- Zope - Zope lists

Re: [Zope] Error importing STX.zexp
by Tres Seaver 29 May '01

29 May '01

Luca Manini <manini(a)agenzialavoro.tn.it> wrote: > I've got an error (see below) while importing > > STX_Document-1.2.zexp > > taken at > > http://www.zope.org/Members/tseaver/STX_Document/STX_Document-1.2.zexp/view > > What's the problem??? See below. > I usually rename export files before importing (ex: STX.zexp),=20 > is that allowed? Yes. > By the way, while not putting a friendly OpenDialog=20 > in the import (export) form :-) * The only way to get that feature would be to use an '<input type="file" ...>' tag, which would cause the browser to actually upload the file. * Imports can *only* take place from the 'import' subdirectory of your Zope installation (actually, from either your INSTANCE_HOME or your SOFTWARE_HOME); they are specifically disallowed via browser upload, due to the security risk such uploads expose. * The widget prepends a directory path to the filename, which isn't wanted. > The object STX_Document does not support this operation =20 The object you are importing is a Product, and can only be imported into the '/Control_Panel/Products' container. I just now successfully imported it into a scratch 2.3.2 Zope. Hope this helps, Tres. -- =============================================================== Tres Seaver tseaver(a)digicool.com Digital Creations "Zope Dealers" http://www.zope.org

2 1

UserDB with cookies not working
by Kevin L 29 May '01

29 May '01

Hi, I have UserDB working successfully with standard basic authentication. But after going into the properties and switching to cookie authentication it does not work. Now when I try to access a propected page it just skips authentication and shows the page. And if I switch back to standard basic authentication then reload the page, it pops up a login dialog box. can anyone help? thanks much __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

1 0

ZClass 'UNSLICEABLE OBJECT' Error Value
by Eric Roby 29 May '01

29 May '01

I am trying to create specialized document classes that have unique propertysheets, methods, are CatalogAware and renderable via <dtml-var ...>. I have been able to successfully build a structured-text document class that meets these criteria, however, I am unable to build an HTML document class. If I try to use OFS:DTMLDocument or OFS:DTMLMethod as my base class, the ZInstance attempt throws a TypeError with a value of 'unsliceable object'. I have tried many variations on this theme and none were successful. I thought I had a handle on ZClasses but I am obviously missing something major. Note: not that this has anything to do with the above, but I can subclass OFS:File and OFS:Image with no problem. I am using Zope version 2.3.1 on a Win2K platform. Any hints, insight, direction, further-reading links would be greatly appreciated. Thanks in advance... Eric

2 2

Anyone want to help create a Zope site?
by Darin Arrick 28 May '01

28 May '01

I am creating a group called the Free Space Foundation. Well, it's not really a group, but a server which will allow people to collaborate on "open source" space-related items (software, hardware, engines, spacecraft designs, etc.) with the goal of helping individuals and small groups go into space. I'm running all sorts of server daemons on the machine, not the least of which is Zope. I'm not a computer newbie (14+ years experience, programming, HW & SW, support, network and server admin, Unix, NT, Linux, etc.), but I am a Zope and Python newbie, so I need some help. Is there someone who may be interested in donating some of their time and effort to helping build this site? I'm going to put in a lot of effort and time, but I'd like some Zope help to speed up that part of the process. No pay is involved; you'll probably want to get involved only if: a) you are a space advocate, or b) you're a Zope and Python freak. Or both. :-) If you know Perl, that would be a plus. Just drop me an e-mail at f r e e s p a c e f o u n d a t i o n @ y a h o o . c o m (remove the spaces first; I do this to bypass Yahoo! Groups' e-mail masking filter) Thanks. Ad astra! Darin Arrick freespacefoundation(a)yahoo.com __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

1 0

Subtracting 2 dates from each other
by Gitte Wange 28 May '01

28 May '01

Hello, I need to subtract to dates from each other. I have searched the archives but haven't found anything useful. Hope someone here could help me. Regards, -- ************************ Gitte Wange Jensen System Squid Developer MMManager Aps +45 29 72 79 72 gitte(a)mmmanager.org ************************

5 8

ZSyncer
by jimbo 28 May '01

28 May '01

Hi, I'm using it on win32. It seems that I still have to install file based products on the remote machines. ie the CMF and others. Nice product. Thanks, -Jimbo

3 3

Ways for putting contents into Zope
by Luca Manini 28 May '01

28 May '01

Hi, what options are there for putting contents into Zope. Let's say I want to use Zope to build an intranet where not specially skilled people (at least not "html" skilled people) has to author most of the site contents. Which approaches can I try? Options that came to mind are: 1) make "contributions" be higly structured (I mean to have many properties and less "free" text) so that I can produce the output like a DB report. 2) try to teach them some StructuredText. 3) try to have them use some other editor to produce "simple" html and import it into Zope. 4) have them put almost plain text and set up some sort to publishing work flow where the plain text get reviewed and edited in steps by different skilled people up to the "final" form? 5) Any experience, other ideas? TIA, Luca.

2 1

RE: [Zope] Re: ZEO Client space was:
by sean.upton＠uniontrib.com 28 May '01

28 May '01

Right: there is no box root exploit issue, but if the ODB has a method that connects to your RDB and flushes out a table, in a non-transactional rdb, you are screwed if someone can, from an arbitrary client do this sort of thing. Also, I would think that ZEO CS->ZSS type traffic would be best run on its own switched VLAN for security and performance reasons. Sean -----Original Message----- From: Jerome Alet [mailto:alet@unice.fr] Sent: Friday, May 25, 2001 11:16 AM To: Bill Anderson Cc: zope(a)zope.org Subject: Re: [Zope] Re: ZEO Client space was: On Fri, May 25, 2001 at 11:39:54AM -0600, Bill Anderson wrote: > > So, you give a user you presumably trust, ssh/ssl access to use ZShell. > They comment this code out, or the code that even botehrs to check for > permssion to do anything, and now they now '0WNZ Y0ur z0p3 sist3m'. Except that in this particular case the user would also have to have got filesystem write access to the Extensions directory and a Manager role in /Control_Panel in order for him to be able to comment out the code and restart Zope, because ZShell is currently an external method. Anyway I tend to agree with you, it shouldn't be possible to bypass the security mechanism. bye, Jerome Alet _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

3 2

RE: ZEO Client space was: [Zope] Prerequisites for a desktop IDE, or any desktop app w/Zope
by sean.upton＠uniontrib.com 28 May '01

28 May '01

This makes a lot more sense now; Your client just 'borrows' Zope security mechanisms, and uses them; your GUI platform is Zope with a new UI. In the case of an IDE, this makes sense. The security thing, though, is still a concern, because in a typical enterprise application, you want to be able to grant differing levels of trust and privileges to certain folks; and if they all access the same ODB, what (for example, in the case of an enterprise KM portal) prevents a clever user (let's say, a Python programmer in the company's IT dept) from being able to bypass the client security mechanism and get access to HR or payroll data that he/she is not supposed to see? You could do host-based security, use a firewall, and limit access in certain ways, but this still won't get you what you need. You could use encryption, but the issues are still the same. In most RDB-based client apps, a client libraries are set up on the users' machines by company IT staff, who set passwords for certain types of access; control over authentication mechanisms happens on a server, which is under control of a restricted group of people. I guess, if you are just looking for applications that access data and call methods written in Zope, XML-RPC would still be ideal, and have the security features that would be needed. There is another advantage to using XML-RPC: XML transactions can be brokered. Suppose we are trying to create a newspaper editorial CMS-like system, which stores news stories for different "desks" at a newspaper: ['news', 'features', 'sports']. You have a diverse web farm of 6 nodes, composed of 3 clusters ZEO clients (2 machines each, all nodes access a single ZSS); each of these ZEO groups handles content and databases for each "desk." All of these desks access content through XML-RPC from fat clients. In this case, we want to be able to create a single virtual server out of these; use a product like an Intel 7210 XML accelerator, and you can loadbalance+direct traffic to the correct server by creating some XPath queries of the request XML to see what database they are trying to access, or what method they are calling, etc. This would also allow us to speed things up and do things like authenticate stuff in the "sports" database off of one LDAP server set up for sports writers, and "news" off another. I understand that this wouldn't address parsing and marshalling latency, but it seems like a good way to have a big application with many GUI clients set up. I know that this way we don't have access to as rich of an object set, or acquisition, etc, but it seems like for most GUI apps, this would be a reasonable thing to give up (for the time being, at least) to have the flexibility and simplicity of using XML-RPC. So, some might ask the question: why create a client that simply treats Zope remote methods as a "dumb" data source? I'm not sure that a dumb transport necessarily makes for an unintelligent application; it just means the application is a little bit more autonomous from Zope (which could either be good or bad)... Sean -----Original Message----- From: Michel Pelletier [mailto:michel@digicool.com] Sent: Thursday, May 24, 2001 9:25 PM To: tim(a)freepm.org Cc: zope(a)zope.org Subject: Re: ZEO Client space was: [Zope] Prerequisites for a desktop IDE, or any desktop app w/Zope On Thu, 24 May 2001, Tim Cook wrote: > Michel Pelletier wrote: > > > XMLRPC could do this, but I'm afraid it would be seriously > > limited. XMLRPC is very useful, but it does not map as well as it could > > onto the python object model. I would prefer to see a GUI client running > > in the same process space as a ZEO client, this way the GUI client could > > do everything that Zope could do and re-use alot of the existing > > interfaces (like security, acquisition, script objects, etc). > > > > Michel, > I took this off list because it was off topic for the thread. But > feel free to Cc it back if you feel it's important. I think it > was covered a few weeks ago on the -dev list but couldn't locate > it. It's not off topic so I'm cc:ing the list. > Anyway, the question is: I thought I had read that using ZEO > basically by-passed the Zope security model? Maybe I was thinking > of direct ZODB access? This is a good question. Using ZEO does bypass the Zope security model, but then again, Zope bypasses the Zope security model. Zope is, essentially, a client that implements an application on top of a persistent database. Why can't your client do the same thing? Zope enforces security upon its users using tested, re-usable interfaces. You're should essentially change the user interface to the Zope core code by making it call wxPython widgets or whatever instead of spewing HTML to a browser over a socket. If this GUIfied ZEO client ran on the same machine as the server, it would actually be safer than a "real" Zope ZEO client, which is exposed to the web. We use ZEO clients to access Zope through many different interfaces, not necessarily all of them over a network, or running in a context we don't trust. We use ZEO clients to debug zope from the command line, to serve just FTP or a monitor server, and each different way of doingit is just a shim on top of the core Zope interfaces. By going with xml-rpc, you'll be shoving *very* rich interface semantics of a full blown windowing sytem down the tiny semantic straw of xml-rpc, to try and manipulate interfaces that were originally indented to be used by medium to poor semantic HTML interfaces. If you use a ZEO client, there are no bottle necks. You could render the object system in 3D OpenGL if you wanted to, and still enforce the user. Jerome's ZShell script shows how this can be done safely. His shell is essentialy just another interface to the Zope core code. It would be very dangerous if it did not use Zope's security API to restrict its actions. In zshell's case, the interface is really simple, a command line. It is probably not as safe to to grant access to this command line over unprotected networks. and it would be unsafe to expose a GUIfied ZEO client to unprotected networks, but this is easily mitigatable with things like ssh or ssl. -Michel _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1

Re: ZEO Client space was: [Zope] Prerequisites for a desktop IDE, or any desktop app w/Zope
by Michel Pelletier 28 May '01

28 May '01

On Thu, 24 May 2001, Tim Cook wrote: > Michel Pelletier wrote: > > > XMLRPC could do this, but I'm afraid it would be seriously > > limited. XMLRPC is very useful, but it does not map as well as it could > > onto the python object model. I would prefer to see a GUI client running > > in the same process space as a ZEO client, this way the GUI client could > > do everything that Zope could do and re-use alot of the existing > > interfaces (like security, acquisition, script objects, etc). > > > > Michel, > I took this off list because it was off topic for the thread. But > feel free to Cc it back if you feel it's important. I think it > was covered a few weeks ago on the -dev list but couldn't locate > it. It's not off topic so I'm cc:ing the list. > Anyway, the question is: I thought I had read that using ZEO > basically by-passed the Zope security model? Maybe I was thinking > of direct ZODB access? This is a good question. Using ZEO does bypass the Zope security model, but then again, Zope bypasses the Zope security model. Zope is, essentially, a client that implements an application on top of a persistent database. Why can't your client do the same thing? Zope enforces security upon its users using tested, re-usable interfaces. You're should essentially change the user interface to the Zope core code by making it call wxPython widgets or whatever instead of spewing HTML to a browser over a socket. If this GUIfied ZEO client ran on the same machine as the server, it would actually be safer than a "real" Zope ZEO client, which is exposed to the web. We use ZEO clients to access Zope through many different interfaces, not necessarily all of them over a network, or running in a context we don't trust. We use ZEO clients to debug zope from the command line, to serve just FTP or a monitor server, and each different way of doingit is just a shim on top of the core Zope interfaces. By going with xml-rpc, you'll be shoving *very* rich interface semantics of a full blown windowing sytem down the tiny semantic straw of xml-rpc, to try and manipulate interfaces that were originally indented to be used by medium to poor semantic HTML interfaces. If you use a ZEO client, there are no bottle necks. You could render the object system in 3D OpenGL if you wanted to, and still enforce the user. Jerome's ZShell script shows how this can be done safely. His shell is essentialy just another interface to the Zope core code. It would be very dangerous if it did not use Zope's security API to restrict its actions. In zshell's case, the interface is really simple, a command line. It is probably not as safe to to grant access to this command line over unprotected networks. and it would be unsafe to expose a GUIfied ZEO client to unprotected networks, but this is easily mitigatable with things like ssh or ssl. -Michel

4 3