- Zope - Zope lists

Multi-User File/Document Sharing
by Chris Cochella 06 May '03

06 May '03

Dear Zope Community, I am evaluating Zope for a particular purpose: Secure document sharing. Scenario: Lawyer wants to share documents (Word, Excel) with multiple clients. Thus, the lawyer (admin) needs the ability to upload/download files for multiple client "accounts". The client only needs to download/upload files associated with their account. In addition, we would need a "stamp" of the filename, show uploaded (downloaded) it, file size, file type, description, etc. The files are not Website "content" per se, so I am not sure if this fits into the scope of what Zope is capable of "out of the box". Any suggestions or comments are greatly appreciated. Best regards, Chris

2 1

RE: [Zope] Multi-User File/Document Sharing
by Meilicke, Scott 06 May '03

06 May '03

It sounds like the CMF (cmf.zope.org) or Plone (www.plone.org) would fit this role. The CMF rides on top of zope, and plone rides on top of the CMF. The CMF and Plone give you content types that can be binary (word, excel, etc), and you can code the templates to show various properties. -Scott -----Original Message----- From: Chris Cochella [mailto:chris@streamcapture.com] Sent: Tuesday, May 06, 2003 11:13 AM To: zope(a)zope.org Cc: Chris Cochella Subject: [Zope] Multi-User File/Document Sharing Dear Zope Community, I am evaluating Zope for a particular purpose: Secure document sharing. Scenario: Lawyer wants to share documents (Word, Excel) with multiple clients. Thus, the lawyer (admin) needs the ability to upload/download files for multiple client "accounts". The client only needs to download/upload files associated with their account. In addition, we would need a "stamp" of the filename, show uploaded (downloaded) it, file size, file type, description, etc. The files are not Website "content" per se, so I am not sure if this fits into the scope of what Zope is capable of "out of the box". Any suggestions or comments are greatly appreciated. Best regards, Chris _______________________________________________ Zope maillist - Zope(a)zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev ) The information contained in this email message may be privileged and is confidential information intended only for the use of the recipient or any employee or agent responsible for delivering it to the intended recipient. Any unauthorized use, distribution or copying of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify the sender immediately and destroy the original message and all attachments from your electronic files.

1 0

restrictedTraverse() security problem
by Terry Hancock 06 May '03

06 May '03

Hi All, I have a call like this in restricted code: Home.restrictedTraverse(username).profile() which should call a method "profile" on a "UserPB" object (this method is public information, and should be visible to anyone). The catch is that UserPB is a wrapper on a database record, which I'm adding by using a __bobo_traverse__ method: class Home(Folder): meta_type = 'Narya-Home' __implements__ = HomeAPI security = ClassSecurityInfo() security.setDefaultAccess("allow") # ... def __bobo_traverse__(self, REQUEST=None, name=None): """Get a UserFolder if it exists, or a UserPB.""" try: return getattr(self, name) except: return self.getUser(name) def getUser(self, username): """Retrieve UserPB object from username.""" return UserPB(self.DB._getUser(username=username)[0]).__of__(self) class UserPB(Acquisition.Explicit, Item): """Basic wrapper for user data from database.""" __implements__ = UserPBI # ... def __init__(self, sqlres): """ Create a UserPB object by wrapping the SQL search result. """ for k in sqlres.__record_schema__.keys(): setattr(self, k, getattr(sqlres, k)) Accessing this causes an error """ Error Type: Unauthorized Error Value: You are not allowed to access foo in this context """ (where "foo" is the actual username). There is such a user, and the wrapper works perfectly when called from unrestricted code, so the problem is definitely the security. Here's the tail end of the traceback: """ File /usr/local/narya/z2.5.1/lib/python/DocumentTemplate/DT_Util.py, line 159, in eval (Object: Home.restrictedTraverse(username).post_score(nposts, nrecent, nmarkup, ndoc, nfaq, nlink, ngallery, nproj)) (Info: username) File <string>, line 0, in ? File /usr/local/narya/z2.5.1/lib/python/OFS/Traversable.py, line 163, in restrictedTraverse (Object: Home) File /usr/local/narya/z2.5.1/lib/python/OFS/Traversable.py, line 130, in unrestrictedTraverse (Object: Home) Unauthorized: (see above) """ Which indeed is the security check: [OFS/Traversable.py]: """ if (not securityManager.validate(object, container, name, o)): raise Unauthorized, name """ So it seems I need to do something to "call off the dogs" here. I've already set my default policy in "Home" to "allow" -- what's missing? Do I have to explicitly call a security method to do that, or is there an attribute or something needed? Also, is it really the Home or the UserPB object whose security is not right? I have not yet been able to figure out where "validate()" is actually defined -- it seems the securityManager object expects to inherit or acquire it from somewhere. I realize there's probably another way to do the large task here, but there are a number of reasons why it's more convenient to do this mimicry trick to make a database record look like a simple child object of Home -- not least of which is that I want to handle them in parallel with persistent Zope objects ("UserFolder") which implement an identical "UserPBI" interface. Any suggestions or ideas would be very much appreciated! Thanks, Terry -- Terry Hancock ( hancock at anansispaceworks.com ) Anansi Spaceworks http://www.anansispaceworks.com

1 0

using RevisionManager
by Fred Yankowski 06 May '03

06 May '03

I'm experimenting with RevisionManager 1.0.1 to see if it could help manage changes in a Plone-based portal project. So far it's not going well. I created a RevisionManager object at the top of a Plone site, and in the import tree selected the entire site (the top folder in the tree). That fails with an exception: Module ZPublisher.Publish, line 98, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 39, in call_object Module Products.RevisionManager.RevisionManager, line 1126, in rm_import Module Products.RevisionManager.RevisionManager, line 592, in importModule Module Products.RevisionManager.RevisionManager, line 964, in writeToFS Module Products.RevisionManager.RevisionManager, line 244, in _get_source Module ZPublisher.mapply, line 89, in mapply Module Products.CMFCore.FSPythonScript, line 152, in document_src AttributeError: _source It looks like RevisionManager is confused by FSPythonScript objects, which seem to have a document_src attribute but no _source attribute. OK, fine, trying to slurp in the entire plone site was reckless. So then I deleted that RevisionManager object and created a new one, this time taking the other extreme and selecting for import only a single File object at the top of plone portal tree. That went OK: the RevisionManager object lists that imported object as being under CVS control, in the context of the portal folder. The corresponding CVS folders and files exist under $INSTANCE_HOME/var/RevisionManager/ and in the cvs repository. But now it seems to be impossible to add any more objects to be controlled by that RevisionManager. Its 'Add objects' tab lists no objects and reports "All objects that can be managed with RevisionManager are already being managed". Similarly, the 'Map files to objects' tab lists nothing. So, how _do_ I put more objects under CVS control? -- Fred Yankowski fred(a)ontosys.com tel: +1.630.879.1312 OntoSys, Inc PGP keyID: 7B449345 fax: +1.630.879.1370 www.ontosys.com 38W242 Deerpath Rd, Batavia, IL 60510-9461, USA

1 0

Session expiration and concurrent same user access control.
by Felipe Barousse Boue 06 May '03

06 May '03

Hello: We are currently using CookieCrumbler as the authentication method for an application. It all works fine so far. Nevertheless, we are interested in implementing session expirations, we'd like to set a property somewhere in the application tree with the number of inactivity minutes when the "session" would expire after the user has not done anything within that period. The question is: what is the best approach to perform this "session expiration" feature ? As far as I am aware, CookieCrumbler does not natively supports this, except of course, coding a bit more to programatically expire CookieCrumbler's session cookies, but this could potentially create other issues.... The second question is: there is also the need to control that users do not access the system with one account more than once at a time. (i.e. that an account is not used by more than one user at a time). Again, what would be the advise in this subject ? Both requirements (expirations and "only one login at a time") are for the same application that currently uses CookieCrumbler. I have seen many different UserFolders and Session products for Zope, some have a rather old release dates and before embarking into an adventure with some of this products, I'd like to get some feedback from the Zope community. Your advise is well appreciated, thanks in advance. ! Felipe

1 0

monkey patch html_quote (was: RE: [Zope] html_quote, quoting acce nts)
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 06 May '03

06 May '03

Ah, I was almost there, I traced it to DocumentTemplate, but didn't notice the seperate html_quote.py file ... OK, now that all this makes sense ... I'm trying to overload/monkey patch the html_quote with some of my own code that quotes ALL html entities, not just the cgi.escape() ones (& < >) ... BUT, it's not working. I noticed the the way DT_Var implements this in ways I'm not too sure I understand (coding beyond my current level of knowledge). Something to do with modifiers, lambda, and mappings. I'm guessing that the monkey patching isn't working because it's "too late" in the process, and the function has been "copied" or something like that? Anyways, could anyone point me in the right direction on how to do this? I've monkey patched other things before successfully, but this one isn't cooperating :( Any help would be greatly appreciated! P.S. : Code is below, not optimized, just for testing. Thanks, J.F. The code in my product's __init__.py # Monkey patch that makes the html_quote actually quote ALL entities, not just "&" "<" and ">", but NOT the octal coded ones, which would allready be encoded. def my_html_quote(string, name='(Unknown name)', md={}): string = ustr(string) myentities = {} for (key, value) in entitydefs.items(): if ( len(value) == 1 ): myentities[value] = key del myentities['&'] # First do the ampersands if ( find(string,'&') > 0 ): string = replace(string,'&','&') # Then everything else for char in myentities.keys(): if ( char in string ): string = replace(string,char,'&'+myentities[char]+';') return string html_quote.html_quote = my_html_quote -----Original Message----- From: Troy Farrell [mailto:troy@entheossoft.com] Sent: Monday, May 05, 2003 12:09 PM To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca; zope Subject: Re: [Zope] html_quote, quoting accents Ok. We're going to trace this to the root. The html_quote you are using is in Products.PythonScripts.standard.html_quote() or so, which points to DocumentTemplate.DT_Var.html_quote() which points to DocumentTemplate.html_quote.html_quote() which points to cgi.escape(). The cgi.escape() docs say this: escape(s[, quote]) Convert the characters "&", "<" and ">" in string s to HTML-safe sequences. Use this if you need to display text that might contain such characters in HTML. If the optional flag quote is true, the double-quote character (""") is also translated; this helps for inclusion in an HTML attribute value, as in <A HREF="...">. If the value to be quoted might include single- or double-quote characters, or both, consider using the quoteattr() function in the xml.sax.saxutils module instead. http://www.python.org/doc/current/lib/node300.html All that being said, html_quote will not solve your problem. One thing you might try is messing with the character coding used on your html pages. The only other option I can see is writing your own convertor. Troy Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote: > Troy, > > OK, well for the purpose of this example, and where I'm starting, is with > CMF Metadata, such as the title. > > A user enters the metadata using their regular keyboards and so on, which > means the accented characters are typed in in ISO-8859-1, and stored as such > I guess? (since technically this value isn't HTML, it should be stored in > it's native character set) > > Now when I output the Title, it comes out in ISO-8859-1 properly, but I'd > like to force it encoded as an HTML entity, so when a user enters the word > "région" in the Title, it'll be entered/saved that way, and by default be > output that way, but ... > > My understanding was that uting html_quote would transform that into > "région" ... But it's not doing anything different for me. Same with > entity notation, &dtml-Title; doesn't do the html_quoting either. > > This is using the default metadata templates, or close enough that changes I > have made shouldn't matter (I've extended the metadata, but not modified the > existing DC setup). > > Am I misunderstanding the purpose of this command? Or is there something > else I'm not getting? > > Thanks, > J.F. > > > -----Original Message----- > From: Troy Farrell [mailto:troy@entheossoft.com] > Sent: Friday, May 02, 2003 5:15 PM > To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca > Subject: Re: [Zope] html_quote, quoting accents > > > Bonjour Jean-François. > > We need more information before we can help you. Where is your user > typing these characters? In what forms? In what type of objects are > you storing this information? We'll try to help you, but we need more > information first. > > Troy > > Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote: > >>Hello, >> >>I have french content on my site, which means accents and other high-bit >>type characters. >> >>For the first time a user actually ran into the problem of the characters >>coming out wrong on his screen, so now I have to fix it :P >> >>I tried using html_quote without success, and also using the &dtml-Title; >>type syntax (Which apparently is auto-quoted) but in both cases my accents >>are still coming out in raw latin-1 instead of something like é ... >> >>Of course in the case of the metadata, I don't want to html encode the >>characters since technically it's not HTML just yet :) >> >>Help ? >> >>Thanks, >> >>Jean-François Doyon >>Internet Service Development and Systems Support / Soutien de systèmes et >>developement de services Internet >>GeoAccess Division / Division GéoAccès >>Canada Center for Remote Sensing / Centre canadien de télédétection >>Natural Resources Canada / Ressources naturelles Canada >>Phone / Téléphone: (613) 992-4902 >>Fax / Télécopieur: (613) 947-2410 >>http://atlas.gc.ca >> >> >>_______________________________________________ >>Zope maillist - Zope(a)zope.org >>http://mail.zope.org/mailman/listinfo/zope >>** No cross posts or HTML encoding! ** >>(Related lists - >> http://mail.zope.org/mailman/listinfo/zope-announce >> http://mail.zope.org/mailman/listinfo/zope-dev ) > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope-dev )

1 0

Re: [Zope] create Login/Logout functionality
by Andreas Pakulat 06 May '03

06 May '03

On 03.Mai 2003 - 17:38:10, Troy Farrell wrote: > Look in the source for 'manage_zmi_logout' in > zopedir/lib/python/App/Management.py That doesn't help me much, I see that I can call manage_zmi_logout to logout the user, but how do I get him to log in? I don't think that I can do it with such a message box, as far as I can see, this can only be done, by setting the permissions on the file. But this doesn't work for me, as anybody should be able to view a certain page, but only logged in users should see a link that points to an edit-form So the question is, which method to call if I have a username and a password, I didn't find anything in the UserFolder API. I will try to look further on the source of the API, but maybe someone can directly point me to the right spot. Andreas > Troy > > Andreas Pakulat wrote: > >Hi, > > > >I would like to have a login Link on the top of my page, but I don't > >know how I can login a user. I have searched through the help, but > >didn't find a method that causes the MessageBox, that appears if I go to > >a /manage Url, to appear. > > > >And I also want the users to get logged of again. > > > >I know that I can write a dtml/zpt page and call a script with values > >from a form, and then in the script set the Authenticated User if he > >exists in the User Folder, but I don't see how to verify the password. > >Also I really would like to have it with the messagebox and not a > >separate form to fill in. > > > >Andreas > > > -- Letzte Worte eines Flugkapitäns: "Wir landen in wenigen Minuten planmäßig"

4 8

How to install Zope server in RedHat Linux 6.1
by sukhee ochirbat 06 May '03

06 May '03

I want to install Zope server in Red Hat Linux 6.1. I have downloaded Zope-2.6.1-linux2-x86.tgz and I have intalled it. According to installation guide, Zope installation was okey. But After ./start command, I encouraged following error. . . . z2 Startup exception Trackback (unnermost last): File /usr/local/zweb/Zope-2.6.1.-linux2-x86/z2.py,line 840 in? SystemExit: A user was not specified to setuid to; fix this to start as root (see doc/SETUID>txt) I read setUID.txt file but python z2.py -u root python zpasswd.py inituser ... has an error. How can I install Zope server in Red hat Linux 6.1. Thank you ===== __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

2 1

NuxUserGroups question
by Zanotti Michele 06 May '03

06 May '03

Hi all, How can I obtain the list of local roles associated to a group? Thanks. Michele

2 1

Create top-level folder
by Matt Ficken 06 May '03

06 May '03

Part of my product's job is to create a top-level folder. I can have it do that only when, from the management interface's "add function", I add it to the root directory. I would like it to always be able to go to the root directory, regardless of where its added. In order to do this, I need to access the root directory object, but I don't know how. What function can I call to return the root directory object? Would 'getPhysicalRoot' do what I want? if yes, what do I call it on? -- __________________________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup

2 1