- Zope - Zope lists

security setting question
by Webmaster Expert RH 20 Mar '03

20 Mar '03

Hello zopers, I have a situation like this : A repository filled with custom class instances ie: DATA folder( w/ Catalog) A script that catch and sort a Catalog Query (get-selection) A dtml-doc that show the results from the script <dtml-in get-selection()> What I want is user w/ a specific role ie : custom_user To be able to : - create new instances - view and edit only those instances THEY have created Please can you point me any path to reach this goal ? It must have to do with the skip-unauthorized and special setting of the security tab (but wich ? The repository ? The script ? The dtml ?....) Thanx in advance.

2 1

Multiple database updates
by garry saddington 20 Mar '03

20 Mar '03

I have a form which retrieves data from a database table and displays it for the user to amend. Many records are able to be changed and i would then like to be able to update all these records in the table. I can not find a way to do this as yet. Can anyone help? regards garry saddington

2 1

Unable to open manage page.
by Israel Carr 20 Mar '03

20 Mar '03

I'm running the following: Zope Version (Zope 2.5.1 (source release, python 2.1, linux2), python 2.1.3, linux2) Python Version 2.1.3 (#1, Sep 7 2002, 15:29:56) [GCC 2.95.4 20011002 (Debian prerelease)] When opening server the management page (10.1.1.1/manage), the screen shows some objects in the main pane, the left nav pane is blank and the page freezes. I am then unable to connect to the server at all, even non-management pages. I must then restart zope and then everything is fine until I try to open the root management page. I CAN go to (10.1.1.1/site/manage) and the mangement screen opens fine. I can click on the '/' link to up a level and the root management screen is displayed but of course the left nav pane doesn't change. Any ideas about this? Thanks, Israel

2 1

Re: [Zope] Catalog problem/only searchable when logged in
by Michael Havard 20 Mar '03

20 Mar '03

I've tried changing both metadata and the content with no success. The content is still only searchable when logged in. >From: Dieter Maurer <dieter(a)handshake.de> >To: "Michael Havard" <nhavar(a)hotmail.com> >CC: zope(a)zope.org >Subject: Re: [Zope] Catalog problem/only searchable when logged in >Date: Wed, 19 Mar 2003 21:31:41 +0100 > >Michael Havard wrote at 2003-3-18 17:41 +0000: > > I am running ZOPE with the CMF. On the CMF on DEV I have a document >that is > > searchable as anonymous. I synced the file to the QA box and I can see >it > > when anonymous but cannot search for it when anonymous. It will only >show in > > the search results when logged in. > > > > I've seen no differences in the security settings between the two >instances > > and no obvious differences in the document. What could be causing this > > problem. > > > > Has anyone seen similar issues? > >Looks like a workflow issue or a lost reindexation. > >When you copy an object, it may enter its initial workflow >state and then not be searchable. > >When you copy an object, it should index itself. >Maybe, that failed. >Try to force indexing by modifying the object. > > >Dieter _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

ExternalFile and ZEO
by Thierry FLORAC 20 Mar '03

20 Mar '03

Hi, I currently use ExternalFiles to store files of my Zope site. My question is : what is the best way to use ExternalFiles in a ZEO environment ??? Should I share the directory containing the files throught NFS, or sync the master server with ZEO clients throught rsync or anything else ??? Thanks for any help, Thierry -- Linux every day, keeps Dr Watson away... http://gpc.sourceforge.net -- http://www.ulthar.net

4 6

Reversible encryption on passwords?
by Terry Hancock 20 Mar '03

20 Mar '03

Hi all, I've been thinking about the pros and cons of using encrypted passwords, and I've realized that there are actually some additional choices. Normally "encrypted password" means you run a secure hash (non-reversible) on a password and then you actually compare the hashes. But there are drawbacks: 1) You can't remind the user of their password, because you don't have it. 2) Certain password-checking schemes (design for plain-text may not be easily implemented this way. But then I started thinking about *actual* encryption and things like GnuPG encryption and signing. Suppose I use a private key to encrypt/decrypt the password data for storage in the database. The key might be stored on the server's filesystem or be retrieved from a more secure computer, but it would be used to encrypt the data for storage and then to decrypt it for authentication. You could do this with public-key cryptography, too, but it's not clear to me that there is an advantage to that. Anyway, in the authentication process, the password would posted in "plain text" -- but if the connection is via SSL (HTTPS), then it is actually encrypted on the way to the server. So, in this scenario, my database contains password fields which can only be read with the right key, but can be decrypted, and the connection to the user is protected by SSL's public-key cryptography. (The idea being that should the database be compromised, the passwords would not be exposed -- at least not in plain text, you'd need to get both the database and the key(s)). It seems to me that this offers most of the security of normal encrypted passwords, but with fewer drawbacks. It does mean that the site owner can read the passwords, but that's supposed to be the advantage. Presumeably I'm not the first person to think of this -- is it used by some sites or not? If not, why not? I'm wondering what the faults are and whether it'd be a good strategy for us. Thanks for any comments, Terry -- Terry Hancock ( hancock at anansispaceworks.com ) Anansi Spaceworks http://www.anansispaceworks.com

3 2

Re: [Zope] Catalog problem/only searchable when logged in
by Michael Havard 20 Mar '03

20 Mar '03

I'm finding nothing on the CMFStaging product. Only three limited references to it on the ZOPE.org site and nothing in the products directory. Can you point me to a site or directory to look in. I know that Zsyncer was not designed for CMF but to date it's worked fine for all of our synchronization on the CMF. The only exception is when searching the catalog in anonymous mode. It seems to me that there should be a way to reindex the content so that all items appear as normal. At first I thought it a permissions problem since the items were in the catalog for logged in users but not anonymous. I'm still not quite convinced that it's not a permissions bug. Anyway... thanks for the help and if you can give any further pointer to the CMFStaging I would appreciate it. >From: Chris Withers <chrisw(a)nipltd.com> >To: Michael Havard <nhavar(a)hotmail.com> >CC: zope(a)zope.org >Subject: Re: [Zope] Catalog problem/only searchable when logged in >Date: Thu, 20 Mar 2003 09:51:20 +0000 > >Michael Havard wrote: >>ZSyncer product > >I thought so given your mispelling of synch ;-) > >Now, ZSyncher isn't designed for CMF and synching content with it will not >work, as you've found out. > >Look at the CMFStaging product instead... > >cheers, > >Chris > _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

1 0

[OT] Example of Forcing Type coercion on a DCOracle2 column?
by John Ziniti 20 Mar '03

20 Mar '03

Hello -- The DCOracle2 Documentation states that it is possible to force type coercion on a result column to particular type, but does not give an example of how to do this. Does anyone have any suggestions? I am trying to force an XMLTYPE column into a CLOB. TIA, John Ziniti

2 5

Find a user's UserFolder?
by Paul Winkler 20 Mar '03

20 Mar '03

Does anybody know a recipe to find out, given a user object and a context object, the acl_users folder in which that user lives? i think i could cook something up with aq_inner and aq_parent but i'd first like to know if there's a canonical way to do this. -- Paul Winkler http://www.slinkp.com Look! Up in the sky! It's LETHAL CARPENTER MANAGER! (random hero from isometric.spaceninja.com)

2 1

Localizer and tinytable...
by Meehan, Francois 20 Mar '03

20 Mar '03

Hi all, I am seting up a squishdot site, and would like to have translation in french using Localizer. I have a problem with Tinytables, what is the best approach to use them with localizer??? Francois

2 1