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*' CONNECTION_TYPE 'Keep-Alive' HTTP_USER_AGENT 'Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)' HTTP_REFERER 'http://crcdocs.bsd.uchicago.edu/test/index_html' SERVER_NAME 'localhost.localdomain' GATEWAY_INTERFACE 'CGI/1.1' SERVER_SOFTWARE 'Zope/(unreleased version, python 2.3.4, linux2) ZServer/1.1' REMOTE_ADDR '24.14.147.78' HTTP_ACCEPT_LANGUAGE 'en-us' SCRIPT_NAME '' REQUEST_METHOD 'GET'

4 12

Using IPython for debugging Zope
by Jean Jordaan 28 Sep '04

28 Sep '04

Hi all I just figured this out a couple of days ago. It is VERY cool. """ $ ./bin/zopectl debug Starting debugger (the name "app" is bound to the top-level Zope object) [...] >>> >>> import IPython >>> IPython.Shell.IPShell().mainloop(sys_exit=1) Python 2.3.3 (#1, Mar 17 2004, 01:31:20) Type "copyright", "credits" or "license" for more information. IPython 0.6.3 -- An enhanced Interactive Python. ? -> Introduction to IPython's features. @magic -> Information about IPython's 'magic' @ functions. help -> Python's own help system. object? -> Details about 'object'. ?object also works, ?? prints more. In [3]: @autocall Automatic calling is: OFF In [4]: app = __IP.internal_ns['app'] In [5]: app Out[5]: <Application instance at 411d1470> In [14]: app.plone.object # Tab-completion ... rooooocks! app.plone.objectIds app.plone.objectMap app.plone.objectIds__roles__ app.plone.objectMap_d app.plone.objectIds_d app.plone.objectValues app.plone.objectItems app.plone.objectValues__roles__ app.plone.objectItems__roles__ app.plone.objectValues_d app.plone.objectItems_d In [14]: app.plone.object In [15]: app.plone.objectIds?? Type: Python Method Base Class: <type 'function'> String Form: <bound method PloneSite.objectIds of <PloneSite instance at 411bdd70>> Namespace: Interactive File: /home/jean/Zope-2.7.1-0/lib/python/OFS/ObjectManager.py Definition: app.plone.objectIds(self, spec=None) Source: def objectIds(self, spec=None): # Returns a list of subobject ids of the current object. # If 'spec' is specified, returns objects whose meta_type # matches 'spec'. if spec is not None: if type(spec)==type('s'): spec=[spec] set=[] for ob in self._objects: if ob['meta_type'] in spec: set.append(ob['id']) return set return [ o['id'] for o in self._objects ] """ Is anyone else using this? -- Jean Jordaan http://www.upfrontsystems.co.za

2 1

A thing about roles I don't get...
by massimo 28 Sep '04

28 Sep '04

...perhaps not the only thing I don't get but.. Hi to all, I have a folder that should be 'operated' only by a certain group of users so I created a local role and then activated the 'Access contents information' permission only for this role (and for manager, just in case). Now I would like to test with a python script if the folder is accessible to the current user, to build dynamically a menu so I tried this script based on the one in the chapter 'Users and Security' of the Zope Book: ################################################################# ## Script (Python) "check" ##bind container=container ##bind context=context ##bind namespace= ##bind script=script ##bind subpath=traverse_subpath ##parameters= ##title= ## # Import a standard function, and get the HTML request and response objects. from Products.PythonScripts.standard import html_quote request = container.REQUEST RESPONSE = request.RESPONSE from AccessControl import getSecurityManager sec_mgr = getSecurityManager() return sec_mgr.checkPermission('Access contents information', context.restrictedTraverse('/path/to/folder')) ################################################################## It doesn't work the way I hope, It ask me to authenticate claiming that I'm not allowed to access the object. I suppose this is the correct behavior, probably I miss something that is in front of my eyes, but a this point I really need a little help... please thanks massimo p.s. yes, I'm a zope beginner

2 2

useing the REQUEST variable in python scripts
by Tim Zegir 28 Sep '04

28 Sep '04

Hi All, I'm trying to get some form variables in a python script. The form variables are dynamic (grabbed from a database). I want to use a variable in the script (something like REQUEST[myvar]) to get the input values. But when I use that code I get a key error. Does anyone know how to get a variable from a form with code like that? Thanks Tim Zegir

2 2

default date unknown
by John Hunter 27 Sep '04

27 Sep '04

I have a date property and need to support an unknown date type. If I leave the field blank, I get a syntax error when I try and save the properties (no more info on error yet, see previous post on error_tb in manager interface). Error Type: AttributeError Error Value: SyntaxError instance has no attribute 'replace' I would be happy to use '' or None. I found this post http://mail.zope.org/pipermail/zope-dev/2001-October/013476.html to handle None. Is this the preferred approach? What is the best/easiest way to support a default unknown date? I can also use 0001-01-01 but this is a bit hackish. Zope 2.7 JDH

1 1

calling python scripts, zsql method from onclick
by Laura McCord 27 Sep '04

27 Sep '04

I need three things to occur on an onclick. Is this possible and if so, what would the syntax be. This is what I have so far: tal:attributes="onclick string:showObject(event, '${box}');" I need to also include a call to an external method python:here.macAddress() and call to a zsql method here/deleteMAC Thanks, Laura

2 1

Leaking ZClasses.Method.MWp
by ezCompany Internet Technology 27 Sep '04

27 Sep '04

Hi All, It looks like my Zope instance (2.7.2, patched cAccescontrol) is leaking ZClasses.Method.MWp classes Acquisition.ImplicitAcquirerWrapper 2047 100751 +98704 ZClasses.Method.MWp 8544 34185 +25641 I can't figure out where this class is used in my application. I even can't find where this class is located in the zope sourcecode. Greetings Ralph

2 1

RE: [Zope] Re: Disgraceful
by Tiller, Michael (M.M.) 27 Sep '04

27 Sep '04

> From: zope-bounces(a)zope.org [mailto:zope-bounces@zope.org] On Behalf Of > Subject: [Zope] Re: Disgraceful > > The Zope Book chapter on sessions is currently the sixth result here: > http://www.google.com/search?q=zope+sessions Really? For me, this is the sixth result: http://vsbabu.org/mt/archives/2003/05/16/resetting_zopes_session_timeout .html I'm assuming that is not what you meant. Interestingly, I couldn't find the Zope book in the first six *PAGES* of results. Perhaps Google gives you a different result than me for some reason, but I entered it just like you typed it. The point is to say where to find the information is "obvious" is clearly subjective. > I think you need to read 'How to ask questions the smart way': > http://www.catb.org/~esr/faqs/smart-questions.html I'm curious, what part specifically did Asad not follow? By the way, did you happen to see the part about how to answer them? There is a lot of good stuff there like: Be gentle. Problem-related stress can make people seem rude or stupid even when they're not. Reply to a first offender off-line. There is no need of public humiliation for someone who may have made an honest mistake. A real newbie may not know how to search archives or where the FAQ is stored or posted. If you can't help, don't hinder. Ask probing questions to elicit more details. While just muttering RTFM is sometimes justified when replying to someone who is just a lazy slob, a pointer to documentation (even if it's just a suggestion to Google for a key phrase) is better. > - Michael Bernstein -- Mike

9 9

formatting the results of Zsql methods
by garry saddington 27 Sep '04

27 Sep '04

I can iterate over the result set from a Zsql method and have each result display across the page and wrap at the page border or I can have them display down the page. I can't work out how to have say five across the page and then have multiple rows each with five results. Could anyone point me in the right direction? regards garry

3 5

Extract Website for Off-line viewing.
by Jason Leach 27 Sep '04

27 Sep '04

hi, We need to extract a Zope site for off-line viewing. So people at a trade show can view it with no Internet access. Any ideas on a good easy way to do this w/o setting up Zope on a Windows laptop? j.

3 2