- Zope - Zope lists

Authentication tutorial
by Marc Ende 09 Apr '02

09 Apr '02

Hi there, does anybody know a good tutorial about the authentication mechanisms of the zope? I've got a site up and running, but I wan't to add some features, where I need user-authentication. (Sorry I'm a newbee on zope) marc

2 1

ZEO - VHM - ZCatalog and absolute_url
by Eric Roby 09 Apr '02

09 Apr '02

This is actually a couple of questions rolled up into one since they are related (in the context of the site configuration). We are on Linux with Zope 2.5.0 and the latest version of ZEO. The setup works fabulous except for the following items. Curiosity (1): Currently, ClientStorage-1 is answering to www.bla.bla.gov. ClientStorage-2 is used for the ZMI work. We have a class of document that is catalog aware. When these doc objects get messed with on ClientStorage-2, the absolute_url Metadata property in the Catalog always points to ClientStorage-2 (on all ClientStorages). So when someone kicksoff a search on ClientStorage-1 (www.bla.bla.gov) the result set returns a list that points to objects on ClientStorage-2. I can go into the catalog on ClientStorage-1 and re-build the indexes and everything is as it should be (with respect to the result set pointing to objects on ClientStorage-1) but as soon as any doc is messed with, the absolute_url for that doc will (again) point to the object on ClientStorage-2. Curiosity(2): Now, add to this a VHM in the root (we are also virtual hosting multiple sites from this setup) with a mapping for www.bla.bla.gov/blaFolder. Everything works as advertised until I hit the ZCatalog result set again. The absolute_url Metadata in the catalog does not reflect the mapping set up in the VHM. It exposes the IP address and logical path to the object. I have scoured both pipermail and NIP archives with no success. The docs tell me the VHM and absolute_url are suppose to play nice and they do until I get to ZCatalog. The docs don't say anything regarding ZEO/ZCatalog interaction. Anyone seen or dealt with this scenario before??? Thanks in advance for any insight... Eric

3 2

Printing a zwiki page
by Michael Montagne 09 Apr '02

09 Apr '02

Is there a method out there to effectively print a wiki page? I'd like to put some office procedure docs in a wiki. They'd need to be printed easily. I'd also need to select a bunch to print if required, but that sounds much more difficult. -- Michael Montagne montagne(a)boora.com http://www.boora.com

2 3

Re: [Zope-dev] [RFClet]: What about the request method and the client side trojan?
by Oliver Bleutgen 09 Apr '02

09 Apr '02

Brian Lloyd wrote: >>[proposal of dissallowing GETs for management methods] >>The win would be that disabling javascipt would make a client save from >>this form of attack, AFAIK, OTOH I can't think of anything which would >>break ATM. >> > > While I don't necessarily disagree about making GETs idempotent, > this still doesn't make you "safe", even with JS turned off. Ahh, idempotent, that word escaped me ;-). > > A quick example: images can be used as form submit buttons. If > I can get you to visit a page and click on my innocent looking > image... you're done :) Ok, I wasn't clear enough. What I proposed would at least give the browser implementors a chance to remedy the problem (e.g. ask before form submission etc.). Compare your scenario to that where one just needs to write <img href="http://victimserver/evilmethod"> > > This is hard, hard, problem. While some good ideas have been > proposed, there is not really a quick fix that doesn't have > some downside that some group somewhere considers a > showstopper :( I consider what I wrote really not the most sophisticated idea around, more something in the line of disabling unneeded servers on a unix machine. But I also don't see how it could be a showstopper for any scenario. No pain (barring modification of methods, which could be done step by step), some gain ... sounds good to me. cheers, oliver

1 1

Mysql user auth products?
by Paul 09 Apr '02

09 Apr '02

Hi, I am looking for a product that will allow me to do user authentication and authorization from a mysql database. My primary needs here are stability as this will be going into a production environment. Does anyone have any experience of these kinds of products and would they recommend any? I am using zope 2.5.0 btw. Thanks Paul.

3 3

textindex: no numbers appears
by Stephan Abele 09 Apr '02

09 Apr '02

Hello zope-specialists, i have the following problem: First, I have created an Zcatalog object. Then, I cataloged some objects. The title-Field is indexed with the type TextIndex. Sometimes, the title of the objects contains only numbers. The problem: If the title contains only numbers, the index is empty. title=123 => no value in the index title=123abc => the value is indexed. Question: What is wrong? What have I to do, to index titles which contains only numbers? Have I to patch some *.py-files? Have I to use a speciall package? Because I am a zope-Newbie, every help will be welcomed, Stephan Abele abele(a)wlb-stuttgart.de

3 2

cookie authentication and virtual hosting
by J�lio Dinis Silva 09 Apr '02

09 Apr '02

Hi, I've been searching for a cookie authentication product virtual hosting aware, i.e, when setting a cookie the product sets the domain part in a explicit way. I tested CookieCrumbler and CookieUserFolder but this ones define the domain part implicitly, i.e, because the setCookie function doesnt set the domain part it uses for the domain part the domain of the site "where you are". What I was looking for was something that uses the came_from var of CookieCrumbler to define the domain part. Anyone knows a cookie authentication product with handlers for the "domain" part of the Response.setCookie method? I know there are some patchs to take care of the "path" soo I was looking if someone had the need to patch the domain part due to virtual hosting setups/handlings. See you, Julio Dinis Silva _________________________________________________________________ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx

1 0

DTML woes (again)
by Matt Gregory 09 Apr '02

09 Apr '02

I have a namespace structure where I am trying to create a portlet template. The namespace (described below) will contain many portlats with varying content but much of the same format. portlets |_billingpayerinfo |_aetna |_insurance |_anotherportlet In the portlets namespace, I have the following dtml method object: <dtml-let includeDir="'billingpayerinfo'" includeFile="'aetna'"> <dtml-var expr="_[includeDir][includeFile]"> </dtml-let> Where includeDir and includeFile are meant to be passed by any links inside of any of the portlets. For instance consider the following link: <a href="/portlets/portlet_template?includeDir=billingpayerinfo&includeFile=aet na">Aetna</a> The problems abound, but at the moment it's formatting the html in Aeta instead of just returning it as html in the template. Any suggestions on how to fix that?

1 1

faster navigation with sorted content-list-property?
by Elena Schulz 09 Apr '02

09 Apr '02

Dear List, the NFGnav-product and most navigator solutions that I know (including my own ones) loop over the content of folders on every page-hit. If there are several additional dynamic navigation-elements like dropdown-lists, breadcrumb-navigators etc. there is a lot of timeconsuming looping for every page-hit. With a sorting-feature it will be even worse. Wouldn´t it be better i.e. faster to store the sorted-content of the folder in a list-property that changes whenever a document or folder is added to that special nav-folder so that different nav-methods can collect the same static content-info? May be someone uses this kind of nav-folder already? Does anybody have some comments or hints about that? Thanks a lot, Elena

2 1

RE: [Zope] Squid, SQLSession and caching
by Schmidt, Allen J. 09 Apr '02

09 Apr '02

Thanks. I probably is a squid thing. I failed to mention we are on ZEO with a bunch of clients and have squid setup with a redirector so a hit on our dotcom name will jump to one of the clients for the request (www1.dotcom, www2.dotcom, etc.). We are thinking now that maybe the cookie that SQLSession sets is setting itself with the www1.dotcom domain name and subsequent requests may or may not be resolved by that original (sub)domain. I found a ZEO client that is NOT behind squid and its redir and it functions as is expected. So, more clues but no real solution yet. It will work for some users but for general site browsing where we want to add session stuff, something else will have to be worked out. Allen -----Original Message----- From: Maik Jablonski [mailto:maik.jablonski@uni-bielefeld.de] Sent: Tuesday, April 09, 2002 10:22 AM To: Schmidt, Allen J. Cc: zope(a)zope.org Subject: Re: [Zope] Squid, SQLSession and caching On Tue, 09 Apr 2002 10:04:30 -0400 "Schmidt, Allen J." <aschmidt(a)nv.cc.va.us> wrote: > A hard refresh (IE5.5) > will set it back but another refresh does it again! Back and forth. > Sometimes it will hold for a few links (to generate views from ZSQL methods) > and then switch back again. > Too much? Not enough detail? Could it just be a Squid-induced thing? hi, maybe it's a squid-problem... snip from squid.conf says: # TAG: ie_refresh on|off # Microsoft Internet Explorer up until version 5.5 Service # Pack 1 has an issue with transparent proxies, wherein it # is impossible to force a refresh. greetings, maik. -- maik jablonski http://www.sachunterricht-online.de universitaet bielefeld http://www.zfl.uni-bielefeld.de zentrum fuer lehrerbildung tlph://+49.(0).521.106.4234

1 0