- Zope - Zope lists

Re: [Zope] Referencing Objects from id's stored in a lines property. -- Quick Update
by complaw＠hal-pc.org 16 Aug '01

16 Aug '01

I'm considering using a DTML document having a lines property that stores id's of related objects (i.e., objects where there is to be a user-defined relation). Essentially, the lines property would be a container of id's of objects available to the object having the lines container. I can load the id's into the lines property (that is easy). However, does anyone know of the DTML code needed to sequentially list each of the elements in the lines property (which is a Python list) and then call that object to obtain and then display the title corresponding to the object id? The following code works... <P>Here they are, one by one.<BR> <dtml-in cases> <A HREF="<dtml-var sequence-item>"><dtml-var sequence-item></A><BR> </dtml-in> But the above code only lists the id's, not the titles to the id's (which would be easier for the user to understand). I tried this... <P>Here they are, one by one.<BR> <dtml-in my_related_objects> <A HREF="<dtml-var sequence-item>"><dtml-var expr="getattr(sequence-item, 'title')"></A><BR> </dtml-in> .. but got a parsing error. Does anyone know what I did wrong? Is there a better way to do this? Thanks again, Ron

1 0

8080
by Brian Pribis 16 Aug '01

16 Aug '01

I have zope working fine, but I am curious as to how to set it up so that people don't have to type in the port number to get to the site? Right now they get a forbidden message if they don't use it. Am I missing something? Also, what docs can someone point me to in making Zope as secure as possible (or just words of advice). I had to install zope as root (zope of course made some things 'nobody'). Is this o.k.? I read a paper by someone that said it should be installed as a normal user. However, after going through all the steps he did, the installation failed in a bad way. Tanks brian-

3 2

Non-manager user administrators?
by Keating, Tim 16 Aug '01

16 Aug '01

I want to give certain users the ability to create, delete and change the password for users in general, without making full-blown managers. Anyone know of a way to do this? You can create a role and restrict its access to the acl_users folder, but since they can create users, they can just create one with the manager role and circumvent the whole thing. Am I stuck with creating a page that uses the Zope API to provide this functionality? Thanks for any input! TK

2 1

Help needed with External Script
by Chris Bruce 16 Aug '01

16 Aug '01

Please Help, I have the following python code as an external script. But when I run it, I get: Error Type: AttributeError Error Value: aq_base But if I comment out the line: obj.propertysheets.ppProperty.manage_editProperties(REQUEST) It works, but of course I have no properties set. Any ideas what the problems are?? Here is the dtml method: <dtml-var standard_html_header> <h2><dtml-var title_or_id> <dtml-var document_title></h2> <p> <dtml-var expr="consultants.ImportData ('PersonalProfile','ppEntry','importData',REQUEST)"></p> <dtml-var standard_html_footer> Here is external python code: import string import csv import Globals from Globals import HTMLFile from AccessControl.User import BasicUserFolder from OFS.ObjectManager import ObjectManager from OFS.PropertyManager import PropertyManager from OFS.SimpleItem import Item from AccessControl.Role import RoleManager from Acquisition import aq_base def importData(self, productName, className, fileName, REQUEST): zfile = getattr( aq_base( self ), fileName, None ) data = "%s"%zfile lines = string.split(data, '\n') p = csv.parser() results ="" for line in lines: r = p.parse(line) if len(r) > 0: results = results + r[0] + ' added.<br>' REQUEST.set('id', r[0]) REQUEST.set('name', r[1] + ' ' + r[2]) REQUEST.set('title', r[1] + ' ' + r[2]) REQUEST.set('expires', '1/21/2002') # REQUEST.set('title', r[3]) REQUEST.set('company', r[4]) REQUEST.set('address', r[5] + ' ' + r[6]) REQUEST.set('city', r[7]) REQUEST.set('state', r[8]) REQUEST.set('zip', r[9]) REQUEST.set('email', r[10]) REQUEST.set('website', r[11]) REQUEST.set('isConsultant', r[12]) intuitcert = [] if r[13]: intuitcert.append('Intuit Pro Advisor') if r[14]: intuitcert.append('Intuit Certified') if r[20]: intuitcert.append('Intuit Certified') REQUEST.set('intuitcert', intuitcert) REQUEST.set('phone', r[15]) REQUEST.set('fax', r[17]) if len(r[22]) > 0: REQUEST.set('expires', r[22]) else: REQUEST.set('expires', '01/01/1970') REQUEST.set('isAssociate', r[23]) REQUEST.set('isCertified', r[24]) product=self.manage_addProduct[productName] zclass=eval('product.'+className) obj=apply(zclass, []) obj._setId(r[0]) obj.propertysheets.ppProperty.manage_editProperties (REQUEST) self._setObject(r[0],obj,set_owner=0) return results Any help would be greatly appreciated. Thanks.

1 0

RE: [Zope] CoreSessionTracking-based LoginMethod for LoginManager
by Andy Gimblett 16 Aug '01

16 Aug '01

> > - The CST documentation mainly talk about CST as a way of tracking > > anonymous sessions, but I see no reason why it couldn't be used > > in this way too...? > > Well... one reason is that there is no failsafe access control on > session data objects (the token key is the only thing required to grab > hold of a session data object and all of its contents via DTML). Nuts - hadn't thought of that. > As a result, the data that is stored in a session data object would > itself need to be encrypted in some way for it to be "secured". > Encrypting it assumes some sort of shared key, so you're back to the > original problem with a layer of indirection. :-( OK... So how about the LoginMethod has the key as a property, defined when it's created (heck, even chosen at random and never visible to any user). Then the raw data from the SessionDataManager is useless, 'cos only the LoginMethod knows the key, but the LoginMethod can decode it and decide if they're logged in or not - right? Or am I missing something - is this still insecure? > Safe authentication is a hard problem. The sessioning machinery might > help in some way, but it's not an answer in and of itself. *nods* - I think I'd still like to use it, because it's a nice way to organise things. Putting any meaningful data on the client side gives me heebie-jeebies. Of course, I'm assuming that CST includes checks to guard against cookie-hijacking. :-) -Andy -- Andy Gimblett - Programmer - Frontier Internet Services Limited Tel: 029 20 820 044 Fax: 029 20 820 035 http://www.frontier.net.uk/ Statements made are at all times subject to Frontier's Terms and Conditions of Business, which are available upon request.

4 3

Roll Your Own vs GUF vs exUserFolder - Why is one better than the other
by Dario Lopez-Kästen 16 Aug '01

16 Aug '01

Hello! I would like to hear from people using GUF and/or exUserFolder and what they think of them, especially why they prefer on over the other, or opinions on why one is better than the other. I've been trying to understand how both products work and AFAICT the main difference is that exUserFolder provides user properties while GUF does not. GUF seems to be better at handling roles thn exUserFolder (in terms of being able to extract them from the database). Any comments insight, corrections of misconceptions are welcome. I need to have a working solution to our problem RSN and I want to use as much of Zope as possible. It won't be possible to solely rely on the zope sec mechanisms but if i can delegate to zope as much as possible it would be a big gain. The last and least desireable option would be to simply ignore the zope sec mechanisms and roll our own sec management. Thank you, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario(a)ita.chalmers.se ICQ will yield no hits IT Systems & Services

1 0

How to transfom an URI into an object (Python script) ?
by Gilles Lenfant 16 Aug '01

16 Aug '01

Thanks from a dead brained man !

2 1

URL Traversal help needed.
by jkinsley 16 Aug '01

16 Aug '01

Greetings.... Assuming I have: /folder/script What do I need to implement within script so that I can call http://www.mysite.com/folder/script/opt/subopt then be able to use opt and subopt within script. I would like opt/subopt to be split at the '/' and available as a tuple or a list. TIA, Jarrod

3 2

how to delete an object from python??
by Robert Rottermann 16 Aug '01

16 Aug '01

Hi there, I wonder how to delete an object from a python script. When I try oName = context.this().getId() f = context.REQUEST.PARENTS[1] f._delObject( oName ) I can not even save the script because zope complains that SyntaxError, Names starting with "_" are not allowed (_delObject). redirect to 'folder_delete' I can not use either, because it tries to call 'folder_contents' which is not possible at the point where I am. Thanks for any help Robert

2 1

Error Type: AttributeError Error Value: __hash__ ??
by Gustav Franzsen 16 Aug '01

16 Aug '01

Have application using LoginManager. Users log in (username and password). Data stored in Mysql. Some users get abovementioned error when attempting to log in, whilst others have no problem. No obvious discernable difference in data in database between users (those that work and those that don't). Not username/password entry problem either. What does this error message mean? Don't see anything in mailinglists on this. Don't know where else to look for this one! We're running: Zope 2.3.3 ZPatterns 0.4.3 LoginManager0.8.8.b1 mysql 3.23.31.win ZMysqlDA 2.0.6 MysqlPython 0.3.5 Using IE5.5 and Opera as browsers Thnx Gustav Franzsen Upfrontsystems Stellenbosch South Africa

2 1