- Zope - Zope lists

web access logs when behind Apache pcgi and authenticated user
by Milos Prudek 30 Apr '02

30 Apr '02

Is there a way to get correct web access logs including authenticates user and originating hostname when Zope is behind Apache through pcgi? Details: Z2.log displays authenticated user when Zope is the direct webserver. When Zope is behind Apache, Z2.log becomes useless. It does not list authenticated users (at least when using exUserFolder) and all connections seem to come from 127.0.0.1 (localhost). The apache log lists correct originating IP or domain name, but not the authenticated user. -- Milos Prudek

1 0

RE: [Zope] DTML in Product
by Raj NS 30 Apr '02

30 Apr '02

hi >add_contrib_dtml = DTMLFile('dtml/add_contrib', globals()) >manage_addGalleryArt = DTMLFile('dtml/addGalleryArt', globals(),add_contrib_dtml=add_contrib_dtml) try this # Constructors # addForm = HTMLFile('addForm_HTML',globals()) #this calls the addForm_HTML.dtml from LocalFS to ZODB # as this is the constructor __init__ , this dtml is called when first time product is installed. def addAction(self,id,REQUEST=None): #Now when this addForm_HTML.dtml is running ( the form REQUEST.form) calls the this script (addAction ) I think , I got ur problem .... >This must be because the DTML files are not in the >Zope >hierarchy, but are instead in my Product, but I then >don't understand why the DTML forms worked in the >first >place. SO -- the question I'm asking is how was I >_supposed_ to do this? (How) can I build a DTML >hierarchy >like this inside my Product? it think you better look at my prototype project http://www.geocities.com/rajns/zope/Pustak.zip ADVICE: if EVER you want to make a project just go throgh projects like Squishdot , read the code , almost 99% u get a easy way of doing diff things. Regards RAJ ________________________________________________________________________ For live cricket scores download Yahoo! Score Tracker at: http://in.sports.yahoo.com/cricket/tracker.html

1 0

Interface for Topic Index
by Tom Deprez 30 Apr '02

30 Apr '02

Hi, I would like to let a user create a Topic List (in Tree form) and later choose out of it to assign topics to a stx document product I made. These topics will allow to search a ZCatalog later on. Is there already someone who made such an interface, which I can easely import and use? Anybody ideas what the easiest way is for such a thing? Thanks in advance, Tom.

2 1

SOAP and 2.6
by marq＠europa.com 30 Apr '02

30 Apr '02

Hi All, Did SOAP support make it into the 2.6 release schedule? Is there any other reliable way to make SOAP happen with Zope? Thanks, mark -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ .

2 1

Generating list of objectIDs dynamically
by Ronald L Roeber 30 Apr '02

30 Apr '02

I am trying to generate an form option list containing documents in a folder. The folder arrangement is as follows. county -- Golden --- doc1 | | | -- doc2 | - Silver --- doc3 | -- doc4 If the user has indicated they are from "Golden" county, how do I generate the proper list of documents in the corresponding directory dynamically ['doc1','doc2']? If the REQUEST object includes the county=="Golden", how can I do something like this (which works, but is obviously not dynamic): <form="form" method="post" action="action" tal:define="workingCounty request/county; docs here/county/Golden/objectValues()"> How do I get the workingCounty variable to replace the "Golden" in the docs definition. This is probably simple, but I'm missing it. Thanks for any help. -------------------------------------------------------------------- Ronald L. Roeber CIT-IANR University of Nebraska Lincoln, NE 68583 Phone: (402) 472-5630 email: rroeber1(a)unl.edu

2 1

zope and WAP
by alejandro.montenegro＠alumnos.utfsm.cl 30 Apr '02

30 Apr '02

Hi .. I'm working on a web using Zope as my application server, now would like to integrate WAP tecnology, any know if this is possible Monti

5 6

Postgres and BLOBS
by Yves Bastide 30 Apr '02

30 Apr '02

On Saturday 27 April 2002 03:48, Colin Fox wrote: > Hi, everyone. > > I need to be able to store binaries (PDFs, JPEGs, etc) in postgres > tables and embed them in web pages. > > The idea is I have entries in the database and there is an image to go > with each entry. > > Postgres supports BLOBs, but there is a somewhat awkward interface to > using them (you have to actually extract the blob to a file on disk). > > I was wondering if anyone had created an object (simlar to the Zope > image object) that would let me reference binaries in the database > without having to do local file manipulation? PostgreSQL supports two sorts of blobs: lo and bytea. lo is the old, kludgy interface, whith a few advantages over bytea; most notably one can retrieve parts of a blob. And many well-known disadvantages. Bytea corresponds to the (really minimal) standard SQL blob interface. Micro-howto: Using a bytea (what follows is a quick slash-and-paste from an app here; may work or not as-is): Say you've got a "File" table: create table File ( id serial primary key, fname text, mimetype text, content bytea); Inserting a file ---------------- From a form with a "file" input: ## Script (Python) "doInsFile" ##bind container=container ##bind context=context ##bind namespace= ##bind script=script ##bind subpath=traverse_subpath ##parameters=fichier ##title= ## from psycopg import Binary container.insertFile( fname = container.REQUEST.file.filename, mimetype = container.REQUEST.file.headers['Content-Type'], content = Binary(container.REQUEST.file.read()) ) With the insertFile SQL method: <params>fname:string mimetype:string content:string</params> insert into file (fname, mimetype, content) values ( <dtml-sqlvar fname type="string">, <dtml-sqlvar mimetype type="string">, <dtml-var content>::bytea ) For this to work, you must allow psycopg's Binary in a Product (see Products/PythonScripts/module_access_examples.py for instructions). Retrieving a file ----------------- The following query retrieves a file: <params>id:int</params> select fname, mimetype, octet_length(content) AS fsize, content from file where <dtml-sqltest id type="int"> It can be called by a Python script like: files=container.qryFichier(id=id) for file in files: RESPONSE.setHeader('Content-Type', file.mimetype) RESPONSE.setHeader('Content-Length', file.fsize) RESPONSE.setHeader('Content-Disposition', 'attachment; filename=%s' % file.name) if file.fsize: RESPONSE.write(fic.content) Misc. Remarks ------------- * When uploading a file, IE gives the full pathname while NS and Moz return the filename with no path (I didn't try Konqueror, Opera and others). You should sanitize "file.filename" before putting it in the DB, if you do. * Blob-access is totally DB-dependant.., even db-adapter-dependant. It's a PITA :-/ yves

1 0

no users can sign in!!!
by Roderick Silva 30 Apr '02

30 Apr '02

2 1

WedDAV: WriteLocks with MS-Office
by Thomas Guettler 30 Apr '02

30 Apr '02

MSWord seems to forget to release a webdav lock. The documents get locked but not released again. I read that this should have been fixed, but it seems that it has not been fixed. The Lock-Manager of the ZMI says: "No locked objects where found" The Undo-Tab looks like this: /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:54:25 PM /a/documents/9/Features2.doc/LOCK by guettler 2002-04-29 05:54:25 PM /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:38:08 PM /a/documents/9/Features2.doc/LOCK by guettler 2002-04-29 05:38:08 PM /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:37:05 PM /a/documents/9/Features2.doc/LOCK by guettler 2002-04-29 05:37:03 PM /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:36:54 PM /a/documents/9/Features2.doc/PUT by guettler The last actions is an unlock, thus it should not be write-protected. Is there a work-around? Versions: -Zope2.5b2 -MSWord 2002 thomas

4 3

Secure Database Access
by Ing Soc 30 Apr '02

30 Apr '02

Hi all, I'm in the process of designing a corporate website based on Zope, with a significant amount of content being corporate database driven. The corporate database system runs on Oracle. My main concern is taking the necessary security precautions to minimise the risk of unauthorised access to the corporate database. I'd like to describe here the approach I'm planning, and get some feedback on whether it is reasonable or not, and perhaps some pointers based on what other security-conscious corporate websites do. As a bit of background, the data we are dealing with relates to the world of corporate stock market investment, and so our database contains lots of information of a private and confidential nature. While we are not up there with banking institutions in terms of the level of security required, having the information altered or even simply accessed by unauthorised persons is not a pretty thought. Diagrammatically, the plan is the following. Each box represents a physically separate server machine or network appliance. INTERNET | (a) | ------------------------------- | Router/Packet Filter Firewall | ------------------------------- | (b) | -------------------------------------- | Front end Apache HTTP server (Linux) | -------------------------------------- | (c) | ------------------------ | Packet Filter Firewall | ------------------------ | (d) | --------------------------------- | Zope Application Server (Linux) | --------------------------------- | (e) | --------------------------------- | Internal Oracle Database Server | --------------------------------- (a) Blocks everything except HTTP/HTTPS to front-end HTTP server. (b) Internet accessible. HTTP/HTTPS ports only available. Proxy passes to internal Zope server through internal firewall. (d) Use SQL Methods and DCOracle2 to access corporate database. (e) Zope user severely restricted to particular read-only views of the database. Zope user will never have any write access whatsoever. Web-driven database updates will be programmatically driven with manual intervention (i.e., no automatic update path to the corporate database from the web) This plan seems basically sound to me, but I would like to bounce it off people who have already been through it all before, if possible. One thing in particular we were wondering is if any significant security gain could be had by replacing the Oracle database in the above diagram with a replicated database on another machine, which in turn gets fed from the corporate database. Our feeling is that this is overkill. Any thoughts, especially from experience, would be greatly appreciated! Thanks, Ing. __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/

2 1