- Zope - Zope lists

RE: [Zope] ZServer ACL
by sean.upton＠uniontrib.com 21 Aug '01

21 Aug '01

Some suggestions, from practical experience: 1 - You want a firewall or router rule to block public access to 8080 on that box. Why not use NetFilter/IPTables to set this up on your Linux box, or for that matter, just set up a Cisco router ACL, which is even easier if you can? 2 - Bind Zope to an destination interface/IP with the -a option for z2.py a. If squid/apache runs on the same box, bind it only to loopback (very secure, but limits some remote admin functionality if you are not careful). b. If you need to, bind ZServer to a management network that is only accessed by the proxy and any private administrative clients. c. If you are really paranoid, segment proxy traffic onto its own network, and bind ZServer onto that network; then force your managment/admin traffic to go through the proxy or from localhost. 3 - Use squid; you will get much more powerful acls that will allow you to block certain pages as well as use acls to determine what is cached and not cached. You can do all sorts of ACLs, for that matter. You can also use a redirector both to rewrite URLs for VHM, and also rewrite blocked management URLs to internal URLs that only can be used on a private network (that is, if you are a bit paranoid). Squid is going to be faster anyhow. Squid also does a nice job round-robin load distribution to ZEO clients. 4 - If you are running ZEO, protect the storage server by keeping it on its own VLAN with a private IP. 5 - use squid ACLs for everything we need in the ACL department, including blocking ZMI access on the public interface(s) of the caching proxy. 6 - Keep our Zope/ZEO nodes on a private network behind Squid proxies to keep them out of 'public' internet view, and give them internet access via NAT on a firewall. Squid serves both a private and a public network, and the private network is less restricted, and you rely on host/application/Zope security beyond that. Sean -----Original Message----- From: Todd Hepler [mailto:thepler@caspiannetworks.com] Sent: Monday, August 20, 2001 5:32 PM To: zope(a)zope.org Subject: [Zope] ZServer ACL I'm relatively new to Zope and python. I have Apache with ProxyPass (port 80) set up on the same box as Zope with a VirtualHostMonster (port 8080). I want to make it so that clients cannot "go around" Apache and talk directly to port 8080, so I'm looking for a way to make Zope only accept requests that come from localhost (or a specified IP address). I can't find anything on zope.org related to ACLs of this nature or blocking access to ZServer based on IP address. Any ideas? I dug through the medusa and ZServer code, but the answer isn't jumping out at me. I'm running Zope 2.4.0 with python 2.1.1 on solaris 2.7. Why would I want this? (you might ask) To scale, I want to be able to turn on caching in Apache, or replace Apache with squid. This won't improve performance if the pages that come out of Zope refer directly to port 8080. The clients would end up "going around" the cache. I know there are ways to make Zope generate appropriate URLs and thus not go around port 80, but I'm not interested in those solutions here. Even those solutions won't stop someone from hardcoding a reference to port 8080 in one of their pages. I want to simply shut off access to it in the first place so that if someone even tries it, they fail. Thanks, -todd _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Zope 2.4 / DTML problem: With looping over two sets
by spex66＠yahoo.com 21 Aug '01

21 Aug '01

Hi there, maybe a newbie question... I try to dtml a cursor-object of an own python-database, swigged from a C-project (Gigabase). Actual the cursor-class has __getitem__ with throwing of IndexError. BUT: it has no real random access via index-number! its behavior is like this (a little bit simplifying): ... cursor.first() #get first position cursor[anyNumber] #if number == 0: return cursor.get() #else: cursor.next().get() #if next() has no result or number > len (cursor), or len(cursor)==0 the exception is thrown and a loop will stop ... so, a simple code-snippet cursor.first() for c in cursor: for r in c.rows: ...process something... works perfect for me! Now following DTML-code makes a unaccepted error (I've had very few accepted errors :-))... obviously the render-code access the cursor.__getitem__ method in second loop (-->c_item) again with static index-number! Bad for my stupid implementation, and not pythonlike where a loop in a loop works with an own loop-variable. I doesn't expect a continous __getitem__ with 'same' index-number, and I don't know how to workaround it on C-language-site first steps to program this page (and this is only the beginning!) the "classic" way, leads me directly to your mailinggroup and the urgent wink for help!!! I like the DTML way, and I want to use it! Anybody a tip or patch, workaround, whatever??? thanks a lot Peter (=PA=) : t = DocumentTemplate.HTML(""" <html><head><title><dtml-var expr="cursor.entityName"></title></head> <body> <dtml-if expr="cursor.__len__()"> <p>Die Suche ergab <dtml-var expr="cursor.__len__()"> Treffer! </p> <table> <tr> <dtml-in expr="cursor.rowNames"> <----- OUTER LOOP <th><dtml-var sequence-item></th> </dtml-in> <tr> <dtml-in cursor prefix="c"> <------ INNER LOOP <tr> <dtml-in expr="cursor.rowNames" prefix="r"> <td><dtml-var expr="c_item.__getattr__ (r_item)"></td> <---- c_item access my cursor again with __getitem__! instead of a loop-variable </dtml-in> </tr> </dtml-in> </table> <dtml-else> <p>Die Suche ergab keine Treffer!</p> </dtml-if> <p>Generated by Miracle</p> </body> </html> """)

1 0

What would it be your preferred basic Zope installation?
by Ausum 20 Aug '01

20 Aug '01

I'd like to have an idea of the most used products (therefore recommended) by the community, in order to try them anytime. Although maybe many of us don't need them yet, it's always a good idea to play around with the tools preferred by others, after getting to know how helpul they found them, associated to their features and particular use cases. I think I'm asking for an up-to-date product rating, and that's why the question is proposed as this: What products would include your preferred basic Zope installation? Thanks in advance, Ausum

3 3

Parsed XML - a casualty of layoffs?
by Brad Clements 20 Aug '01

20 Aug '01

I was wondering if Parsed XML work will continue soon or not. A few weeks ago I posted a note about permission mappings for a Parsed XML doc in a Zclass methods folder being reset every time Zope is restarted.. I'm curious if anyone in ZC has been assigned "ownership" of parsed XML so I can talk to them about it. Of course, the problem could be elsewhere I suppose. Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax netmeeting: ils://ils.murkworks.com AOL-IM: BKClements

4 3

finding the content_type of a subclass (phyton newby)
by Giuseppe Bonelli 20 Aug '01

20 Aug '01

Hi all, I made an archive of pdf files searchable through the catalog, but I have a small glich I cannot resolve myself. The PDFs are stored in the file system using the ExtFile product and I am using pdftotext and ExtDocument to get them indexed by the PrincipiaSearchSource. The code I use (better to say I borrowed ...) is the following: In ExtDocument.py [...] class ExtDocument(ExtFile): [...] def PrincipiaSearchSource(self): """Convert data to raw text (don't bother formatting)""" filename=self._get_filename(self.filename) if self.content_type == 'application/pdf': return popen('pdftotext -raw %s -' % filename).read() else: return 'abracadabra' In ExtFile.py [...] class ExtFile(CatalogAware, SimpleItem, PropertyManager): [...] def _get_filename [...] The problem is that any new instance of an ExtDocument get indexed in PrincipiaSearchSource as 'abracadabra', meaning that it is not recognized as 'application/pdf'; but when I update the Catalog the ExtDocument get indexed correctly! Someone has a clue ? TIA, --peppo

1 0

Help with creating a list of folders
by Todd Loomis 20 Aug '01

20 Aug '01

I'm trying to create a list of folders which to put into a form drop-down box. The folders to be shown are only the ones they has access to. I tried this and nothing happens: <select name="folder"> <option value="" selected>Select Folder</option> <dtml-in expr="objectValues('Folders')"> <option value="<dtml-var id>" selected><dtml-var title></option> </dtml-in> </select> Todd ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Todd Loomis Web Developer (SAIC) Defense Modeling & Simulation Office 1901 N. Beauregard Street, Suite 500 Alexandria, VA 22311 Office: 703.824.3407 Fax: 703.379.3778 tloomis(a)dmso.mil

3 2

RE: [Zope] problems with MailHost
by sean.upton＠uniontrib.com 20 Aug '01

20 Aug '01

If you are using Win2k, you could use the SMTP services in IIS, and set it up to relay off your MTA. You would, however, have to get the mail administrator for your company MTA to allow relay from your host, which is often disabled by default on some MTAs... If nothing else, you could set up another MTA on a different box or try some 3rd party MTAs for NT on your NT/Zope server; I wouldn't think it would be a problem as long as you could SMTP relay... Sean -----Original Message----- From: Robert Rottermann [mailto:robert@redcor.ch] Sent: Sunday, August 19, 2001 2:40 PM To: zope(a)zope.org Subject: [Zope] problems with MailHost Hi there, the ISP where my Zope Server is situated is using an MTA (Mercury 1.47 for Novell) that seams not to accept the mails generated by Zope's MailHost. It complains that the FROM: field is not valid. Now I have two questions: - Does anyone of you know a solution. - is there a mailserver (preferably in python) I could install on my NT box with which I can test what the difference between a Zope generated and a "normal" email is. Thanks for your help Robert www.redcor.ch don't mind my typos I see them neither _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

[OT] Apache TimeOut directive (was HTTP upload - filesize limit)
by Eric Walstad 20 Aug '01

20 Aug '01

Well, I have a couple of Virtual Hosts set up and I put the TimeOut directive at the top of the httpd.conf file (in the "global" area). This way, all the Virtual Hosts get the same TimeOut value. You may want to try putting a time out value inside each of the Virtual Host directives that you want to have a custom TimeOut. Note that I am a total Apache newbie, so this is just a guess. Maybe there's an Apache guru listening that will have some input. Good luck! Eric. > -----Original Message----- > From: Gitte Wange [mailto:gitte@mmmanager.org] > Sent: Monday, August 20, 2001 3:37 AM > To: eric(a)walstads.net > Subject: Re: [Zope] HTTP upload - filesize limit > > > On Wednesday 15 August 2001 20:33, you wrote: > > Hi Gitte, > > I'm replying off the mailing list because I just wanted to find out if > > increasing the value of the Timeout directive worked for you. > > Did it? Any other comments on it? I don't want to get bitten by this > > later on! > > Thanks, > > Eric. > > Hi Eric, > > I just had a chance to test the Timeout directive and it actually > works :-))) > > We have set ours for 7200 secinds because it's really bug files > people need > to upload ... > > I was wondering if I could do it for each virtual host I have ?? > Insted of doing it for every portal I have. Got any experience in this ? > > Regards, > Gitte Wange > > > > > > -----Original Message----- > > > From: Gitte Wange [mailto:gitte@babytux.dk] > > > Sent: Tuesday, August 14, 2001 2:08 PM > > > To: eric(a)walstads.net > > > Subject: RE: [Zope] HTTP upload - filesize limit > > > > > > > > > Hi Eric > > > > > > Where did you find this directive in httpd.conf ? > > > > > > because I couldn't find it :-( > > > > > > Gitte > > > > > > At 13:16 13-08-2001 -0700, you wrote: > > > >Hi Gitte, > > > >I am doing something similar and hadn't yet had any problems > with file > > > >size... > > > >So, I tried uploading a really huge file and sure enough, it > choked. I > > > >store the uploaded files on the filesystem with LocalFS. > When the file > > > >upload died, there was a tiny file on the file system with the > > > > > > name of the > > > > > > >file that I tried to upload. > > > >I did a bit of tweaking of Apache's TimeOut directive in the > > > > > > httpd.conf file > > > > > > >and found I can control when the file transfer will die by > changing that > > > >value. In general, the upload stops about 4 seconds (an *old* > > > > > > machine here > > > > > > >:) after the timeout time is reached. So, I'm assuming that > the TimeOut > > > > > > > >value just needs to be bumped up a bit, depending on what you > > > > > > perceive to be > > > > > > >a max file size and minimum transfer speed. > > > >I hope this helps. > > > >Eric. > > > > > > > >> -----Original Message----- > > > >> From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of > > > >> Oleg Broytmann > > > >> Sent: Monday, August 13, 2001 12:13 PM > > > >> To: Gitte Wange > > > >> Cc: Zope Mailing List > > > >> Subject: RE: [Zope] HTTP upload - filesize limit > > > >> > > > >> On Tue, 14 Aug 2001, Gitte Wange wrote: > > > >> > We are using apache in front of Zserver and ProxyPass to > > > > > > redirect to the > > > > > > >> > zope sites. > > > >> > > > >> Very probably, Apache is configured to limit size and > time; hence > > > >> it limits POST size. > > > >> > > > >> Oleg. > > > >> ---- > > > >> Oleg Broytmann http://www.zope.org/Members/phd/ > > > > > > phd(a)phd.pp.ru > > > > > > >> Programmers don't die, they just GOSUB without RETURN. > > > >> > > > >> > > > >> _______________________________________________ > > > >> Zope maillist - Zope(a)zope.org > > > >> http://lists.zope.org/mailman/listinfo/zope > > > >> ** No cross posts or HTML encoding! ** > > > >> (Related lists - > > > >> http://lists.zope.org/mailman/listinfo/zope-announce > > > >> http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

dtml-let vs. REQUEST.set
by McMains, Sean 20 Aug '01

20 Aug '01

I have a Z SQL Method I'm trying to call with user_id set to the name of whomever had been authenticated via Zope's authentication methods. If I use dtml-let to assign a value to the user_id parameter, I get an error. But if I use REQUEST.set to assign the value, it seems to work fine. I.e., if I try to build the user_id value with this code: <dtml-let user_id="REQUEST.AUTHENTICATED_USER.getUserName()"> I get this error: Error Type: Bad Request Error Value: ['user_id'] However, if I use this code to assign the value to user_id: <dtml-call "REQUEST.set( 'user_id', REQUEST.AUTHENTICATED_USER.getUserName())"> Everything seems to work fine. So, I've got a working version in the latter, but I don't understand why it works and the former doesn't. Can anyone lend any insight? Sean

2 1

Error packing Data.fs due to time problems
by andres 20 Aug '01

20 Aug '01

Hello, I'm having problems packing a Data.fs file under Zope-2.3.3. When packing is attempted it returns the message: Error Type: FileStorageError Error Value: The database has already been packed to a later time or no changes have been made since the last pack This is thrown by lib/python/ZODB/FileStorage.py Since we have made changes to the Data.fs the problem must be due to a "time" issue. In addition, we feel confident that it is not a system clock issue because we can pack other Data.fs files on the same machine. Using fsrecover.py gave us the message: "Nothing to recover" Anybody else encounter this problem? We can use the Data.fs but short of exporting all its contents to a new file, we would like correct this packing problem in situ. Andres Corrada-Emmanuel Internet Programming http://www.mamey.com

1 0