- Zope - Zope lists

Security question concerning DTML Method
by oliver.erlewein＠sqs.de 18 Apr '02

18 Apr '02

Hi Zopistas I've got a question whether this is the correct behaviour... I give somebody the right to add "Documents, Images and Files" and don't give him the right to "Change DTML Method". Then I login as that user and I get DTML Method in the drop down list(already peculiar) and when I select it I can create a DTML Method AND upload a file to it!!!! Although when I try to change the DTML Method then I get a login window asking me to login (That's OK). So I can't change anything afterwards but I can upload what I want. This is somehow a quite drastic security breach in my humble opinion. Maybe it would help splitting the Add Right in three parts?! Regards Oliver Oh and if someone needs the exact information please contact me and I'll send it but it's a little too much for the maillist. ;-))

2 1

Tasking System
by Todd Loomis, DMSO (SAIC) 18 Apr '02

18 Apr '02

All: Does anybody know of a system that can be used within zope to keep track of task. Thanks, Todd

3 2

Re: Zope Users and Roles
by Felipe E. Barousse B. 18 Apr '02

18 Apr '02

Juan Pablo: You need to create the roles at the "root" or "test" level (in your example). For that role "db_user", at the level where you created, get into the security tab and check the following permissions: Access contents informations Use Database Methods View And uncheck the "Acquire permission settings?" column. (Hope I didn forget any other important ones) At "insert_field" for the VIEW permission: uncheck the Acquire permissions column, and check the "db_user" column which is the role you created above. Still, take care of the Anonymous role's properties, as it allows anyone to access certain properties; for instance I'd uncheck it also at the insert_field VIEW permission, as indicated above. This should work. The problem seemed that you only adjusted the view property for the role, not the required "Access DB methods" and "Access contents information" which are required -at least those two- for the security scheme to properly work as you need. Hope this information helps. Felipe Barousse Boué Bufete Consultor de México - Piensa Technologies. www.piensa.com >Message: 8 >From: Juan Pablo Romero <jpablo(a)perl.ajusco.upn.mx> >To: zope(a)zope.org >Date: 17 Apr 2002 14:24:59 -0500 >Subject: [Zope] Users and Roles > >Hi! > >I have a little problem with user managment: > >/test/ > modify_db (zsql method) > insert_field (page template) > acl_users/ > fred (a user with the role 'db_user') > > > >I want to allow access to 'insert_field' only to users bearing the >'db_user' role, so I created such role in the root folder. > >Then I checked 'view' property in the 'db_user' column (within >'security' tab from 'insert_field'), and also unchecked the same >property in the 'Acquire Permission ...' column. > >According to the manual, when a client attempts to view >/test/insert_field, zope should allow access to user 'fred' (because he >has the 'db_user' role), right? > >In my case zope keeps asking for login/password. > > >What could be wrong? > > >Thanks in advance. > > > Juan Pablo

2 1

RE: [Zope] Tasking System
by Schmidt, Allen J. 18 Apr '02

18 Apr '02

Thanks for the info. I have been looking at f2w Helpdesk just now. We have everything needed to put it into place so may go that way for a test. We'll keep Roundup in mind, though. Thanks Allen -----Original Message----- From: Larry Price [mailto:laprice@efn.org] Sent: Thursday, April 18, 2002 12:51 PM To: Schmidt, Allen J. Cc: 'abg(a)comco-inc.com'; zope(a)zope.org Subject: RE: [Zope] Tasking System On Thu, 18 Apr 2002, Schmidt, Allen J. wrote: > We are looking for an issue tracking system. Will take any and all > suggestions!! > Looking for something that anonymous users can add issues to for resolution. > Admins would delegate tasks to those on our staff. Registered users could > add/modify/delete tasks or assign to others with a trail documenting the > process. Upon completion of an issue, an email would be generated to the > user initiating it. Sounds like more of a helpdesk package now. > > The URL link to the product from the link below does not work. Wanted to > take a look, but.... > I've been in the same boat recently and finally found Roundup, http://roundup.sf.net It's written in python, has a zope frontend and an email interface that works, it uses a hand-crufted bsddb backend and the html templating is slightly less than self-explanatory, but it's easy to modify. http://www.efn.org/~laprice ( Community, Cooperation, Consensus http://www.opn.org ( Openness to serendipity, make mistakes http://www.efn.org/~laprice/poems ( but learn from them.(carpe fructus ludi)

1 0

metaflow versus dcworkflow
by Antwan Reijnen 18 Apr '02

18 Apr '02

Hi, can anyone enlighten me on the need of another workflow-product like metaflow? Is there something wrong with dcworkflow? I find the latter perfect for my needs, and it seems it has more features and expandability than metaflow. So why not concentrating on putting more effort in dcworkflow if you miss something in it, instead of developing a new procuct? Greetings, grumpy.

4 4

import threading.Lock --> unpickleable
by Thomas Guettler 18 Apr '02

18 Apr '02

I was told that it is possible to syncronise several zope-request with methods from the python library. But it is not that easy: If you try to add a threading.Lock() instance to a python class you get: Error Type: UnpickleableError Error Value: Cannot pickle objects This means, you have to store it in an volatile attribute. I tried it like this. But this hangs if I delete the object which has the Lock as_v_lock instance. def acquireLock(self): print "StollDMS.acquireLock" lock=getattr(self, "_v_lock", None) if not lock: self._v_lock=threading.Lock() lock=self._v_lock lock.acquire() def releaseLock(self): # acquire() should have been called # about one second before. This means the volatile lock # should still be there print "StollDMS.releaseLock" self._v_lock.release() Any ideas? thomas

1 1

Users email
by JesusAvila＠apb.es 18 Apr '02

18 Apr '02

Hi there, When I want to add a new user to a CMF site, the attributes the interface ask me to fill in are: - Name - Password - (Confirm) - Domains - Roles There is anyway i can add more attributes to each user i create, such as the email address, contact number, ... Basically what would be great is that if i could create a profile for each user. At the moment i just need to add the email address, but in the future i will need to add a profile to each user. Thanks a lot. Jesus

3 2

RE: Authentication Problem
by Dianne Van Dulken 18 Apr '02

18 Apr '02

Sorry to reply to my own email, but I have gotten a little further, and was hoping someone might be able to help with more details. What is happening is that it is losing the AUTHENTICATED_USER On the logged_in section, if I remove the redirect, and show AUTHENTICATED_USER, it comes up perfectly as tester1 If I put back in the redirect, it reverts to ANONYMOUS USER. Does anyone have any idea why this would happen? Is it something to do with the configuration settings? Thanks a lot! Di > Hi there, > > I am having a little trouble with a synced portal between dev > and QA. On development, I can log in beautifully using the > login_form. It goes to my logged_in page beautifully. > > On the new QA site, it gets as far as the logged_in section, > but doesn't seem to recognise that it has been logged in. As > soon as it moves through to the admin homepage, it redirects > back to the login. > > Does anyone know what causes this? I've been searching > through the archives, but can't find anything that matches > both instances. I thought it might be a problem with the > cookies, but they seem to be very similar > > On dev: > > __ac_name > "tester1" > ozepayzope.qa.ozemail.com.au/ > 0 > 2934247040 > 29558135 > 1491665840 > 29484710 > * > > > On QA: > > __ac_name > "tester2" > 203.108.77.197/ > 0 > 1714181632 > 29558133 > 3983437728 > 29484707 > * > > Could anyone give me a hint as to what it might be? > > Thanks! > > Di >

3 2

Groupware
by Todd Loomis, DMSO (SAIC) 18 Apr '02

18 Apr '02

All: I need something that will allow some sort of tasking list along with a message board. This will be used by many different groups so I'll have to create on for each. Does anybody know of anything that might fit my needs. Thanks, Todd

2 1

MetaFlow
by Andreas Heckel 18 Apr '02

18 Apr '02

Is anybody out there who tryed to follow the tutorial "Using MetaFlow" on zopemag.com ? After reading the paper I thought MetaFlow is what I'm looking for. It is installed on Zope 2.5.0b3 (binary release, python 2.1, linux2-x86), python 2.1.1, linux2) The code is quite clear. The documentation is exemplary. But it simply doesn't work :-( My Session: create a MetaFlow Object in ZMI (Workflow) -> add two state (public,private) -> try to delete one of them (public) -> ERROR: BadRequest:addImage does not exist -> add two Transition (publish,hide) -> try to set any property of a Transition -> ERROR: KeyError: destination -> try to create a MetaFlow File (MyFile) WorkflowDefinition:Workflow -> ERROR: WorkflowError: no initial state in workflow Workflow Yes ... i read the doc about the initial state but where can I set it on ZMI ? -> give up in frustration -> went home not to write a more flaming post ;-) Michel ... that's not the way promoting Zope as a professional tool. Regards Andreas Heckel andreas(a)easyleading.org

1 0