- Zope - Zope lists

RE: dynamically assigning DB-connections to ZSQL-methods ?
by Frederic Quin 07 Jun '01

07 Jun '01

Hi, I meet the same problem... I had to execute the same query but on different databases located on different hosts... What I did to resolve my probleme : I created as many Zope Folder as I had DB Con objects. In each Folder, I put a different DB Con object and my Z SQL Methods. Instead of calling the Z SQL Method "sqlGetDatas()" like this : <dtml-in "sqlGetDatas()"> I call it like that : <dtml-in "myHost1.sqlGetDatas()"> If it based on a cookie, you can put in the cookie the name of the Folder containing the Z SQL Method to call. If all your "DB Folders" are in the Folder "DBCons", you just have to call the Z SQL Method "sqlGetDatas()" like this : <dtml-in "_.getattr( DBCons, myCookie['dbcon'] ).sqlGetDatas()"> I hope to be clear and helpfull, but I am not so sure... Frederic Quin #################################################################### I have to make some ZSQL-methods connect to different database-connections based on a cookie, but am experiencing a bit of trouble.. available DB-connections for a ZSQL-method are listed in a select-box only, not as a simple string , so it is troublesome just adding a python-script to return a DB-connection conditionally.... Have anybody done anything like this ? tips ?

1 0

Re: [Zope] Difficult question related to creating instances of
by complaw＠hal-pc.org 07 Jun '01

07 Jun '01

> "Ronald L. Chichester" wrote: > > > The bottom-line question is, can I make a list for an HTML list box with > > the contents of the folder that calls the addForm method? > > I found that the power of using ZClasses was in being able to > define a META TYPE. This gives you a lot of handling > capabilities in many situations. So instead of having one Zclass > with a boolean to select whehter it's an issue or a paradigm. I > would create two separate Classes. The overhead is pretty small > compared to what you get back in power. I am using two ZClasses. One for the paradigm (which has one set of properties) and another for the issues (with yet another set of properties). Both classes do different things. They are, however, related in that they reference each other. The question then becomes how to contain those references. One of the classes has to maintain a reference. Note, one issue can reference multiple paradigms. Each paradigm, in turn, may reference several issues. The reference-back (when viewing the paradigm) can be done (I think) through dtml by picking out those issues that contain the link to the paradigm in question. I wanted to adopt this technique because it is scalable and flexible. I could have created a set of classes with direct links (e.g., boolean properties that indicate whether a particular issue contains one of the paradigms. This would be fine for one subject (the subject being a set of paradigms and issues). However, I would have had to derive a whole new class for each subject. The method I'm trying to work out here would be flexible enough to work on mulitiple subjects without having to change/create a new product. All the content developer need to is pick the same product whenever he wanted to set up something like this. > > For the association part, your issue will need a lines property > that will contain the associated paradigm ID's. When you add an > issue and select the paradigms from the multi-select then your > form handler will have a list of paradigms to fill this property > with. > Correct. That is the goal. The problem comes on how to load the list of paradigms into the add_form/edit_form for the ZClass. > Do the paradigms available to an issue span mutiple folders or > are they all co-located? Yes. All of the paradigms and issues reside in the same folder (that is called a "subject" folder). In fact, we don't want to mix paradigms/issues with other folders. > The former gets pretty tricky and is > better implemented with a URL vs. just the ID. I would agree to that. Thanks, Ron

1 0

I'm missing something really basic
by Chris Ryland 07 Jun '01

07 Jun '01

I've been using Zope for a couple of weeks now fairly intensely, and learning fast. But then I run into the most obvious question in the world, and I'm stumped (perhaps it's too obvious). I've scoured the documentation, but I can't find it. So here goes. How does a dtml document refer to the URL parameters passed to it? E.g., I have a top-level index_html dtml method containing: <dtml-var standard_html_header> <dtml-var content fmt=structured-text> <dtml-var standard_html_footer> and a dtml document 'content' at each level in my tree with stx. So far, so good. But now I want to pass two parameters to one of these 'content' document, as in http://localhost:8080/about/news?product=Xdata?newstype=review I can't for the life of me figure out how to get those two parameters. They don't seem to be in the context, and they're only in the REQUEST in the raw parameter string (which I guess I could parse). Is it because this is a non-forms document that I don't get the parameters? -- Cheers! Chris Ryland Em Software, Inc. www.emsoftware.com

4 3

RE: [Zope] Major security flaw in Zope 2.3.2
by Ellis, Neil (FNB) 07 Jun '01

07 Jun '01

Sorry if I'm misunderstanding the current conversation. The difference seems to be that a Mailman user is only dealing with e-mail however a Zope user may be making purchases and therefore their password may be more sensitive. Many regards Neil Ellis > -----Original Message----- > From: barry(a)digicool.com [SMTP:barry@digicool.com] > Sent: 07 June 2001 15:29 > To: Joachim Werner > Cc: Jerome Alet; zope(a)zope.org > Subject: Re: [Zope] Major security flaw in Zope 2.3.2 > > > >>>>> "JW" == Joachim Werner <joe(a)iuveno-net.de> writes: > > JW> I am really not against encrypted passwords. DC should > JW> implement this soon. AFAIK the only reason for passwords not > JW> being encrypted yet was that the encryption modules needed > JW> were not available for all platforms or so. > > I'm coming in totally in the middle of this thread, and I only follow > this list tangentially, but I thought I'd comment w.r.t. my experience > in Mailman. > > One reason to keep passwords in the clear is to provide a mail-back > service when a user forgets his or her password. If you store them in > encrypted form, you can't really do this. (You could store > user-supplied hints and mail those back, but that doesn't seem to work > to well in my experience. I haven't seen any usability studies to say > whether that's a useful approach or not.) > > In Mailman, we keep user passwords in the clear so we can do the > monthly password reminders. However, the list admin passwords are > kept as a sha1 hash - not in the clear. That means that if a list > admin forgets his password, it's up to the site admin to assign them a > new password. So far, this has been a workable trade-off. > > We have the advantage that user passwords don't protect a highly > valuable resource; the worst that can happen is that they'll get > unsubscribed from a list. Bad, but not catastrophic. List and site > admin passwords are more valuable, so they affort a higher degree of > security (and necessarily, less convenience). > > Side note: Mailman doesn't -- by default -- have SSL for its login > pages, although I'm aware that some sites have augmented their Mailman > installations to provide this. It would probably be a good idea to > someday bundled this functionality. > > Cheers, > -Barry > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Re: Updating a ZCatalog within a DTML Method
by Nico Grubert 07 Jun '01

07 Jun '01

> Message: 9 > Date: Thu, 07 Jun 2001 11:02:38 +0100 > From: Nico Grubert <nico(a)beehive.de> > To: zope(a)zope.org > Subject: [Zope] Updating a ZCatalog within a DTML Method > > Hello, > > I was trying to update a ZCatalog within a DTML Method by using DTML and > I could not figure it out how to do it. > > I have the following structure: > > MyFolder > | > |--MyDTML_Method > | > |--MyCatalog > > within the DTML Method "MyDTML_Method" I would like to update the > "MyCatalog" using DTML so I do not need to go in the "Advanced" View of > "MyCatalog" and click the [Update] button. > > Any what DTML Code can do this ? > > thanks in advance > Nico > > ---------------------------------------------------------------- > nico grubert (education & publishing) nico(a)beehive.de > beehive elektronische medien GmbH http://www.beehive.de > phone: +49 30 847-82 0 fax: +49 30 847-82 29 > > --__--__-- > > Message: 10 > Date: Thu, 7 Jun 2001 11:02:16 +0200 > From: Oliver Bleutgen <myzope(a)gmx.net> > Reply-To: Oliver Bleutgen <myzope(a)gmx.net> > To: zope(a)zope.org > Subject: Re: [Zope] Updating a ZCatalog within a DTML Method > > > Hello, > > > I was trying to update a ZCatalog within a DTML Method by using DTML and > > I could not figure it out how to do it. > > > I have the following structure: > > > MyFolder > > | > > |--MyDTML_Method > > | > > |--MyCatalog > > > within the DTML Method "MyDTML_Method" I would like to update the > > "MyCatalog" using DTML so I do not need to go in the "Advanced" View of > > "MyCatalog" and click the [Update] button. > > > Any what DTML Code can do this ? > > You should find this information right in=20 > the source of the advanced page. > =46rom what I see there, it might work like > <dtml-call "yourcatalog.manage_catalogReindex()"> > > cheers, > oliver > > --__--__-- thank you, oliver. I had tried this before, within the DTML Method called "testUpdate" but <dtml-call "MyCatalog.manage_catalogReindex()"> brings me the following error: ---------------------------------------------------------------------------------- Error Type: TypeError Error Value: not enough arguments; expected 4, got 1 Troubleshooting Suggestions The URL may be incorrect. The parameters passed to this resource may be incorrect. A resource that this resource relies on may be encountering an error. For more detailed information about the error, please refer to the HTML source for this page. If the error persists please contact the site maintainer. Thank you for your patience. Traceback (innermost last): File C:\Programme\dev01_zope232\lib\python\ZPublisher\Publish.py, line 223, in publish_module File C:\Programme\dev01_zope232\lib\python\ZPublisher\Publish.py, line 187, in publish File C:\Programme\dev01_zope232\lib\python\Zope\__init__.py, line 221, in zpublisher_exception_hook (Object: Traversable) File C:\Programme\dev01_zope232\lib\python\ZPublisher\Publish.py, line 171, in publish File C:\Programme\dev01_zope232\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: testUpdate) File C:\Programme\dev01_zope232\lib\python\ZPublisher\Publish.py, line 112, in call_object (Object: testUpdate) File C:\Programme\dev01_zope232\lib\python\OFS\DTMLMethod.py, line 189, in __call__ (Object: testUpdate) File C:\Programme\dev01_zope232\lib\python\DocumentTemplate\DT_String.py, line 538, in __call__ (Object: testUpdate) File C:\Programme\dev01_zope232\lib\python\DocumentTemplate\DT_Util.py, line 334, in eval (Object: MyCatalog.manage_catalogReindex()) (Info: MyCatalog) File <string>, line 0, in ? TypeError: (see above) --------------------------------------------------------------

1 0

ZPyGreSQLDA
by Sherwood Robinson 07 Jun '01

07 Jun '01

Has anyone been able to compile ZPyGreSQLDA to run in windows? I use Cygwin but it keeps erroring when I try to compile it. Anyone? Below is the output I get when I try to compile it for Windows... If anyone with greater knowledge in this could help me figure it out that would be awesome. Of course it is using CYGWIN and the settings inside of that. So that would be the next step. To get it to compile with the Proper Python.... OUTPUT BELOW: gcc -DUSE_DL_IMPORT -g -O2 -Wall -Wstrict-prototypes -I/usr/include/python2.1 -I /usr/include/python2.1 -DHAVE_CONFIG_H -I/usr/include/postgresql -c ././pgmodul e.c -o ./pgmodule.o ././pgmodule.c: In function `pgconnect': ././pgmodule.c:694: warning: passing arg 4 of `PyArg_ParseTupleAndKeywords' from incompatible pointer type gcc -shared -Wl,--enable-auto-image-base ./pgmodule.o -lpq -lcrypt -L/usr/lib/ python2.1/config -lpython2.1 -o ./_pgmodule.dll Cannot export _bss_end__: symbol not defined Cannot export _bss_start__: symbol not defined Cannot export _data_end__: symbol not defined Cannot export _data_start__: symbol not defined collect2: ld returned 1 exit status make: *** [_pgmodule.dll] Error 1 I will also submit this to the Cygwin list..... TIA SR ---------------------------------------------------- Sherwood Robinson Hostmaster The Free Lance-Star/Internet Department srobinson(a)fredericksburg.com http://www.fredericksburg.com 616 Amelia St. Fredericksburg, VA 22401 540-374-5000 ext. 5657

1 0

manage_clone problems
by Jean-François Ménard 07 Jun '01

07 Jun '01

In my python product, I'm trying to copy some objects from one container to another. Both inherit from ObjectManager and CatalogAware. CatalogAware appear before ObjectManager. When I try to use manage_clone, I get: Traceback (innermost last): File D:\INTRAN~1\lib\python\ZPublisher\Publish.py, line 223, in publish_module File D:\INTRAN~1\lib\python\ZPublisher\Publish.py, line 187, in publish File D:\INTRAN~1\lib\python\Zope\__init__.py, line 221, in zpublisher_exception_hook (Object: RoleManager) File D:\INTRAN~1\lib\python\ZPublisher\Publish.py, line 171, in publish File D:\INTRAN~1\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: copieChampsActionsCMT) File D:\INTRAN~1\lib\python\ZPublisher\Publish.py, line 112, in call_object (Object: copieChampsActionsCMT) File D:\INTRAN~1\lib\python\Products\Excel2Explore\LigneCMT.py, line 61, in copieChampsActionsCMT (Object: RoleManager) File D:\INTRAN~1\lib\python\OFS\CopySupport.py, line 333, in manage_clone (Object: RoleManager) File D:\INTRAN~1\lib\python\OFS\CopySupport.py, line 444, in _verifyObjectPaste (Object: RoleManager) Copy Error: (see above) I found in the mailinglist archive that it would be a security problem. What are the security settings needed to enable copying of objects???? Any, any any ant help would be very appreciated... :) Thanks! Jeff

1 0

?? Z - Class Bug ??
by Eric Roby 07 Jun '01

07 Jun '01

I hesitate to cry 'wolf' when I am still new to the system. However, on the recommendation from Tres Seaver, I have submitted this to the bug-collector. My main motivation for posting it here (as well) is to see if anyone else has experienced similar behavior. The case boils down to this: New ZClasses DO NOT inherit the 'put' services of their base classes. IOW, an instance of a new class derived from ZDTMLDocument base (say) can be created TTW but CANNOT be (later) updated via FTP or WEBDav clients. FTP clients report file creation errors and WEBDav clients don't show that the instance exists. OR ... am I simply missing some implementation details W/R to the class composition. I have looked at other python products that define new document classes and they seem to have implemented their own 'put' services. Is this a detail that must be addressed when composing new classes TTW? Or, should I expect to inherit that service from the base classes? Any thoughts ... Eric

1 0

Python Script problems: attribute-less object (assign or del)
by Richard Ettema 07 Jun '01

07 Jun '01

Hi, I am trying to create a python script which gathers info from a sql database using get_items (a ZSQLMethod). The first thing it needs to do is if item.name is empty, give item.name the value of item.name2. I get the following error msg when running the complete script, Error Type: TypeError Error Value: attribute-less object (assign or del) the assignment of name2 to name is the problem but I don't understand why. Can someone point me in the right direction please. for item in container.get_items(): if item.name=='': item.name = item.name2 Thanks for your help Richard

2 1

Major security flaw in Zope 2.3.2
by Jerome Alet 07 Jun '01

07 Jun '01

Hi, first I'm sorry if this is a well known problem. Anybody who can read the file Data.fs (or Data.fs.old) can also do whatever he wants on your ZODB. explanation: it seems that Zope 2.3.0 and 2.3.2 store passwords in clear text in the ZODB !!! The following is only partially tested, but should work: Say someone has a local unix account on your Zope server (don't know for NT, but I think the problem is still there), and has readonly access to the Zope/var/Data.fs file. Then he just installs Zope on his own machine, and put the stealed Data.fs file there, and use the emergency user facility to access to it. Then he just have to put an External method in the root which does: --- CUT --- for username in self.acl_users.getUserNames() : user = self.acl_users.getUser(newusername) clearpassword = user._getPassword() # do something with username/clearpassword --- CUT --- The user has now a list of username/passwords to access YOUR ZODB's root from everywhere, and can do whatever he wants. Setting rw------- permissions on Data.fs may help, but not in all cases: if Data.fs is owned by nobody.nogroup, Apache is installed on the same machine, and the user can run his own cgi-scripts (most ISPs I suppose), then by default the user's CGI scripts will run as nobody too, allowing him to read Data.fs during his own CGI execution, and copy it wherever he wants during this time. Solutions: * make Data.fs and Data.fs.old only readable by a user every other user on the system can't run commands as. * But the best to do is: Encrypt all passwords in the ZODB. hoping this helps. bye, Jerome Alet

8 10