- Zope - Zope lists

Re: Z2.log and authenticated users
by Josef Meile 16 Feb '03

16 Feb '03

> I had a similar problem solved by Paul Tiemann, > pault@c... on Fri Sep 20 10:25:16 2002. Our > exchange is below: Thanks a lot. The patch works as I want. Regards, Josef

1 0

locale: unknown locale: de_DE@euro
by Florian Konnertz 16 Feb '03

16 Feb '03

Hello, I encountered a locale issue while installing ZWiki-0.15 on my box here in germany (Zope-2.6.1, Python-2.1.3) 2003-02-14T10:57:43 ERROR(200) Zope Could not import Products.ZWiki Traceback (innermost last): File /usr/local/Zope-2.6.1-src/lib/python/OFS/Application.py, line 541, in import_product File /usr/local/zope/lib/python/Products/ZWiki/__init__.py, line 12, in ? File /usr/local/zope/lib/python/Products/ZWiki/ZWikiPage.py, line 45, in ? File /usr/local/zope/lib/python/Products/ZWiki/Regexps.py, line 68, in ? File /usr/local/lib/python2.1/locale.py, line 339, in getdefaultlocale File /usr/local/lib/python2.1/locale.py, line 272, in _parse_localename ValueError: unknown locale: de_DE@euro This is the opportunity for me to learn the localization stuff... :-) /usr/lib/locale/de_DE@euro/ exists, but of course has to be accessed with de_DE\@euro in the bash (i guess this is not the problem, because many of the files have an @ in their name.) I tried the following: >>> import locale >>> locale._print_locale() Locale defaults as determined by getdefaultlocale(): ------------------------------------------------------------------------ Traceback (most recent call last): File "<stdin>", line 1, in ? File "/usr/local/lib/python2.1/locale.py", line 678, in _print_locale lang, enc = getdefaultlocale() File "/usr/local/lib/python2.1/locale.py", line 339, in getdefaultlocale return _parse_localename(localename) File "/usr/local/lib/python2.1/locale.py", line 272, in _parse_localename raise ValueError, 'unknown locale: %s' % localename ValueError: unknown locale: de_DE@euro >>> locale._parse_localename('de_DE@euro') Traceback (most recent call last): File "<stdin>", line 1, in ? File "/usr/local/lib/python2.1/locale.py", line 272, in _parse_localename raise ValueError, 'unknown locale: %s' % localename ValueError: unknown locale: de_DE@euro Further investigation drove me nuts ( _parse_localename, normalize etc.) so please give me advice what to do. And a link to a localization intro is appreciated too. Regards, Florian -- Florian Konnertz --- http://www.florian-konnertz.de http://openspirit.homelinux.net/noowiki/FrontPage Improved ZWiki about all topics, especially consciousness research and wisdom traditions

1 1

users and passwords
by G. Clifford Williams 16 Feb '03

16 Feb '03

I'm thinking about using zope to manage a portal that I want to setup. The problem is that certain parts of the site will call for "non-zope" applications; possibilities include squirlmail and phpbb. What I'd like to know is whether it's possible to 'synchronize' or 'share' the authentication of logins and passwords between, say, zope and phpbb. Thank you inadvance -- G. Clifford Williams gcw-python(a)rezidew.net

2 1

Re: [Zope] Accessing a user's password
by Terry Hancock 15 Feb '03

15 Feb '03

On Saturday 15 February 2003 09:00 am, zope-request(a)zope.org wrote: > Asad Habib wrote: > > Is there any way to access a user's password given the > > name of the user? > > Why would you want to do that? It's a bit of a security issue... It actually depends on how the authentication data is actually stored. In my case, I'm using MySQL to do that, so as long as I have the right privileges to do the search, it's simply a matter of running an SQL query. For other user folders, you'll need to do an unrestricted python call (from within a product or an external method). Obviously this is good, since it isn't possible for a restricted pythons script to steal passwords! > > Also, once you access the password, > > how would you decrypt it > You can't, that's the point ;-) So true. You can of course, *crack* passwords -- but it's an unreliable and difficult process. It's precisely what a good secure hash is trying to avoid! (It's not like the reversible private or public key encryption which can be reversed if you have the key -- I was a little unclear on this distinction myself just last year when I was changing my authentication system). This is a good reason to use plain-text storage of passwords if you think you're going to need this capability. I was originally going to use encrypted passwords on my project, but SimpleUserFolder made this difficult because it didn't give me a way to compare hashes instead of the original passwords (This may not be true anymore, I haven't checked, BTW). But the point is, I realized I wanted to be able to send out reminders (and the data is not so secure that it is really necessary to have high security -- it's more of a privacy password at this point). So the technical difficulty was actually a bit of a blessing in disguise, because it made me stop and think about this issue. I also realized that unless you're using SSL/HTTPS you aren't really that secure anyway -- although you may be storing a secure hash, the password is going plain text through the internet on each login (Someone please correct me if I'm wrong on this point). If so, then what's the point? All you're doing is giving yourself a false sense of security at the cost of considerable inconvenience -- any competent cracker can set up to sniff your passwords anyway. > > (I would like to email the > > password to a user who has forgotten his)? > > You should change their password and email them that new one. Although I agree that this is the only way to deal with encrypted passwords, it can be very annoying for the user. I decided plain text served my present needs better, partly for this reason. Of course, if you are handling extremely sensitive information (financial data or keys, classified information, extremely personal data like medical records) or other stuff with severe consequences if it's leaked, then you're better off with encrypted and the hassles that come with it. But if it's just a privacy password to keep people from pretending to be other people in forums or something, or from messing up each other's profiles or something, then I don't think it's worth it. And if you *are* going to use encrypted passwords, then you need to set up your site for SSL/HTTPS! Actually, you have to think about what kind of threat is probable -- how can the passwords be stolen? If your database is accessible by other means, or could be compromised, then encrypting the data there really makes sense. But it seems to me that a remote attack, such as sniffing packets is much more likely. Therefore, you'd actually be more secure to use plain text passwords with an SSL/ HTTPS site than to encrypt passwords on a plain HTTP site. Cheers, Terry -- Terry Hancock ( hancock at anansispaceworks.com ) Anansi Spaceworks http://www.anansispaceworks.com "Some things are too important to be taken seriously"

1 0

RE: [Zope] Love Zope but want to avoid Python
by sean.upton＠uniontrib.com 15 Feb '03

15 Feb '03

Really, Python is Zope's Secret Weapon. Ignoring that is to your disadvantage. You can use Java in Zope, but only via Python. Look at JPE, which is a bridge between CPython and Java. This would allow you to leverage existing Java code and familiarity in Zope/Python. I think I've heard of someone using this technique to write a custom catalog index using a Java-based indesing framework. Frankly, though, all the advantages of Zope won't make sense if you try to use it in this way. To take advantage of Zope's object persistence, you really need to be coding in Python; I don't think JPE will give you enough power to . It is an awkward mix, except in certain circumstances. Most Java programmers have no problem with Python, since concepts are similar in many ways. If you are really into (finger) typing more than you need to, I suppose you can stick with Java. Its funny, but I would think Java is a crutch... (a) Static typing introduces more potential for errors in casts than the potential for errors (not caught by a compiler) in a dynamically typed language with test-first design. Unit-tests and code-readability make Python a hands-down winner. (b) Working in both worlds isn't that bad. Many folks handle both Java and Python skills just fine. (c) Java is a poor language for code-reviews, experimentation and such, becuase there is more code to read, intent is not clear across team-members, and you can't try out a snippet of code in interactive mode. It only doubles in complexity if you start to realize that (ouch!) you have to write your unit tests in this same cumbersome language. This means that Python is orders of magnitude faster for team projects and developing using component-oriented methodologies that have any hope of scaling past 1 programmer. (d) Read http://www.infoworld.com/article/03/02/06/06stratdev_1.html (e) Read Bill Venners' 5 part interview with Guido http://www.artima.com/intv/strongweak.html (f) Learning Python is easy, easy, easy, especially for a Java programmer. Similarities: assignment via reference, fully-object-oriented from the start, rich class libraries. Differences: Python supports mutliple inheritance, interface contracts are not required in Python, but can optionally be specified (and are in most good Zope products, like the CMF), Python is dynamically typed, which means less casts and worrying about type-checking (just focus on passing unit-tests instead). Python can be learned interactively. You are not going to face the same, or even 1/4 of the same learning curve you took on when you first learned Java. Buy youself a copy of Beazley's Python Essential Reference, 2nd Ed, and go through the official Python tutorial at: http://www.python.org/doc/ and you should be in good shape. If you don't have a few hours to learn the ropes in Python, perhaps Zope is not really going to benefit you as much as it possibly could; if you are that committed to the Java platform, you might want to consider some of the other app server alternatives out there. If Zope has compelling features (and it has many) that are attractive enough, learning Python should not be the barrier for you. If it is, you likely don't care about the features enough to justify the interest. Sean -----Original Message----- From: Heri [mailto:htan@gmx.de] Sent: Wednesday, February 12, 2003 8:04 PM To: zope(a)zope.org Subject: [Zope] Love Zope but want to avoid Python Hi, i'm a java programmer for the last 3 years. I'm very comfortable with Java Language now, and understand most of its library, ettc.. I like Zope very much and like its ZPT and many others. But I have not much idea about Python and I don't want to spend much time 'learning python' just do do stuff with Zope. As I feel more comfortable with Java, can someone suggest me a way to use ZOPE by using my Java Skill? thanks!!! _______________________________________________ Zope maillist - Zope(a)zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )

5 4

Love Zope but want to avoid Python
by Heri 15 Feb '03

15 Feb '03

Hi, i'm a java programmer for the last 3 years. I'm very comfortable with Java Language now, and understand most of its library, ettc.. I like Zope very much and like its ZPT and many others. But I have not much idea about Python and I don't want to spend much time 'learning python' just do do stuff with Zope. As I feel more comfortable with Java, can someone suggest me a way to use ZOPE by using my Java Skill? thanks!!!

4 3

Re: [Zope] Writing a product
by Dennis Allison 15 Feb '03

15 Feb '03

Stavros Tsolakos <stsolakos(a)patras.atmel.com> wrote: I want to find some step by step reference about how to write a new product. I have found some how-tos, but I still feel completely lost. Everywhere I look, I see Zope specific function calls. Does any document exist containing product-API specific stuff that could aid a Zope little-above-newbie level developer? Take a look at: http://www.zope.org/Members/maxm/HowTo/easyProduct which provides a simple and quick path to writing products.

3 2

External Editor on Client?
by Andy McKay 15 Feb '03

15 Feb '03

Hi, I've got an intranet app that uses Plone, CMFTypes and Word so that using the joys of External Editor people can happily edit and save Word docs oh so easily. But I need to be able to tell if the client has EE on it and if it doesnt display a warning message that points them to the download page. Anyone got a cunning way of doing this? There's nothing in the HTTP headers (on my IE and Mozilla anyway). I could add a sort of ping to External Editor that returned its version info, but that would just be a "download this file?" dialog in most browsers and not something useful. Any other ideas? -- Andy McKay

1 0

Enabling micropayment in zope using centipaid
by Adonis El Fakih 15 Feb '03

15 Feb '03

Hi, We have various sites using Zope and we are trying to install a micropayment solution to collect fees from our online users. We want to use the Apache::Centipaid module from centipaid.com. This module is an Apache authentication module, and it works by inserting configuration instructions for mod_perl in the httpd.conf. What we are trying to do (for testing purposed) is to make the http://www.aley.net/Ar/centipaid path paid using centipaid Apache:: Centipaid module (the test is to pay $0.005 which will allo the user access for 1 day) We have tested the module with plain apache site and it works well, but when used with a zope installation we are getting nothing. What I mean it seems that module does not get called at all, so it is an apache/Zope issue dealign with authentication, and that is why I am asking for pointers on how to do that if it can be done at all. In plain apache installations the path is the path of the file but in zope it is not, since it is rewritten to be executed by Zope.cgi This is the centipaid configuration, the instruction is what confusing me here, and where should I insert it?? after the rewrite engine? before??.. AuthName Centipaid AuthType aleynet PerlAuthenHandler Apache::Centipaid require valid-user # debug level 5 shows everything, 0 show nothing PerlSetVar debug 5 # payee information # To signup for an account go to www.centipaid.com PerlSetVar acct xxxx PerlSetVar pass xxx PerlSetVar amount 0.005 PerlSetVar duration 1d PerlSetVar lang en PerlSetVar enforce_ip 0 # centipaid receipt server assigned to payee PerlSetVar authserver pay001.centipaid.com PerlSetvar authport 2021 # mysql database to hold the receipts PerlSetVar dbtype mysql PerlSetVar dbhost xxxx PerlSetVar dbport 3306 PerlSetVar dbname xxxx perlSetVar dbuser xxx perlSetVar dbpass xxx and our zope installation looks like this ServerName www.aley.net DocumentRoot /web/zope/sites/www.aley.net ErrorLog /web/log/www.aley.net-error_log TransferLog /web/log/www.aley.net-access_log ScriptAlias /cgi-bin/ /web/zope/sites/www.aley.net/cgi-bin/ # AllowOverride None AllowOverride AuthConfig Options ExecCGI Order allow,deny Allow from all RewriteEngine on RewriteRule ^/cgi-bin - [L] RewriteRule ^/accesswatch - [L] RewriteRule ^/netgame - [L] RewriteRule ^/images - [L] RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule ^(.*) /web/zope/sites/www.aley.net/cgi-bin/Zope.cgi$1 [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,L] Any help on getting Zope to work with this authentication module will be appretiated, since it will open the doors for paid content on sites using centipaid. Info about centipaid: http://www.centipaid.com Apache::Centipaid http://www.centipaid.com/download/apache_centipaid.html Configuring the Apache::Centipaid module http://www.centipaid.com/faq/question.php?qstId=8 Thanks in advance.. Adonis _______________________________________________________________ Ayna.com the Arabic web starts right here.

1 0

Can't access id or title
by Sean K 15 Feb '03

15 Feb '03

Hi all, When I add a dtml method to an instance of a product that subclasses folder, any attempt to render the id or title cuases the Authentication Failed msssage box and delivers a traceback like this:- Module ZPublisher.Publish, line 150, in publish_module Module ZPublisher.Publish, line 114, in publish Module Zope.App.startup, line 182, in zpublisher_exception_hook Module ZPublisher.Publish, line 98, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 39, in call_object Module OFS.DTMLMethod, line 126, in __call__ Module DocumentTemplate.DT_String, line 474, in __call__ Module OFS.DTMLMethod, line 119, in __call__ Module DocumentTemplate.DT_String, line 474, in __call__ Unauthorized: You are not allowed to access title_or_id in this context (Also, an error occurred while attempting to render the standard error message.). I have tried adding Implicit and SimpleItem to the inheritence, this does not help (I didn't expect it to as folder inherits Item). Rendering the id from a dtml method of the product causes no pain. Of course a dtml document contained in the product also causes no problems. So why the problem? No references to id or title and the dtml-method renders fine. Thanks in advance, Sean Kemplay. __________________________________________________ Do you Yahoo!? Yahoo! Shopping - Send Flowers for Valentine's Day http://shopping.yahoo.com

2 2