- Zope - Zope lists

Security and resposability
by p.t. 16 Jun '02

16 Jun '02

I'm in some troubles with two problems: one is concerning session and the other security. The session problem is connected with references maintaned in items (specifically dictionary) stored in a session to the original objects. The list helped me to understand that copy() and deepcopy() exist: this could have solved the problem. However, the Python module copy is not loadable for security resons. Some time ago I had the necessity to evaluate a string, that could be done using eval(). However, eval() is not usable for security resons. Both situations can be overidden using an External Method "safe_eval" (as pointed out by Dieter Maurer in an answer to my thread dictionary definition and strings on 4 Apr 2002). Now, I would have no technical difficulties doing that, but, for a "political" decision of the institution using the product, everything developed must be usable with the current "standard" version of Zope, without modifying even a comma on the original downloaded files. This means no External Method "safe_eval". Now, my question is: why limit the usage of methods like copy(), deepcopy() and eval()? The usual answer is to rise the security treshold. OK, but this is also an "a priori" limitation of developer responsability. I believe that I understand the troubles an evaluation of a client query could produce. But can some guru explain to me how an hacker could produce crashes or some other sever damages if I use such methods to evaluate an internally generated string or deepcopying an internally generated dictionary? Sorry for the long message. p.t.

3 3

ZSyncer trouble with large Folders
by Graham King 16 Jun '02

16 Jun '02

Well I really like the function of ZSyncer, and I'm using the latest (0.4.3). Oh, I see there's 0.4.4 - but here's my problem.... BUT, we sometimes get into trouble with large Folders. Of course our developers constantly grow these anyway. I would assume that we're getting TCP connection failures due to checking a large number of objects. Sometimes I get "page not found" or "Internal Error" or occasional a Zope/python error: "IO/Error" after a Sync. After this last, I find that ZSyncer has worked after all, but it's terribly frustrating at times. I'm resorting to Export/Import to ensure things happen the first time round. Has anyone come across these issues? Any suggestions? cheers Graham

4 3

Re: [Zope] Problems decoding MIME parts with CMFMail script "addtoMailFolder_unpack_part"
by Michael LaPera 16 Jun '02

16 Jun '02

2 1

Performance question
by Dirk Datzert 15 Jun '02

15 Jun '02

Hi, I tested our Zope instance with httperf and wondered that our zope is probably not performant enough. We have the following Zope running: Hardware: Compaq DL360, 1.2GHz, 640MB RAM Software: SLES 7, Python 2.3.1, Zope 2.3.3, Apache 1.3.19 with ProxyPass/ProxyPassReverse I used the following httperf command: httperf --server web04 --uri http://web04/Technik/ --num-conn 30 --rate 3 --timeout 10 http://web04/Technik/ is normally a page which needs 3 sec to build. I get 29 client-timeoute out of 30 request. In the monitor of web04 I see max 4 python processes running with 25% CPU usage but only 35MB RSS. How can I give Python more memory ? like 128MB for each python process How can I make Zope use a better caching ? I thing that the results of the request are not cached for next request ! Is it better to use Apache with pcgi ? Any suggestions welcome :-) Regards, Dirk

3 2

Best way to impliment ultralight security / restricted access schemes.
by Gary Speer 15 Jun '02

15 Jun '02

Hi - I'm looking for the most expedient way to accomplish the following: We have a project where we want to implement persistent security (if you can call it that) by folder but using annonimous or screenname-only logins. To put it plainly, if you know the secret password for a folder, same password for all coming to the folder, you get access to the folder and all subfolders. Your access is persistent, session to session, at least by machine (cookie) or your list of folder accesses is restored when you login using the same screen name. Each user may have a different combination of folder approvals. I know there are lots of ways to do this with typical html panashe. I'm looking for really cool ideas that use the power of Zope to keep this really simple. The semi-obvious is to make the first-time-access password a property of the folder. Its the remembering you've been there before and automatically letting you back in that we are after via a database record (preferred) or a cookie. All thoughts appreciated. Thanks, gary

2 1

RE: [Zope] How to concatenate variables
by McDonnell, Larry 15 Jun '02

15 Jun '02

Ok, how do you use <dtml-in concat_sub_type_to_part_num(st1,sub_type2)>? I keep getting a key error. Can you use a python script passing variables in a dtml-in statement? -----Original Message----- From: Dieter Maurer [mailto:dieter@handshake.de] Sent: Friday, June 14, 2002 3:05 PM To: McDonnell, Larry Cc: 'Zope@Zope. Org' (E-mail) Subject: Re: [Zope] How to concatenate variables McDonnell, Larry writes: > I am having problems concatenating variables. I have seven pull down menus. > Selecting one from each menu will create a part number. I setup a test to > see if this would work. I have one dtml doc with the menus. After a submit > it calls this dtml doc: > > <form name="form1" method="post" action=""> > <dtml-let pn="' ' "> > <dtml-call concat_sub_type_to_part_num(st1,sub_type2)> > <dtml-var st1>st1<dtml-var sub_type2>st2 > <dtml-var expr="pn==st1+sub_type2"> > <dtml-var pn> pn > </dtml-let> > </form> > > I call a python script concat_sub_type_to_part_num and pass two of the menu > selections in this test. I tried to concat there but no luck. I can only see > the variables I passed. Functions are unable to change strings in the callers context. You need to return the concatenated value. And you must not use "dtml-call" in this case, as it discards the return value. Dieter

2 1

Planning advice
by Charlie Reiman 15 Jun '02

15 Jun '02

I've been working with Zope for a few months now and I'm not really thrilled with what I've got. I have a functioning website and it works and does what I want but I can already see that moving forward is going to be unpleasant. As an engineer this bugs me and I need to evaluate the situation and determine: is it me or is it Zope? The project has two major goals. First, to create a data reporting site. It's a straightforward display of SQL data as tables. Nothing super-fancy but there are style issues and there's quite a number of reports, all different, and date ranges, etc... Lots of minor issues. The only tricky part is the reporting system needs to support multiple customers, ideally off of the same URL, each seeing different data. The second part is trickier. Each client may have custom or hidden reports and I need to be able to maintain this stuff. Ideally, I won't be maintaining and customizing this, as I'm expensive. A cheaper webmonkey (who is a fully actualized human to whom I intend no disrespect by calling a "webmonkey") will be doing the customization and maintenance. In object parlance, I customer's reports would be subclasses of a generic reporting class, adding and removing functionality as needed. What exactly would be the right approach to this? My original attack was a Python product. This rapidly became a huge pain, as the folderish product contained several ZSQL methods that require constant tweaking. With each tweak, I had to delete existing instances of my product (as they contained instances of old ZSQL methods) and reinstall and reconfigure a new instance. Iterations usually involved bouncing the server as well since it eventually failed to work correctly with refresh (I never figured out why). On top of that, subclassing my product to create custom reports is beyond what we expect of our future simian. The current approach consists of a "reports" folder that I mirror via PortableHole to different client folders. This lets clients have custom attributes that the mirrored reports can acquire. This is also unpleasant since it makes it impossible for custom pages in the clients folder to acquire reporting infrastructure data from the reports directory. It also fully exposes my reporting system to the future webmonkey. I will only be able to distract them with bananas for so long before they stick their paws into my juicy code resulting in a sticky mess and an angry monkey. So what would you do? Products look like the right thing, but I'm not sure how to handle the mess of SQL methods and potentially complicated customization I need to do. Just so it's clear, here's what I have now: /clients/one/reports (PortableHole to /reports) /clients/two/reports (PortableHole to /reports) /reports (contains LOTS of stuff, including more folders with ZSQL methods, DTML, Python snippets, images...) I also had a previous solution: /reports/client-one/index.html /reports/client-two/index.html /reports/... All the above mentioned DTML & ZSQL stuff but not organized into subfolders. This solution was unmaintainable since the reports folder was rapidly swelling to huge proportions, making it difficult to work in that folder. What it feels like to me is that Zope's acquisition is clever but insufficient for moderately complicated design. What I want is more like an import or inheritance system, where I explicitly state what I'm trying to use. Obviously, I'm missing something (besides a monkey). Comments?

2 1

Form in ZClass
by Daniel Schmitz 15 Jun '02

15 Jun '02

Hi all, its possible make automatic form in Products/Zclass? Bye _______________________________________________________________________ Copa 2002 Yahoo! - Patrocinador oficial da Copa do Mundo da FIFA 2002 http://br.sports.yahoo.com/fifaworldcup/

2 1

external process
by Micah Martin 15 Jun '02

15 Jun '02

Hi all, I can't seem to get Zope to initiate an external process. I've tried to use External Methods and the Python os library functions spawnv() and fork() with execv()/system(). In each case the functions run and return but nothing else happens. Running the same function calls from Python outside of Zope works fine. Anyone have any ideas why it wont work or how to get it to work? Micah

3 2

sql method call not working
by Kelley, Sean 15 Jun '02

15 Jun '02

Hi, I am trying to call a simple sql method to insert data from a form. Does not work. I have used this same way of doing it before and cannot see the problem. I can test the sql method and that works, but calling it from the html doc does not work. I can comment out the call and insert some html and that works ok also. <dtml-try> <dtml-call name="plancheck_insert"> <dtml-except> <br>Sorry, your IW Plan Check Entry was not added to the database because an error occurred. </dtml-try> I get the exception message. Do you see a reason why this might not work? I looked at persmissions, spelling, etc. Sean Kelley Technology Coordinator Utilities Dept. City of Santa Rosa

3 2