November 2005 - Zope

Render a string as tal
by Mark Gibson 21 Nov '05

21 Nov '05

I would like to be able to render an arbitrary string as tal, having the tal statements evaluated correctly. How would I go about doing this? -- Mark Gibson <mark(a)dimensional.com>

5 10

Re: ZopeTestCase.Functional and sessions?
by Stefan H. Holek 21 Nov '05

21 Nov '05

Well, yes. As you have already discovered, publish() creates it's own REQUEST (also see ZPublisher.Test). All you have after a call to publish() is the response object. Note that you *can* check ZODB- based variables after publish(). However the REQUEST is not stored in the ZODB... Which begs the question why you need publish() in the first place. It is only useful if you want to test the Publisher, i.e. the status code, or some returned headers and cookies. Everything else can be tested directly. How to put a session object into self.app.REQUEST is demonstrated in the testShoppingCart.py example test. Stefan On 21. Nov 2005, at 03:46, Paul Winkler wrote: > Yes, everything is fine unless you attempt to access the session > from the test code. So I can't see any way to e.g. assert that after > publishing a page, a certain variable is set in the session. > For example, I wish I could rewrite your test like so: > > def testUseSessions(self): > response = self.publish(self.folder_path+'/use_session') > self.assertEqual(response.getStatus(), 200) > self.assertEqual(self.app.REQUEST.SESSION.get('foo', 'xxx'), > 'bar') > -- Anything that happens, happens. --Douglas Adams

1 0

minimizing conflict errors
by Dennis Allison 20 Nov '05

20 Nov '05

I have a DTML method which provides the primary navigation control in a portion of our system and so is very heavily used. It is a primary source of conflict errors and so is being rethought. Zope 2.8.4, ZEO 3.4.2, ZODB 3.4.2, Python 2.4.2 or 2.3.5 MySQL 4.0.20, MySQL-Python 1.2.0, MYSQLDA 2.0.9 ZODB 3.4.2 does not raise a conflict error on a read-read conflict, one of the reasons fr moving to Zope 2.8.4. The structure of the naviagation method is simple enough. Everything is wrapped in a <dtml-let> which sets a number of parameters mostly by reading them from the SESSION (with an interface function) or plucking them from the relational database with a query. In the scope of the let is dtml code which, when rendered, provides the various navigation links. In various sections there are additional <dtml-let> blocks and additional queries to the relational database and several <dtml-in> loops. Looking at the code, I don't understand why I am seeing conflicts. As I understand things, neither variables in the <dtml-let> space nor the REQUEST/RESPONSE space are stored in the ZODB so modifications to them don't look like writes to the conflict mechanism. Am I incorrect in my understanding?

3 2

session variables in the presence of conflicts
by Dennis Allison 20 Nov '05

20 Nov '05

Zope 2.8.4 ZEO 3.4.2 ZODB 3.4.2 Python 2.4.2 or 2.3.5 MySQL 4.0.20 MySQL-Python 1.2.0 MYSQLDA 2.0.9 We have just moved from Zope 2.7.6 to Zope 2.8.4 motivated, in part, but the ability to avoid read conflicts under ZODB 3.4.2. We have been having a lot of problems: more conflict errors, release of unreleased locks in MySQL transactions, loss of session variables, and others. We use session variables and MySQL very heavily. Our MySQL tables are MyISAM and are not transactional. ZODB3 3.4.1 introduce some changes to the conflict resolution which appears to be a logical improvement but also appears to have acerbated our problems. In the ZODB# 3.4.2 system, if a commit fails, an exception is raised and the transaction is aborted. Zope then attempts to reschedule the transaction. The abort needs to roll back MySQL transactions that are part of the conflicting ZODB and the Session Variable Store so the restart is clean. In our case, we have been using MyISAM tables, which are not transactional. The rollbacks fail and the locking in the database adapter gets confused. Changing the table type from MyISAM to Innodb, which is transactional, should resolve the MySQL problems, although it has yet to be tested. Conflict errors also arise through the session variables. Since we have a multi-Zope system configuration sharing a single ZEO, the session variables are stored in a Temporary Storage object on the ZEO host. When a conflict occurs, a number of things, none good, apparently can happen. Session variable transactions cannot be rolled back (as the temporary storage mechanism is not transactional). And, at a different level, session variable persistence requires that transactions require a copy-out/copy-in mechanism to identify those changes which have been changed and need to persisted; an aborted transaction may not be marked as persistent and so will disappear at some apparently random time in the future when the temporary store is packed and cruft removed. Some refactoring of the programming can help minimize the potential for session variable conflicts, but they cannot be eliminated. If systems stability in the face of session variable conflicts is important, 1. Does the store for session variable need to be transactional and support rollbacks? and 2. What Temporary Storage object provides the right mechanism to manage session variables with rollback efficiently?

5 10

MD5 Python Zope Plone
by D Washburn 20 Nov '05

20 Nov '05

I have a need to encrypt a parameter passed on a URL to another website using Python and MD5 encryption. I tried to set up a test python script: I am running ZOPE and Plone. I have made other Python scripts that work. ******************* import md5 print "This is the", script.meta_type, '"%s"' % script.getId(), if script.title: print "(%s)" % html_quote(script.title), print "in", container.absolute_url() hash1 = md5.new("Hello world").digest() print "hash=",hash1 return printed ************** When I do this and I attempt to test it - my ZOPE/Plone instance pops up the login screen (even though I am logged in already). I tried logging in but it just kept asking for my username/password. Suggestions? Anyone got a simple example of a Python script that can be passed a piece of text and return an encrypted string? Thanks, David

4 3

CMF 1.5.5 released
by Jens Vagelpohl 20 Nov '05

20 Nov '05

The CMF developer community and Zope Corporation are pleased to announce the release of version 1.5.5 of the Zope Content Management Framework (CMF). This release marks the latest stable release in the CMF 1.5 series and should be suitable for production use. What is the CMF? The Zope Content Management Framework provides a set of services and content objects useful for building highly dynamic, content-oriented portal sites. As packaged, the CMF generates a site much like the Zope.org site. The CMF is intended to be easily customizable, in terms of both the types of content used and the policies and services it provides. Where do I get it? Download it from http://zope.org/Products/CMF/CMF-1.5.5 Points of interest include: - "Windows ZIP file", http://zope.org/Products/CMF/CMF-1.5.5/CMF-1.5.5.zip - "Unix tar/gzip archive", http://zope.org/Products/CMF/CMF-1.5.5/CMF-1.5.5.tar.gz - "Release notes", http://zope.org/Products/CMF/CMF-1.5.5/README.txt - "Change history", http://zope.org/Products/CMF/CMF-1.5.5/CHANGES.txt - "Installation instructions", http://zope.org/Products/CMF/CMF-1.5.5/INSTALL.txt Where do I go to learn more? The "CMF mailing list":mailto:zope-cmf@zope.org has many participants who are active in supporting the CMF. ...to report bugs? The "CMF Collector":http://zope.org/Collectors/CMF is ths place to report bugs (please search for existing reports of your issue first!) --------- Jens Vagelpohl jens(a)dataflake.org

1 0

Problem with multiple Browser Id Managers
by Pablo Ziliani 19 Nov '05

19 Nov '05

Hello all, I have a situation here; as I has previously posted, I need to set the domain/host for of the cookie that stores the session id so it is shared among multiple subdomains. As Dieter has pointed to me, I should change the 'domain' property for the Browser Id Manager (from now on BMI) that controls the session. Unfortunately, my Zope instance holds multiples virtual sites, so I can't simply change the root BMI that comes with Zope's installation; instead I need to create inner BMI instances. So I did, giving the new instance a different Browser Id Name than the root's _ZopeId both to differentiate them and to be more site-specific. Then I restarted Zope (don't know if this really matters) and re-entered the site to see what happened: I was still given the same cookie, _ZopeId. Reading the documentation I found this quote (browser-add.stx): """ Instantiating Multiple Browser Id Managers (Optional) (...) In its default configuration, Zope will not allow you to create a browser id manager if one is installed in the root or in a place where the new browser id manager can acquire the original browser id manager via its containment path (for programmers: the session id manager's class' Zope __replaceable__ property is set to UNIQUE). This means, practically, that if you wish to have multiple browser id managers, you need to carefully delete the root browser id manager, then you need to place additional browser id managers in the most deeply-nested containers first, working your way out towards the root, finally replacing the root browser id manager if desired. """ ...which is either false or (more likely), outdated, since first (as I said) I had no trouble in adding another deeper BMI; and second, because any attempt to delete root's BMI ends in a "/browser_id_manager/ cannot be deleted." page error message. Any hint? Thanks all in advance, Pablo Ziliani

3 5

Reprise -- Manager Proxy Role ineffective for deleting/moving objects
by George Lee 19 Nov '05

19 Nov '05

I forget if I submitted a collector issue about this before, but I didn't see it. I just posted one at <http://www.zope.org/Collectors/CMF/396>: Title: PortalFolder.py _verifyObjectPaste ignores executable security Version info: CMF 1.5.4 but also in trunk _verifyObjectPaste calls "sm.checkPermission(permission_name,self)" rather than "_checkPermission(permission_name,self)" This makes it ignore executable security. So, if _verifyObjectPaste is in an external method or in a script with sufficient proxy roles, it raises an Unauthorized error for users when the external method / proxy role security should suffice. On 9/9/05, Dieter Maurer <dieter(a)handshake.de> wrote: > George Lee wrote at 2005-9-8 23:57 -0400: > > ... > >Is it okay to just replace sm.checkPermission with _checkPermission > >from CMFCore.utils or is that not okay? > > Yes. But, please file a bug report as well. > > >Also Dieter I noticed that Alan Runyan and you briefly discussed this > >issue back in 2002: > >http://mail.zope.org/pipermail/zope-cmf/2002-September/015350.html > > Any internal use should always take executable security (i.e. > executable ownership and proxy roles) into account. > Not doing so is a but, as things expected to be possible are not > and (maybe even worse) things expected to be impossible may > be possible. > > There may be a need for application code to check the permissions > of the user with proxy roles not taken into account. > > E.g. a script that must use a "Manager" roles to do one > thing but does not want to do another unless the current > user has specific permissions. > > For this case, there also should be a method checking > permissions with proxy roles not taken into account. > > -- > Dieter >

1 0

FYI: Zope 3 Book on Safari
by Jonathan Cyr 18 Nov '05

18 Nov '05

FYI, I noticed that O'Reilly just added Steven Richter's Zope 3 book to their Safari service. I now read all my Safari-based manuals on a Tablet PC, rather than stocking my bookshelves with the appropriate resources at $30-50 bucks a pop. Even though I'd already bought the Zope 3 book, I think it's great that I don't need to have it with me now. I'll probably donate it to the local library as I did with the rest of my bookshelf resources. O'Reilly, for some reason, doesn't seem to be the biggest fan of Zope or Python, so it's nice to see this addition to the service. http://safari.ora.com -Jon Cyr -- Jonathan Cyr http://www.cyr.info http://www.weddingweblog.com cyrj(a)cyr.info

1 0

conflicts, sessions, and programming best practices guidelines
by Dennis Allison 18 Nov '05

18 Nov '05

Has anyone prepared a set of best practice guidelines on the techniques to use to minimize conflicts? It is becoming clear that we need to do to refactor some of our code to get us out of our current conflict pickle. A quick google produced lots of commentary but nothing I could hand to our programmers as guidelines.

6 12