- Zope - Zope lists

Re: [Zope] Zope security management
by Dario Lopez-K�sten 23 Mar '01

23 Mar '01

[Sorry - may mailer cheated on my. Once more ] This is not in Zope yet, I am working on making it so Here's how I do it in PLSQL: Two steps: 1) the form action element calls the login method using https:// <form method="post" action="https://...../mts2.login"> This is not necessary however, you could still use <form method="post" action="mts2.login"> because 2) The login method checks to see if it is called from a valid port. This is the first statement in the method (or procedure as it is called in plsql-ish): begin -- check if we are secure if not wutl.is_ssl then raise ssl_not_used; end if; Here is the is_ssl procedure: function is_ssl return boolean is current_port varchar2(5); begin -- is_ssl returns true if the port number of the call is from valid ports -- SSL uses 443 as standard -- use cgi environment variable: SERVER_PORT = 443 current_port := owa_util.get_cgi_env('SERVER_PORT'); if NVL(to_number(current_port), 0) in (443) then return true; end if; return false; -- if null or not eq SSL_PORT end; Now in Zope we have access to more info than I have with the PLSQL WebToolikit. Besides using the Server Port, I could also look att the URL, the Server URL and some more elements in the REQUEST object, and whatch for URL:s that begin with "https:". What I am not sure about is how this would work with Apache running as a Proxy. Anyway; this works for me in the PLSQL things I run, and makes sure that the requests I accpet in my programs are used only with SSL in known ports. This of course assumes knowledge that I actually run SSL on the specified ports. /dario ----- Original Message ----- From: "Bill Welch" <bill(a)carbonecho.com> To: <zope(a)zope.org> Sent: Thursday, March 22, 2001 8:16 PM Subject: Re: [Zope] Zope security management > Please share with us how you make sure that the login form can only be > used over SSL. > > Bill. >

1 0

Virtual Hosting configuration for Zope
by Alan Capesius 23 Mar '01

23 Mar '01

I've put together the following solutions for virtual hosting of domains and I'm looking for some feedback from the list. The solution uses TinyTable, Virtual Host Monster and AccessRule and a DTML method to process all inbound requests by domain name similar to the way in which SiteRoot script things. The best part is that once set, the AccessRule does not need to be modified to add new hosts. Host to folder mapping is performed via entries in the TinyTable, the rest of the configuration is static. I would think it would be simple to implement something like this as a product, though it is beyond my current skill set. I'd like to enhance it a bit further so that it can handle hostnames in addition to just domain names. I'd also be happy to hear any feedback on this. Tested with Zope 2.3.0 and TinyTable 0-8-2. Virtual Host Monster and AccessRule support are built into 2.3.0 Here it is: Create a folder in Root called VHosts Inside VHosts create a folder for each Virtual host Inside each new Virtual host's folder , create a Virtual Host Monster called VHM Inside VHosts, create a TinyTable called HostsTable Give the Tiny Table the following columns : domain, folder Create records for domain to folder mapping as shown here: "domain1.com", "Folder1" "domain2.com", "Folder2" Where the domain names are the virtual names for your server and the folder names are the folders created inside VHosts. Entries are CASE SENSITIVE and MUST match the folder names created in the earlier step. Enter all domains in lower case. Inside VHosts create the following DTML Method: Name: gethostfolder <dtml-in "VHosts.HostsTable(domainname)"> <dtml-return folder> <dtml-else> <dtml-return "'NULL'"> </dtml-in> In the Root, create a DTML called AccessRule AccessRule in Root Folder =================== <dtml-let hostname="_.string.split(_.string.lower(_.string.split(HTTP_HOST, ':')[0]),'.')[-2:]" domainname="hostname[0] + '.' + hostname[1]" vhmcode="VHosts.gethostfolder(_.None, _, host=domainname)"> <dtml-if "vhmcode<>'NULL'"> <dtml-if "_.string.split(_.string.lower(PATH_INFO), '/')[-1:]==['manage'] or _.string.split(_.string.lower(PATH_INFO), '/')[-1:]==['manage_main'] or _.string.split(_.string.lower(PATH_INFO), '/')[-1:]==['manage_workspace'] "> <dtml-if "TraversalRequestNameStack[-2:]<>[vhmcode,'VHosts']"> <dtml-call "REQUEST['TraversalRequestNameStack'].extend([vhmcode, 'VHosts'])"> </dtml-if> <dtml-else> <dtml-call "REQUEST['TraversalRequestNameStack'].extend(['VHM', vhmcode, 'VHosts'])"> </dtml-if> </dtml-if> </dtml-let> It should look like this: Root- AccessRule VHosts- HostsTable gethostfolder Folder1- VHM index_html Folder2- VHM index_html Security Settings: gethostfolder method: no anonymous access, proxy as manager, manager has full rights. HostsTable: No anonymous access, manager full rights AccessRule: Proxy as manager Now, to enable the system, Use the Root folder's Add->SetAccessRule option and enter "AccessRule" (without quotes) and click Set. Requests for domain1 will be drawn from Folder1, 2 from 2 etc.. Managent of the virtual domain will show only the VHosts folder contents for the selected site. Management of the root site will show the root. Access to unsupported domains will fall back to root. (perhaps to be a redirect to a 404 page in the future) Display the mappings with /VHosts/HostsTable or via the management interface. Use http://hostname/_SUPPRESS_ACCESSRULE/manage to deactivate the AccessRule if you have any problems accessing the system. All feedback welcome. To the list please. Alan Capesius, MCSE Tech World, Inc. http://twsite.bizland.com/zopetips.htm

4 5

DTML-tree and frames.
by Rubinstein Fredrik 23 Mar '01

23 Mar '01

Hi there. I want to create an website on which I split the screen with a narrow left side in which there will be an dtml-tree function and a wide right side. When a user clicks on a expandeed leave on the left side I want to display information on the the wide right side. However it seems that I can not get the frames stuff to work. Are there any suggestions or examples out there ? With kind regards. Fred PS. Still an Zope Newbie

1 0

Thoughts on <dtml-in ...> and related matters
by The Famous Brett Watson 23 Mar '01

23 Mar '01

I'm relatively new to Zope, and so unfamiliar with all the issues that this might raise, but here are my thoughts on the dtml-in "sequence-item" issue. It seems that what we have here is a specific instance of a general problem: dtml variables which aren't readily accessible in Python because they use identifiers that aren't valid in Python. In the first instance I would suggest a policy of making built-in dtml names Python-compatible. There seems to be a lack of consistency in the naming conventions which would benefit from this anyhow. Yes it's true that renaming any variable like this can impact on already-written programs, but that's true of any change to the namespace. I've also noted that there is a large amount of confusion amongst Zope newbies when it comes to the differences between the dtml any Python namespaces -- understandably so. Even if you can understand what a namespace is, what a context is, that there is a difference between Python and DTML in terms of these concepts, and how acquisition works in general, it's still damn hard to figure out exactly what identifiers are valid and associated with what object in these circumstances. If anyone has a good tutorial on the matter, please point me to it. As someone who is familiar with programming language theory but new to Zope, I often find myself asking "WTF is in my namespace now?" And there seems to be a high number of questions relating to how to fetch dtml-accessable objects in Python. A smoothing out of these differences would be beneficial to all, I think. Finally, with regards to the idea of tying sequence-item and related variables to other names (such as foo-item, bar-item, etc), I would anticipate this being done by creating a loop control variable with properties. For example, one could have the following. <dtml-in mylist using="foo"> Key: <dtml-var foo.key>; value: <dtml-var foo.item> </dtml-in> This could be introduced as a *new* syntax for the dtml-in tag, such that omitting the "using" attribute causes the old sequence-* suite of variables to be used. This should obviate any issues with namespace pollution: the programmer declares the new variable (and thus namespace) to populate. Presumably the variable can also be declared in a way that makes it directly-accessable in Python, too. Like I say, I'm not familiar enough with Zope to know if all this is viable, but it's the kind of behaviour that I'd go looking for if I thought it existed. Regards, TFBW

1 0

Re: [Zope] Zope security management
by Karl Anderson 23 Mar '01

23 Mar '01

"Phil Harris" <phil.harris(a)zope.co.uk> writes: > I agree with the fact that why bother with MD5 when SSL is available, > however not everyone using Zope has that capability available to them. Everybody who uses one of the free secure Apache servers has SSL available to them; is this not the case for other servers that Zope can run behind? > For instance, I've recently seen a posting on slashdot.org where some people > are questioning the pricing of SSL certificates, these people are living in > Asia where the price of certificates equates to a few months salary. That Slashdot discussion unsurprisingly only said half of the story. SSL certs are free; becoming your own certificate authority and signing your own certificates is free, and even documented by mod_ssl. I have a personal zope site that protects BasicAuth with SSL, and I didn't pay for any bits. The only reason to pay for a CA to sign your cert is to have that CA vouch that the cert is yours; Netscape accepts those certs without a dialog box. There's probably other advangates, like insurance, as well, I dunno. But thats what the official CAs provide; it's not Zope's job. This doesn't address the original problem - if you allow nonsecure authorization to a page, eventually someone will forget to access it via SSL and will send the password across in the clear. That's a valid point. Personally, I'm paranoid that my browser or proxy will send my credentials without being asked for, which IIRC they are allowed to do; so once I send credentials to my site, I always use SSL for other URLs. This is annoying, but wouldn't client certificates solve this problem? -- Karl Anderson karl(a)digicool.com

4 5

RFC: eks -- extended kde2-soho-server and zope-soho-server
by Olaf Zanger 23 Mar '01

23 Mar '01

hi there, the preface: this RFC is written with the great work of the open-source-community as a whole as well as the overwhelming efforts of the single participant in mind. what is more, these ideas base on the very fact that this community with its unique development model can create what was unthinkable only few years ago. the idea grew basing on the linux-(kernel)-slogen "world domination". the name: "eks -- enhanced kde2-soho-server" (eks: as in german for drinking the whole glas of beer at once and derived from "exchange" which eks shall survive :-). the background: one of the major oportunities of open source (os) is the extra value that is created by combining several different os projects and integrating it into a "added value product". the value of integration is one of the good reasons why home-servers (adomo), digital video recordors (tivo) and other gadgets are based more and more on linux. integration -- the idea: call the kde2 desktop ready for prime time, add the ideas of yahoo-services (calendar, notes, addressbook, email), think .NET and "hailstorm" and you end up with knowing that "desktop" is now but tomorrow is integrated and mobile computing. lets take the upper buzzwords and available os-technologies to cook up a recipe. the ingredients: kde2, koffice, kpilot, python-scripting, zope/php/perl, mysql/pgsql, soap (in gnome known under soup by ximian), suse/mandrake and the os-wap-server. extend some current developments and come up with some new things. with eks kde2 data are stored in a os-database. the typical kde2 app may be python scriptable. koffice saves through a kio-slave in a database-file-system. zope/php/perl makes all this stuff accessable by internet/intranet and mobile-phone through www/wap. the picture: 1. kde2 bases on data in files for kmail, kab, kalender and all the others. this is great stuff for a single desktop. in a network (in the living room, small office, home office) these data can be moved to the server easily using smb or nfs. it is not so easy to keep pdas and laptops in sync. 2. now "kde2-soho-server" functionality gets added to the server. a "soho-application-server" might be wanted. 3. to allow a higher degree of integration of kde2 data (e.g. specific addressbook entries and grouping to be used in kugar, rekall, kapital, ...), data and files may move into a mysql/pgsql database of the added "kde2-soho-server". since soho has little money this best happens automatically. 4. the zope/perl/php based "soho-application-server" provides base functionality of the main programs (though functionally slower and with less features) to use all the data through a browser in the intranet and internet without the need of kde2 beeing installed on a specific device. now all company or household data is accessible through kde2 locally, the web worldwide, wap and embedded qt mobile. the added value: single click "kde2-soho-server" setup. fast migration from workstation-centric data to mobile-network data. powerfull base for further business logic development with scripting language (e.g. python) and internet data-access. huge extra market for kde2 deployment. killer application for kde2-desktop. the work: there is heaps, but thinking of at least five different image viewers and comparable situation in mp3 players there might be the one or the other programmer beeing happy to jump on the wagon. 1. projects to be started: define location for content (pic-, movie-library, database name and structure), krystal (graphical editor for kugar xml files). 2. in early stages: kproject, mymap, gud (zope-http-organizer), sql-ledger (perl-http-cash) 3. beta: rekall, kde-db, kapital, pgp integration, karm-kapital-korganizer integration 4. more features: kapital (soho-features [as in quickbooks], database adapter) 5. (kio-)database access: afaik none of the current koffice components does support database sources. 6. www-content: make Zope GUD (Grand Unified Desktop) and Zope CMF (Content Management Framework) compatible to the datastructures and file-formats (xml) of kde2 now in the databases. Zope basic rendering of kword, killustrator, kpresenter, ... xml data. 7. multimedia: any os-streaming of content to www-terminals or mobile phones around? 8. sync: sync-ml support throughout kde2 (with the database in mind :-) 9. scripting: python support throughout kde2. 10. development: support of the noted capabilities through kdevelop, kde-studio, blackadder (mainly the scripting), kde2-python language bindings?. 11. other issues: don't know anything about wap server. the setup: suse and mandrake would have additional buttons called "kde2-soho-server" and "soho-application-server". the first part would ask for all the valid information to set everything up in the first place. the second would add access through browser-only devices intranet/internet. the vision (a more than normal office day for the envisioned kde-lady): 1. she gets a email of a new client and adds the vcard to the company database by single mouseclick. after approval of client data by the assistant the client gets its password by crypted email. 2. amazed about the fast setup he orders some products in the online shop. 3. kapital already provides the address out of the database. the billing for the client is approved by sales staff. a bill is generated through kugar. a version is faxed through hylafax, one is printed for the backup record and one is sent by encrypted email. 4. after a long day finally at home kde-lady notices, that she does not have the mobile number of this cute new client. but she doesn't want to miss his invitation to this slick soiree at a new gallery. 5. so she accesses the company addresses through the soho-application-server to get the mobile number of the client. btw she figures from the timetracker that she has more than enough overtime to add some private time to the calendar for tomorrow morning. 6. in a integrated internet service she finds easily the address of the gallery. 7. after a great evening the morning is hard. but at work she receives a voice mail. kde2 plays the stream. the accountant of the cute client really appreaciated the fast billing. this way the expense can be part of this financial year :-). the disclaimer: 1. in case any ideas are already beeing realised or have been realised by os please notify me. why don't you tell the world what has to be done to make those two buttons appear in the distros :-). 2. this was hacked together at 1:30am. there was no major effort for spell checking and checking project names. 3. work: since i build up a own company currently i can't put software-development-effort into the eks. if wanted, i may be able to push the idea further for more details. i find it most interesting to fill the missing links between the great running projects of the developer crowds (like towing with zope/php and kde2/gnome in a common direction for added value). what do you guys think about putting such a topic to dot.kde.org? i read the latest outcry on the development list and wonder if visions that long are supposed to be on the development list or if there is an other place for that? as noted comments are requested and very much appreciated. Olaf M. Zanger the author: grew up with atari, mac and win. he worked in project management, windows soho-network administration and www-content. now he prefers kde2. currently he is developing internet application services for renewable energy systems. until now he has a second computer close by running the legacy windows stuff and to figure every day that a crashing kde2 app is better than a crashed win-system. -- Olaf Marc Zanger mailto:olaf.zanger@gmx.net

1 0

dtml-with this only broken?
by Ron Bickers 23 Mar '01

23 Mar '01

It seems that <dtml-with "this()" only> doesn't do what one would expect. My 'description' is still being acquired. I found in the mailing list that I can use something like <dtml-if "_.hasattr(aq_explicit, 'description')">, but why doesn't the with only work? _______________________ Ron Bickers Logic Etc, Inc. rbickers(a)logicetc.com

1 0

newbie: publishing/product relationship?
by Peter J. MASON 23 Mar '01

23 Mar '01

Following one of the howto's (September Update 2000 update of the Python Product ...", I've created an object which I think is "publishable". The article says it is but doesn't say how to do so (ie publish it). Instead it goes on to explain how you turn it into a "product", so to be managed by the Zope management interface. It seems that a "product" allows you to define a generic such product which the management interface allows others to create instances of. The example has one entering id, title, questions, etc. Is this a fair statement? In my case I don't want that property since the only instances I wish to admit will be ones defined in a (private) database. If you like, I'm seeking an RPC mechanism and wish to invoke methods on such instances only. Is "creating a product" what I really want to do, or can I stop short at at "publishing"? In the publish only case, what form of URL would people use to get at those methods? Admittedly one method will be a "create/add" but that is to create another entry in my private, non-Zope "database". Perhaps an [substitute favourite commercial database]-SQL type example might be similar if there is an example to refer to? -- Peter J. MASON, Principal Software Engineer Retriever Communications Pty Ltd Ph: +61-2-9006 8600 Fax: +61-2-9006 8605 Email: peter.mason(a)retriever.com.au Web: www.retriever.com.au

2 1

Permissions on ZClass
by Darin Lee 23 Mar '01

23 Mar '01

Zopistas, I have a custom set of ZClasses all living together in a product I have created (a news folder where authors can post articles and photographs) but something strange is happening with authentication. If an author logs in to the Zope site root and selects my News folderish object for editing purposes, I can determine the AUTHENTICATED_USER variable and all is well. Like so -- http://my.zope.site/manage However, If the author comes into my ZClass directly, the AUTHENTICATED_USER variable still reports that they are anonymous - even though they are authorized and able to access (however you can see their user name in the left frame). Like so -- http://my.zope.site/news/manage If they visit the site root and re-visit the news folderish object then AUTHENTICATED_USER is set properly and all is well. I need it to work becuase I'm using AUTHENTICATED_USER to determine who is writing the articles and binding that information to another ZClass which contains a photograph, biography information and other tidbits of info. I'm having some difficulty grokking Zope Permissions, so if anyone has any thoughts, I would greatly appreciate it! (I did read the permissions chapter in the ZB - but the mappings in ZClasses are still reeeeaaalllly fuzzi to me). My understanding was that AUTHENTICATED_USER should be set by the closest acl_users folder up the tree. Thanks in advance, -Darin

1 0

RE: How slow should dtml-var be? (was: RE: [Zope] Problems with *BIG* SQL queries)
by Alan Capesius 23 Mar '01

23 Mar '01

As am I As you can see from the code example I posted earlier, the HTML table is broken down into sub-tables which render very quickly (at least under Netscape) compared to a huge table with the same data. The code was: <dtml-var standard_html_header> <dtml-var "ZopeTime()"> <dtml-call "REQUEST.set('count', 0)"> <TABLE> <dtml-in allorders> <dtml-call "REQUEST.set('count', count+1)"> <dtml-if "count>100"> </TABLE><TABLE> <dtml-call "REQUEST.set('count', 0)"> </dtml-if> <TR><TD><dtml-var itemno></TD><TD><dtml-var desc></TD><TD><dtml-var datelastmn></TD></TR> </dtml-in> </TABLE> <dtml-var "ZopeTime()"> <dtml-var standard_html_footer> > > > ---------- > > From: Bill Anderson[SMTP:BILL@LIBC.ORG] > > Sent: Thursday, March 22, 2001 9:15:06 PM > > To: Capesius," Alan > > Cc: zope(a)zope.org > > Subject: RE: How slow should dtml-var be? (was: RE: [Zope] > Problems with * BIG* SQL queries) > > Auto forwarded by a Rule > > > On 21 Mar 2001 13:18:38 -0600, Capesius, Alan wrote: > > Let's clarify that here...large tables not lots of tables. > > As I showed in my earlier messages in the *BIG* thread, a large > table (31000 > > records) may take 15 minutes+ to render whereas the same data > parsed into > > 300 tables renders very quickly (seconds). > > > i believe Andy is referring to _HTML_ tables, not SQL tables ... > > > >>>rendered, for example lots of tables on Netscape. Your > > >>>example includes no > > >>>HTML so thats just an off the wall comment. > > > Bill > > >

1 0