- Zope - Zope lists

Re: [Zope] Security question...
by H.de.Wit＠SFK.NL 28 Jan '03

28 Jan '03

It is a little cheap, but this should work: You can exclude the two users (it is 1 report, isn't?) by adding a call to a pythonscript to your report. content of the pythonscript something like this: from AccessControl import getSecurityManager user = getSecurityManager().getUser() if user=="George" or name=="Saddam": target='www.friendsforever.org' RESPONSE.redirect(target) return # i don't know why, but this return seems to be necessary. Hans de Wit Stichting Farmaceutische Kengetallen Postbus 30460 2500 GL DEN HAAG Tel. 070-3737448 Fax 070-3737445 |---------+---------------------------> | | pskipwort@touchc| | | orp.com | | | Sent by: | | | zope-admin(a)zope.| | | org | | | | | | | | | 28-01-2003 05:36| | | | |---------+---------------------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| | | | To: zope(a)zope.org | | cc: | | Subject: [Zope] Security question... | >--------------------------------------------------------------------------------------------------------------------------------------------------| I thought this might be in the FAQ, but can't seem to find it in there... I have a particular report which I want "Everyone with Role 'A' to be able to View except for users U1 and U2' I do not want to remove U1 and U2 from Role A globally - is there an easy of of locally removing 'View' permission for 2 specific users, and retain View permissions for other users sharing the role ? Thanks, P PETER SKIPWORTH SYSTEM ADMINISTRATOR TOUCHCORP LTD TELEPHONE 03 9635 2626 www.touchcorp.com _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Security question...
by pskipwort＠touchcorp.com 28 Jan '03

28 Jan '03

I thought this might be in the FAQ, but can't seem to find it in there... I have a particular report which I want "Everyone with Role 'A' to be able to View except for users U1 and U2' I do not want to remove U1 and U2 from Role A globally - is there an easy of of locally removing 'View' permission for 2 specific users, and retain View permissions for other users sharing the role ? Thanks, P PETER SKIPWORTH SYSTEM ADMINISTRATOR TOUCHCORP LTD TELEPHONE 03 9635 2626 www.touchcorp.com

2 1

Using Apache instead of Zope server.
by Paul Naveen Raj Jeyaraj 28 Jan '03

28 Jan '03

Hi, I want to use Apache server instead of zope server. I have succeeded in running zope behind Apache, but want to know whether it is possible to use zope with some other server other than zope's server. Any pointers about this would be of great help. Thank you. Regards, Paul.

2 1

Zope News Jan 27 2002
by george donnelly 28 Jan '03

28 Jan '03

ZOPE NEWS January 27, 2002 1. DECISION TIME ON NEW ZOPE.ORG NZO is moving along thanks to the efforts of Guido, Sidnei, Jeff and others but the Zope Community has an important role to play. Should Plone be used? or the CMF? What content should be carried over to NZO and who's going to help out with this? Guido van Rossum's Latest Update on NZO http://lists.zope.org/pipermail/zope-web/2003-January/002310.html An Open Letter Advocating the use of Plone for NZO http://plone.org/Members/zwark/plone-nzo An open discussion on how to organize a community voting process for the NZO decision http://plone.org/Members/slinkp/CMF_Wiki.2003-01-25.3013/CommunityDecisionPr ocess 2. CMF 1.4: HELP WANTED Andy McKay is looking for help with the CMF 1.4 release. http://cmf.zope.org/projmgmt/project_schedule/roadmap_1_4 The relevent discussions on the CMF list: http://lists.zope.org/pipermail/zope-cmf/2003-January/thread.html#16893 3. ZOPE 3 SPRINTS December saw two Zope 3 sprints in Europe. The first, organized by Kit Blake at Infrae, brought together a large group of sprinters for a wonderful week-long session. Much was accomplished, not just in committed code, but in brainstorming and knowledge sharing. Rotterdam was a blast and Kit really did an exceptional job at running the circus. http://dev.zope.org/Wikis/DevSite/Projects/ComponentArchitecture/InfraeSprin tathon http://dev.zope.org/Wikis/DevSite/Projects/ComponentArchitecture/Alpha1Sprin t 4. ZOPE RELEASES In the last newsletter we discussed Jim's promise to get a Zope 3 alpha1 release out in 2002. Well, in most timezones, Jim met his promise! On Dec 31, Zope 3 officially saw its first light of day. The release had its intended impact: focus was brought to the project and the schedule. Quietly another release began to make its way out. Zope 2.6.1 beta1 was released, with fixes for some problems in 2.6.0. Another beta was scheduled for December, but that slipped. The second beta is planned for January, though no announcement has been made. 5. PLONE 1.0 RC2, FINAL IN SIGHT A second release candidate for Plone was released Jan 22. The number of translations is now up to 24! Also, if you want Plone to look different than the Norwegian Blue layout, RC2 has 8 new skins. http://plone.org/Members/runyaga/news/RC2_released 6. UPCOMING EVENTS SolutionLinux 2003 The Zope Europe Association has organized a pavilion of Zope companies and organizations for SolutionsLinux 2003, Paris, Feb 4-6. Participants include Ingeniweb, PilotSystems, Logilab, Cocof, Zope and Python Job Mart, University of Savoie, and Zopera. In conjunction with the pavilion, there is a second Zope 3 UI Sprint in Paris during the same week. http://www.zope-europe.org/sl2003/ Berne Plone Sprint The week after the Zope pavilion, there is a Plone sprint in Berne, Switzerland (Feb 10-12). Bernhard Bühlmann is organizing it, and he has an impressive list of attendees. And yes, Berne is gorgeous. http://plone.org/Members/buehlmann/PloneSprintBerne/News_Item.2002-12-06.054 9 DZUG meeting and sprint Christian Theune, Maik Jablonski, and the other DZUG'ers are planning a DZUG meeting Mar 24-27. Along with the meeting, a sprint is planned. Looks like Tres Seaver from ZC will be there as well. http://dev.zope.org/Wikis/DevSite/Projects/ComponentArchitecture/DZUGSprint 7. ZOPE 3 NEWSLETTER NO. 6 http://dev.zope.org/Wikis/DevSite/Projects/ComponentArchitecture/Zope3Newsl etter6 8. DISCUSSION ON IMPROVEMENTS TO ZPT If you've used Page Templates and the associated TAL functions, you've probably enjoyed the enhanced usefulness and flexibility they offer. Nevertheless, there is always room for improvement. Order of TAL operations(1) has been the topic du jour on the ZPT mailing list(2). Shane Hathaway introduced his "Mini proposal"(3) to improve TAL by adding two new attributes: tal:repeat-define and tal:repeat-condition. At issue is the fact that due to the order of operations, a tal:define or tal:condition will only be executed once when on the same element as a tal:repeat. Shane's proposal adds two attributes that would be evaluated for each repetition. Well, what looked like a fairly straight-forward request generated a storm of comments. The reactions ranged from moderate approval (4) (5) to proposals to change the order of operations and not add tags (6) to proposals of a user-defined order (7). With all the talk of changing things, the "leave well enough alone" crowd came out to play (8). At our deadline, the discussion looks to have stalled with no resolution. 1) http://www.zope.org/Documentation/Books/ZopeBook/current/AppendixC.stx#3-16 2) http://lists.zope.org/mailman/listinfo/zpt 3) http://lists.zope.org/pipermail/zpt/2003-January/004210.html 4) http://lists.zope.org/pipermail/zpt/2003-January/004248.html 5) http://lists.zope.org/pipermail/zpt/2003-January/004249.html 6) http://lists.zope.org/pipermail/zpt/2003-January/004241.html 7) http://lists.zope.org/pipermail/zpt/2003-January/004226.html 8) http://lists.zope.org/pipermail/zpt/2003-January/004244.html 9. ZOPE SOLUTIONS PROVIDERS LIST REACHES 100 As of this weekend, with the addition of TEKK <http://tekk.dk/> from Copenhagen Denmark and Uptime Systemlösungen GmbH <http://www.uptime.at/> from Vienna Austria, the Zope Solution Providers list now has 100 members. 10. CMF Portlets Reaches 0.5.1 I'm working on the next release of CMFPortlets, v 0.5.1, and the major new feature will be the interactive layout, thanks to OptionChooser 1.0, a DHTML layers switcher and chooser based on the Dynapi library, which I got to know by means of Tim Lynch, member of our community. OptionChooser is written by Dan George. CMFPortlets 0.5.1 will be released during the next week. An installer for Plone will be delayed until the release of its 1.0 version, due to remaining issues related to the behaviour of SkinnedFolders, which are the primitives for portlets. ZN: Ausum, can you give a sketch of what CMFPortlets does and what some possible, easy-to-grok applications could be? AS: Hi George, what a nice opportunity to write stuff. CMFPortlets was born from the need to offer personalized content to members, in the same way as many "my.something.com" portals, without paying the price of getting through any other processor in the middle. (No XML is needed here.) The key idea behind was to pack content into renderable container objects -the portlets, which rely on SkinnedFolders- so that they could use Zope's security and cataloguing machinery, while been able to be easily arranged in a presentation page. So, although portlets are indeed objects with a view method, we don't want nor need to watch them individually, but through a single global method, 'page_view', wich is callable from everywhere (from the root, by default). A portlet needs to be fully renderable before it gets its way to the presentation page, (aka 'workspace'). If the portlet uses CSS, it needs to contain its own styles, so that they don't disturb another portlet's look in the same workspace. (I'm working on a 'plugable' stylesheet concept so that the designer can define a general stylesheet for the site, and still allow portlets to look the way their authors wanted.). As portlets are containers, they can store anything from other portal types to just code, so that, if we store several documents, we'll see them rendered one below another; and if we store one or more methods calling things from different places, we'll see what those methods retrieve, one thing below the previous. A portlet's default view does render and show all what's inside it, but as it needs to provide itslef a graphical container to show off at the workspace, you can apply to it a "portlet_skin". (Typically boxes with a title.) Adding, renaming, deleting and setting the size properties of workspaces. Workspaces (or pages) aren't objects by themselves. Instead, 'page_view' is aimed to give you that impression, by rendering the portlets you have selected (which in their turn are a search to the catalog) in the place in page you've also selected, according to a variable living in portal_memberdata. Every time you add, delete, or rename a workspace, or change its size properties or add/delete a portlet, you retrieve and modify that variable, just that. The methods for the task live in 'portlets_garage'. Applications for portlets In its origin, portlets were meant just to provide content personalization for large B2C portals. I use it in combination with RDFSummary to display feeds in my local computer (which I used as demo for a few weeks), but in the corporate and intranet market, they can be used to allow an employee to have its own workspaces according to his role within the company. This same level of content discrimination on a personal basis is a must in large institutions like universities and even the government. There might be cases when the portlets selection is up to the end user, and there might be others where a person with the right role creates the workspaces and assigns them to the users. But the most important, from my perspective, is that it can be hooked to a personalization tool ('portal_personalization' maybe) that tracks a user's session and, based on a computer generated profile and his own needs, offers him a unique visit experience, all on the fly. I'm sorry I can't tell more within the context of this "impromptu". I hope I have covered at least some of your questions. I'll write a detailed how-to that you could quote for the next-to-tomorrow's release of Zope news. :) 11. NEW HOWTO'S zSSL SSL Server integrated to Zope http://www.zope.org/Members/nakagami/zSSL Upload, Insert and Retrieval of BLOBs http://www.zope.org/Members/murphy/MySQL-BLOBs How-To install Silva_0.9 on OSX http://www.zope.org/Members/rmoser/osx_silva Row level lock with ZMySQLDA on InnoDB causes error http://www.zope.org/Members/murphy/ZMySQLDA-locking Formulator_With_ZPT http://www.zope.org/Members/beno/HowTo/Formulator_With_ZPT Zope and SSL http://www.zope.org/Members/Ioan/ZopeSSL Using Dreamweaver with Zope, over WebDAV http://www.zope.org/Members/ike/dreamweaver/DAV Zope and Python on Mac OS X v. 10.1 and higher http://www.zope.org/Members/jens/docs/zope_osx Tips for multilingual websites, using DTML and Localizer http://www.zope.org/Members/CodeSyntax/DTML_Localizer Using Folders as Pages http://www.zope.org/Members/phill/FoldersAsPages Issue with importing all from MySQLdb http://www.zope.org/Members/murphy/MySQLdb-import Build a simple ZClass (CatalogAware, non-default Catalog, Folderish) http://www.zope.org/Members/kedai/BuildSimpleZClass 12. PRODUCT RELEASES ZPhotoSlides 0.9 http://www.zope.org/Members/p3b/ZPhotoSlides/ZPhotoSlides-0.9.tar.gz Play Chess http://www.zope.org/Members/blacktav/chess/play_chess-0.0.zexp Silva-0.9.tgz http://www.zope.org/Members/faassen/Silva/Silva-0.9.tgz RemoteUserFolder-0.4 http://www.zope.org/Members/djay/RemoteUserFolder/RemoteUserFolder-0.4.zip Zope Discussion Board http://www.zope.org/Members/rfrey74/zboard/ZopeBoard.zip PythonDB.zip http://www.zope.org/Members/rfrey74/pythonDB/PythonDB.zip IssueTrackers general masscontainer http://www.zope.org/Members/peterbe/IssueTrackerProduct/issuetrackers.zexp Unified HTML Document http://www.zope.org/Members/lheber/software/UnifiedHtmlDocument.tar.gz Silva-0.9.0.1 http://www.zope.org/Members/faassen/Silva/Silva-0.9.0.1.tgz Gnowsys version 0.2 (development) http://www.zope.org/Members/nagarjuna/GNOWSYS/Gnowsys-0.2.tgz Formulator-1.3.1 http://www.zope.org/Members/faassen/Formulator/Formulator-1.3.1.tgz ParsedXML-1.3.1 http://www.zope.org/Members/faassen/ParsedXML/ParsedXML-1.3.1.tgz ZWiki-0.14.0 http://www.zope.org/Members/simon/ZWiki/ZWiki-0.14.0.tgz TextIndexNG-1.08 http://www.zope.org/Members/ajung/TextIndexNG/TextIndexNG-1.08.tar.gz VarImage 1.0 (alpha) http://www.zope.org/Members/terry/VarImage/VarImage-1.0a.tgz XMLWidgets-0.8.4 http://www.zope.org/Members/faassen/XMLWidgets/XMLWidgets-0.8.4.tgz BlogTopic-0.1a http://www.zope.org/Members/karl/BlogTopic/BlogTopic/BlogTopic-0.1a.tar.gz QuickLinks-0.1.6 http://www.zope.org/Members/peterbe/QuickLinks/QuickLinks-0.1.6.zip This week's Zope News was brought to you (in a hurry) by: Troy Farrell, Paul Everitt, Bakhtiar A Hamid, Jeffrey Shell, Ausum Studio and George Donnelly. <--> george donnelly - http://zettai.net/ - "We Love Newbies" :) Zope Hosting - Dynamic Website Design - Search Engine Promotion Yahoo, AIM: zettainet - ICQ: 51907738 - e:george@zettai.net

1 0

Changing HTML tag attributes with ZPT macros
by Michael LaPera 28 Jan '03

28 Jan '03

Hello, I have a ZPT METAL macro slot for menu bar navigation. The menu bars have JavaScript image mouseovers that I want to preload using the "onload" attribute in the body tag. How can I change the images that I preload when I use different navigation in the slot? Michael

3 2

Includes w/ WebDAV.
by Jason C. Leach 28 Jan '03

28 Jan '03

hi, I have noticed that with WebDAV, dtml-include statements are executed when data is checked out from the server. This is not what we want. We need them to go in and out as include statements (they go in to the web server fine). Any way to stop DTML from being executed by WebDAV? Thanks, j. -- ...................... ..... Jason C. Leach .. Current PGP/GPG Key ID: 43AD2024

2 1

Memory leak possibly solved
by Chris Muldrow 27 Jan '03

27 Jan '03

We've been fighting a rather nasty memory leak that was growing our memory usage up to the 800 meg range or more and never giving any memory back. It started when we switched to 2.6.0 (of course, we didn't notice until after our 2.6.0 testing period...) and occurred as well with 2.6.1b1. Through a whole lot of testing, I narrowed it down to when Zclass instances we have that are CatalogAware were being indexed (mainly TextIndexed). I could start up an instance of our site, hit the index button and watch the memory climb. It did the same thing on a smaller scale when the individual instances were saved and indexed. I tried rebasing the Zclasses; using both ZCTextIndex and TextIndex; running on a standalone Zope instead of ZEO; and creating entirely new catalogs with reduced numbers of indexes. Nothing seemed to work. While doing this work on 2.6.1b1, I noticed that there was a bug that wasn't letting me create a new Zclass in the 2.6.1b1 Products folder. I posted it to the collector (I could add them in 2.6.0, then move the data to 2.6.1b1 and not be able to add them, so I figured it was some sort of weird bug). Tres suggested I install the latest CVS version and see if it fixed the Zclass problem. It did fix the Zclass problem, and on a whim I threw my data into the CVS install and started banging on the Catalog. It looks like the memory leak is gone!!!! After dancing naked around the office for a little while, I decided to post this for anyone else who might experience one of these two problems. Because Tres and I both tried just the CVS Zclass stuff and it didn't fix the problem, he said he thought it might be ZODB-related. I suspect that might be the same issue with my Catalog problems--I pretty much had them pinned down to writes into the ZODB. Thanks to Chris and Dieter and Tres and anyone else who tried to help. I've decided memory leaks are evil things born of Satan's womb.... Chris muldrow(a)mac.com

1 0

interaction with local FS
by Mario Bianchi 27 Jan '03

27 Jan '03

Hi everyone, I'm curious in finding out how zope interacts with the server's file system: let's say I want to allow the users of my site to manage (read/write) their own files on the server's file system, does Zope support this goal anyhow? As far as I've seen, to me the response seems to be no, it doesn't! The only way to access the server's file system from zope seems to be using the ExternalFile product, which is far from satisfactory from the point of view of file access rights: it only allows access to files owned by zope itself (or in the same group of zope's). No way to access 'someuser''s files with the uid of 'someuser'? Thanks, Mario. _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

2 1

How to disply a property of an object created with a Z class
by pieter claassen 27 Jan '03

27 Jan '03

I used a Z class to write a basic news pinup board for my site. Everything is working fine but I reached a point where I am trying to publish only the heading and a summary of the message while asking users to click on a link to view the body of the message I have created a newster class which is my news server instance. The newster class contains the messages class which is the blueprint for each of the messages that I am going to add. Each message is an object in the newster directory. The message objects each have a number of properties such as expired, title, id, summary and body. I have two methods: 1. index_html that prints the title and summary of each message instance one after the other on a long page. 2. display_body that will print the body of the message in a new window. The problem: I pass the id of the message whose body must be displayed in a url like: display_body?document_id=<id> Here is what I believe the basic code of the display_body method should be: <dtml-var standard_html_header> <dtml-with REQUEST> <dtml-with expr="document_id"> <dtml-var body> </dtml-with> </dtml-with> <dtml-var standard_html_footer> I can print the document_id as a dtml-var but somehow I cannot get zope to understand it is the name of an object whose body property I want to display. But, somehow, zope does not push the properties of the document_id (which it received through the web) on top of the namespace and therefore it believes that there is no such thing as a body property. Any help will be greatly appreciated. This is driving me nuts. Thanks, Pieter

3 3

manage_proxy Forbidden error
by Cornel Nitu 27 Jan '03

27 Jan '03

Hi, I want to add from an external product, a DTMLMethod with proxy role 'Manager'. getattr(self,'daily_notifications').manage_proxy(['Anonymous','Authenticated','Manager'],REQUEST) I receive the following error: "Forbidden Header You are not authorized to change daily_notifications because you do not have proxy roles. " How is it possible? Thanks.

2 1