- Zope - Zope lists

WedDAV: WriteLocks with MS-Office
by Thomas Guettler 30 Apr '02

30 Apr '02

MSWord seems to forget to release a webdav lock. The documents get locked but not released again. I read that this should have been fixed, but it seems that it has not been fixed. The Lock-Manager of the ZMI says: "No locked objects where found" The Undo-Tab looks like this: /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:54:25 PM /a/documents/9/Features2.doc/LOCK by guettler 2002-04-29 05:54:25 PM /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:38:08 PM /a/documents/9/Features2.doc/LOCK by guettler 2002-04-29 05:38:08 PM /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:37:05 PM /a/documents/9/Features2.doc/LOCK by guettler 2002-04-29 05:37:03 PM /a/documents/9/Features2.doc/UNLOCK by guettler 2002-04-29 05:36:54 PM /a/documents/9/Features2.doc/PUT by guettler The last actions is an unlock, thus it should not be write-protected. Is there a work-around? Versions: -Zope2.5b2 -MSWord 2002 thomas

4 3

Secure Database Access
by Ing Soc 30 Apr '02

30 Apr '02

Hi all, I'm in the process of designing a corporate website based on Zope, with a significant amount of content being corporate database driven. The corporate database system runs on Oracle. My main concern is taking the necessary security precautions to minimise the risk of unauthorised access to the corporate database. I'd like to describe here the approach I'm planning, and get some feedback on whether it is reasonable or not, and perhaps some pointers based on what other security-conscious corporate websites do. As a bit of background, the data we are dealing with relates to the world of corporate stock market investment, and so our database contains lots of information of a private and confidential nature. While we are not up there with banking institutions in terms of the level of security required, having the information altered or even simply accessed by unauthorised persons is not a pretty thought. Diagrammatically, the plan is the following. Each box represents a physically separate server machine or network appliance. INTERNET | (a) | ------------------------------- | Router/Packet Filter Firewall | ------------------------------- | (b) | -------------------------------------- | Front end Apache HTTP server (Linux) | -------------------------------------- | (c) | ------------------------ | Packet Filter Firewall | ------------------------ | (d) | --------------------------------- | Zope Application Server (Linux) | --------------------------------- | (e) | --------------------------------- | Internal Oracle Database Server | --------------------------------- (a) Blocks everything except HTTP/HTTPS to front-end HTTP server. (b) Internet accessible. HTTP/HTTPS ports only available. Proxy passes to internal Zope server through internal firewall. (d) Use SQL Methods and DCOracle2 to access corporate database. (e) Zope user severely restricted to particular read-only views of the database. Zope user will never have any write access whatsoever. Web-driven database updates will be programmatically driven with manual intervention (i.e., no automatic update path to the corporate database from the web) This plan seems basically sound to me, but I would like to bounce it off people who have already been through it all before, if possible. One thing in particular we were wondering is if any significant security gain could be had by replacing the Oracle database in the above diagram with a replicated database on another machine, which in turn gets fed from the corporate database. Our feeling is that this is overkill. Any thoughts, especially from experience, would be greatly appreciated! Thanks, Ing. __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/

2 1

Re: [Zope] dtml-tree and leaves
by Anthony Baxter 30 Apr '02

30 Apr '02

>>> Pascal Samuzeau wrote > Hi, > > Ok, maybe you're right, but have you another way to do the same > ? In the general case? no. But it's almost always better to write something to solve the particular problem you've got, rather than the general case. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0

News turning up on the frontpage of Zope.org
by Gitte Wange 30 Apr '02

30 Apr '02

Hello, As the version 1.0 of my product is very close I was wondering how I could get a news item to turn up on the front page of the zope.org website ? Also - will the message go automatically to the Zope-Announce list ? I have tried to create news item with other releases - but they didn't turn up on the front page even after they were reviewed ... TIA, Gitte Wange

2 1

dtml-tree and leaves
by Pascal Samuzeau 30 Apr '02

30 Apr '02

Hello, I want to use of dtml-tree to get what there is in a folder and subfolders, with a method pass in leaves. For this I've this architecture : !-Root !-------+Folder A !-----------+Folder B !-----------+Folder C !-------+Folder D !-----------+Folder E !-----------------index !-----------------dtcontent !-----------------dtcTemplate !----index !----dtcontent !----dtcTemplate When I try to do Root/Folder D/FolderE/index, with code in index as : <dtml-tree PARENTS[-1].Folder A branches="objectValues" leaves="dtcTemplate"> I got the content with the template of Root/dtcTemplate. So, How can I write to tell to leaves to get the dtcTemplate in Folder E ? I have tried some, but every time the acquisition gives me first the Root/dtcTemplate. Sincerily PS -------------------------------------------------- Oreka ! Nous sommes l'internet moins cher ! Surfez 25% moins cher avec http://www.oreka.com

2 2

Re: [Zope] Secure Database Access
by oliver.erlewein＠sqs.de 30 Apr '02

30 Apr '02

Hi Ing. Well for one thing don't open the HTTP Port use only HTTPS!!! Lock FTP and WebDAV access within Zope. Use the longest SSL-Cert you can find! If it's really crytical the you can also use x509 certs-per-user. For more details on that check up on M2Crypto. With the Domains option in Zope (acl_users) you can do things like write access only from IP Range 192.168.xxx.xxx and readonly from all external access. But beware when using Apache with Proxypass. Then you need the additional Packet Proxy_Via because the IP Adresses don't get routed through. Regards Oliver Erlewein

1 0

Re: Secure Database Access
by ingsocdoubleungood 30 Apr '02

30 Apr '02

Apologies for the formatting of my previous email. It was not like that when I previewed it. Ing

1 0

Re: [Zope] Q: Zope and chat
by Bill Bell 29 Apr '02

29 Apr '02

Hi, Ed: Thanks for responding. Now you have me wondering what the client-side code does. I also wonder how your architecture compares with that of Tony Sjogren's "Online Status Indicator," which is written in Java. Bill *********** REPLY SEPARATOR *********** On 4/29/2002 at 4:29 PM Ed Colmar wrote: >HI bill. > >I am working on something to provide this functionality... but it requires >some python code to be run on the client's end. Won't work with regular >browsers. > >-ed- > > >----- Original Message ----- >From: "Bill Bell" <bill-bell(a)bill-bell.hamilton.on.ca> >To: <zope(a)zope.org> >Sent: Monday, April 29, 2002 2:29 PM >Subject: [Zope] Q: Zope and chat > > > >Could someone please point me toward code, or discussion, about how to >detect whether a given person is available on-line for chat? I'd simply >like to offer chat on my web page whenever the visitor happens to visit >when I'm actually online. > >Thanks! > >------------ >"It is the time that you have wasted for your rose that makes your rose so >important."--St-Exupery > > > > >_______________________________________________ >Zope maillist - Zope(a)zope.org >http://lists.zope.org/mailman/listinfo/zope >** No cross posts or HTML encoding! ** >(Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) ------------ "It is the time that you have wasted for your rose that makes your rose so important."--St-Exupery

1 0

How can I list our folders and files?
by Leo 29 Apr '02

29 Apr '02

Hello, I'm creating a website by Zope for our staff. Each staff should have its own folder in the machine. I want to make a page which will automatically list out all subfolders and files for that user after they login. I cannot figure out how can I do that, by python? or dtml? Please help. Leo

2 1

Faster ZCatalog Searches (better? Optimized?)
by BZ 29 Apr '02

29 Apr '02

Now that one of my ZUBB boards is over 5,000 messages I am noticing where some of the slowdowns are. In my tests I have found that it is the <dtml-in statement and cycle that is bogging things down. In taking a look at Zope.org search through their ZCatalog they use a different code: ZUBB: <dtml-in "searchResults(in_reply_to=[''])" size=batch_size reverse sort=id start=query_start> Zope.org:  Is one better than the other? Is there something else that could be slowing down these searches? Thanks, BZ

4 4