- Zope - Zope lists

What's the best way to search a Zope site?
by Tony McDonald 23 Mar '01

23 Mar '01

Hi all, I guess the subject says it all, but I'd like some advice on how best to do the search thang. I've fiddled with Catalog in the past, but didn't really understand it. Most of our site is served from SQL databases, but we do have a considerable amount of content in DTML Methods and Documents on the site too. Our platform is Solaris, Zope 2.3.0-src and Python 1.5.2 TIA muchly, Tone. -- Dr Tony McDonald, Assistant Director, FMCC, http://www.fmcc.org.uk/ The Medical School, Newcastle University Tel: +44 191 243 6140 A Zope list for UK HE/FE http://www.fmcc.org.uk/mailman/listinfo/zope

2 2

some confusion on ftp security.
by Patrick 23 Mar '01

23 Mar '01

I was just wondering if there is a separate config file for the Medusa FTP server because it alows anonymous logins even when I have used the zope management interface to create a user say fgh who has the rights that would usually be given to the anonymous group. I even defined a matching group fgh and removed all rights from the anonymous group. The advantage is that the user can not see list or download any files but I was just suggesting that the user does not get a login prompt at all in the first place incase this user manages to find some way of exploiting the system.... (or have I missed something) Thanks. Patrick

7 12

newbie can't log out of zope manager?
by Peter J. MASON 23 Mar '01

23 Mar '01

It's my turn to climb the zope learning curve so apologising if this is boring ... I'm on a redhat 6.2 linux platform and have installed apparently OK to to run with Apache. My browser pointed at http://localhost:8080/manage gets me to the management tabs, and I created a user, but when I choose to "logout" using the button at top right I get "Authorisation failure. Retry?" on the screen and an invitation to reenter the admin password. How do I deal with this problem? I found one of the site documents which referred to a file and dir permissions on a SuSe linux system and have tried to be guided by it, but certain files (like "access") do not exist on my installation, so I'm untrusting. Can someone help me out please? -- Peter J. MASON, Principal Software Engineer Retriever Communications Pty Ltd Ph: +61-2-9006 8600 Fax: +61-2-9006 8605 Email: peter.mason(a)retriever.com.au Web: www.retriever.com.au

3 6

How do I force authentication?
by Jérôme Loisel 23 Mar '01

23 Mar '01

Hello! I am building a few Zope websites. These sites live as subfolders of my root zope install, in which I place common code. Those websites will be administered by non-technical people, so one of my main coding efforts is building alternate, easy-to-use admin screens. I have one snag now. I want a login page which has Zope authenticate visitors. I don't want to take them to the real admin screens, I just want to have Zope authenticate them. I initially did this by writing a simple DTML method, login.html, which is not viewable by anyone with a role other than anonymous. That worked fine for a while. That approach fails, however, when the user if defined in an acl_users folder which is lower in the object hierarchy than the login.html method. And that is the case for all my sub-site admins. I have gone around this so far by copying login.html to all subsites... But I am sure there is a better solution. Can anyone point me in the right direction? Thanks for listening. Cheers, Jérôme Loisel -- Jérôme Loisel Lévinux: GNU/Linux dans les communautés à Lévis

4 3

LoginManager newbie question
by Ludwig Weiss 23 Mar '01

23 Mar '01

Hi there, i got the loginmanager to run, but i would like to have a small login dialog on the frontpage, wich should consult the LoginManager to process the request. I cannot trigger the login process from outside the Manager. /folderX index_html (with login form) acl_users any ideas??? thanks in advance Ludwig

1 0

two questions
by Oliver Vecernik 23 Mar '01

23 Mar '01

Hi, I'm experimenting with Zope to deal with my new homepage. I've got two questions, maybe someone can help me. 1. Relative URL's I've got the following piece of code: <ul> <dtml-in expr="objectValues('Folder')" sort=sort_order> <li><a class="sidemenu" href="&dtml-absolute_url;"><dtml-var title_or_id></a><br></li> </dtml-in> </ul> I don't want an absolute_url but a relative url, but couldn't find any list in doc which variables are available. Can anyone give me a clue or point me the doc where to find it? 2. Static copy When I'm done with the development of my homepage I'd like to copy my pages to my ISP, but unfortenately he doesn't provide Zope. I don't need forms and my data rarely changes so I had the idea to make a static copy. I tried wget but had the following problem: if there are more links to another page on the same page (eg. navbar on top, and a sidebar pointing to the same item) I get two copies of the whole tree and even worse, with my navbar on top of the pages wget recursively tries to copy my pages forever. Has anybody a better idea? Oliver

2 1

Problem with passing <input type=hidden value='<dtml-var nbMenu>' name=nbMenu> from an external Method
by servel yannick 23 Mar '01

23 Mar '01

Hi all, Source code of SaveMenu.html <dtml-var "SaveMenu(REQUEST=REQUEST)"> Source code of the external method SaveMenu def SaveMenu(self, REQUEST=None): s="" i = 1 s = s +"<input type=hidden value='<dtml-var nbMenu>' name=nbMenu>" return s And here is the code returned when SaveMenu is executed: <input type=hidden value='<dtml-var nbMenu>' name=nbMenu> instead of value='<dtml-var nbMenu>' I should have value=(an integer) Is there an alternative solution to fix that problem? Many Thanks, Yannick

3 2

feature suggestion (aliases)
by tom smith 23 Mar '01

23 Mar '01

hi all This would be really really useful. An object type which just contained a reference to another object elsewhere in the system. It's main view would be, er, view (rather than edit) . It would behave like a Mac's alias or (I think) like a unix softlink. It's only purpose would be to make navigation of the management screens easier and quicker. It's only *other* purpose would be to avoid duplicating code that doesn't fit into the hierarchy. Of it's three purposes... cheers tom -- tom smith | tom(a)othermedia.com http://www.othermedia.com/blog tel 020 8541 5355 | fax 020 8541 5507 11 penrhyn road, kingston-upon-thames, london KT1 2BZ

3 2

Re: [Zope] Zope security management
by Dario Lopez-K�sten 23 Mar '01

23 Mar '01

[Sorry - may mailer cheated on my. Once more ] This is not in Zope yet, I am working on making it so Here's how I do it in PLSQL: Two steps: 1) the form action element calls the login method using https:// <form method="post" action="https://...../mts2.login"> This is not necessary however, you could still use <form method="post" action="mts2.login"> because 2) The login method checks to see if it is called from a valid port. This is the first statement in the method (or procedure as it is called in plsql-ish): begin -- check if we are secure if not wutl.is_ssl then raise ssl_not_used; end if; Here is the is_ssl procedure: function is_ssl return boolean is current_port varchar2(5); begin -- is_ssl returns true if the port number of the call is from valid ports -- SSL uses 443 as standard -- use cgi environment variable: SERVER_PORT = 443 current_port := owa_util.get_cgi_env('SERVER_PORT'); if NVL(to_number(current_port), 0) in (443) then return true; end if; return false; -- if null or not eq SSL_PORT end; Now in Zope we have access to more info than I have with the PLSQL WebToolikit. Besides using the Server Port, I could also look att the URL, the Server URL and some more elements in the REQUEST object, and whatch for URL:s that begin with "https:". What I am not sure about is how this would work with Apache running as a Proxy. Anyway; this works for me in the PLSQL things I run, and makes sure that the requests I accpet in my programs are used only with SSL in known ports. This of course assumes knowledge that I actually run SSL on the specified ports. /dario ----- Original Message ----- From: "Bill Welch" <bill(a)carbonecho.com> To: <zope(a)zope.org> Sent: Thursday, March 22, 2001 8:16 PM Subject: Re: [Zope] Zope security management > Please share with us how you make sure that the login form can only be > used over SSL. > > Bill. >

1 0

Virtual Hosting configuration for Zope
by Alan Capesius 23 Mar '01

23 Mar '01

I've put together the following solutions for virtual hosting of domains and I'm looking for some feedback from the list. The solution uses TinyTable, Virtual Host Monster and AccessRule and a DTML method to process all inbound requests by domain name similar to the way in which SiteRoot script things. The best part is that once set, the AccessRule does not need to be modified to add new hosts. Host to folder mapping is performed via entries in the TinyTable, the rest of the configuration is static. I would think it would be simple to implement something like this as a product, though it is beyond my current skill set. I'd like to enhance it a bit further so that it can handle hostnames in addition to just domain names. I'd also be happy to hear any feedback on this. Tested with Zope 2.3.0 and TinyTable 0-8-2. Virtual Host Monster and AccessRule support are built into 2.3.0 Here it is: Create a folder in Root called VHosts Inside VHosts create a folder for each Virtual host Inside each new Virtual host's folder , create a Virtual Host Monster called VHM Inside VHosts, create a TinyTable called HostsTable Give the Tiny Table the following columns : domain, folder Create records for domain to folder mapping as shown here: "domain1.com", "Folder1" "domain2.com", "Folder2" Where the domain names are the virtual names for your server and the folder names are the folders created inside VHosts. Entries are CASE SENSITIVE and MUST match the folder names created in the earlier step. Enter all domains in lower case. Inside VHosts create the following DTML Method: Name: gethostfolder <dtml-in "VHosts.HostsTable(domainname)"> <dtml-return folder> <dtml-else> <dtml-return "'NULL'"> </dtml-in> In the Root, create a DTML called AccessRule AccessRule in Root Folder =================== <dtml-let hostname="_.string.split(_.string.lower(_.string.split(HTTP_HOST, ':')[0]),'.')[-2:]" domainname="hostname[0] + '.' + hostname[1]" vhmcode="VHosts.gethostfolder(_.None, _, host=domainname)"> <dtml-if "vhmcode<>'NULL'"> <dtml-if "_.string.split(_.string.lower(PATH_INFO), '/')[-1:]==['manage'] or _.string.split(_.string.lower(PATH_INFO), '/')[-1:]==['manage_main'] or _.string.split(_.string.lower(PATH_INFO), '/')[-1:]==['manage_workspace'] "> <dtml-if "TraversalRequestNameStack[-2:]<>[vhmcode,'VHosts']"> <dtml-call "REQUEST['TraversalRequestNameStack'].extend([vhmcode, 'VHosts'])"> </dtml-if> <dtml-else> <dtml-call "REQUEST['TraversalRequestNameStack'].extend(['VHM', vhmcode, 'VHosts'])"> </dtml-if> </dtml-if> </dtml-let> It should look like this: Root- AccessRule VHosts- HostsTable gethostfolder Folder1- VHM index_html Folder2- VHM index_html Security Settings: gethostfolder method: no anonymous access, proxy as manager, manager has full rights. HostsTable: No anonymous access, manager full rights AccessRule: Proxy as manager Now, to enable the system, Use the Root folder's Add->SetAccessRule option and enter "AccessRule" (without quotes) and click Set. Requests for domain1 will be drawn from Folder1, 2 from 2 etc.. Managent of the virtual domain will show only the VHosts folder contents for the selected site. Management of the root site will show the root. Access to unsupported domains will fall back to root. (perhaps to be a redirect to a 404 page in the future) Display the mappings with /VHosts/HostsTable or via the management interface. Use http://hostname/_SUPPRESS_ACCESSRULE/manage to deactivate the AccessRule if you have any problems accessing the system. All feedback welcome. To the list please. Alan Capesius, MCSE Tech World, Inc. http://twsite.bizland.com/zopetips.htm

4 5