- Zope - Zope lists

HowTo configure premissions for LoginManager?
by Johan Carlsson 07 Mar '01

07 Mar '01

I have just setup a LoginManager following the LoginManager with SQL and Skinscripts by dlpierson. Now I'm thinking about how to setup security for my LoginManager. At the moment it's very open for anyone who has DTML permissions on my lab server. Not so great. LoginManager has premissions set to: Manager --- All Anonymous --- "Access contents information", "Use Database Methods" "Acquire permission settings?" --- None Now, this is needed to allow Anonymous user to login. But it also makes it possible for a Anonymous to access the following DTML Method in the root folder: <dtml-var standard_html_header> <pre> <b>test.acl_users.getUser('a').username</b> <dtml-with test> <dtml-with acl_users> getUser('c').username: <dtml-var "getUser('c').username"> getUser('c').password: <dtml-var "getUser('c').password"> getUser('c').getRoles: <dtml-var "getUser('c').getRoles()"> </dtml-with> </dtml-with> </pre> <pre> <b>dtml-in "sql_getUserFor(username='c')"</b> <dtml-with test> <dtml-with acl_users> <dtml-in "sql_getUserFor(username='c')"> username: <dtml-var username> password: <dtml-var password> </dtml-in> </dtml-with> </dtml-with> <dtml-var standard_html_footer> Which returns (where there is a user named 'c'): test.acl_users.getUser('a').username getUser('c').username: c getUser('c').password: d getUser('c').getRoles: ['test'] dtml-in "sql_getUserFor(username='c')" username: c password: d Now the question is how (and where) should I configure permissions so LoginManager gets secured? TIA/Johan Carlsson

1 0

Re: [Zope] Solved: How to get the url without the domain...
by Ausum 07 Mar '01

07 Mar '01

No, Evan. I didn't and now I'm glad you've mentioned it. From now on I'll look for documentation within the methods at the python modules. The answer was at Application.py all the time. :) Now about urls parsed through getpath and <dtml-in>, and after looking at its correspondant Zcatalog.py module (where it isn't defined a "relative" argument), the remaining question would be this: Is there a short way to do the same thing, when using Zcatalog? Thanks a lot, Ausum >I missed the start of the thread; Have you tried "absolute_url(1)"? >Cheers, >Evan @ digicool & 4-am

1 0

How to change a property via DTML ?
by olpa＠sybcom.de 07 Mar '01

07 Mar '01

Hello Zopers, how can I change the value of the property of an object let's say index_html via dtml (for instance the title property) ? Thanx --- "Whip me. Beat me. Make me maintain AIX." (By Stephan Zielinski) --- Oliver Pabst .-------------------------. mailto:olpa@sybcom.de : : phone :+49 681 56600600 : project department : SYBCOM GmbH fax :+49 681 56600660 : : http://www.sybcom.de

2 1

[Zope]
by Ruberl Michele 07 Mar '01

07 Mar '01

Hi all, I'd like to know if STXDocument 1. 2 by Tres Seaver still needs Renderable ZClass or if DC added it in the 2.3.0 version. ... or if there is something even newer about Structured text docs! Thanks! Michele

1 0

<dtml-if not X>
by Axel.Missbach＠t-online.de 07 Mar '01

07 Mar '01

Hallo, please tell me the way to define an if-not-clause with dtml. I thought the following is the right way!? <dtml-if not x> .... </dtml-if> but it is not excepted. greetings Axel

3 3

something wrong with my uploaded images
by Hans de Wit 07 Mar '01

07 Mar '01

Hello, When i add images "by hand", the images are perfect. However uploading them with the following dtml doesn't work. The result is an object, but when i view it, there is a cross (like this image is not found). There are not enough bytes in the image object either. I checked the variables foto_id, foto_file and foto_title with an <dtml-var foto_id> etc. They seem to be allright. The manage_delObjects also works fine. What i am doing wrong? any hints appreciated <dtml-with expr="PARENTS[1].fotos"> <dtml-if expr="_.hasattr(this(),foto_id)"> <dtml-call expr="manage_delObjects(foto_id)"> </dtml-if> <dtml-call expr="manage_addImage(id=foto_id,file=foto_file,title=foto_title)"> </dtml-with> <dtml-call "RESPONSE.redirect(HTTP_REFERER)"> Met vriendelijke groeten, Hans de Wit h.de.wit(a)scp.nl

1 0

WebDrive vs Zope?
by Wolfgang Strobl 07 Mar '01

07 Mar '01

While reading chapter 3 of Dieter Maurers "Building Dynamic WebSites with Zope" (a fine piece of work, btw!), I followed the reference to WebDrive (a product mapping anything accessible by ftp or by webdav to drive letters, i.e. into the file system on windows) and gave it a try. ftp works reasonably well with Zope, but I couldn't get the webdav support (i was looking for) to work. It connects successfully. but displays an empty drive, afterwards. I can create documents there (which indeed arrive intact in Zope), but that's it - there is no way to see any of the existing files or folders at all! This behaviour is independent of whether I log in using an id with manager rights or anonymously. In the latter case, I can't create any files, of coures. Before digging deeper into it, I'd like to ask whether any of you has any hints. As it seems, it works for some people. Tres Seaver recommended WebDrive in http://groups.yahoo.com/group/zope/message/51235 for example. (I'm using WebDrive 3.0 with a almost fresh Zope 2.3.1b1 installation on win2000, btw.) -- ws

3 4

From POST to GET
by Peter Bengtsson 07 Mar '01

07 Mar '01

Problem is this. I POST a form to a page called process_html. Inside process I do some validation on posted variables. If i find that something is wrong I want to complain by sending the user to bad_input_html?errmsg=Username%20Empty (which is a GET request in theory). What happens is that the redirect is a mix of GET and POST. It is a pure POST request, but the querystring is picked up as well. Truth is that this works fine in Internet Explorer, but it fails on the UK Vodafone WAP Gateway. It works on all other WAP Gateways except this one. This tag would work in a normal situation: <form action="process_html?loginname=Peter%20Bengtsson" method=POST> But with my gateway only the POST variables are sent and the variable "loginname" is ignored. Anyhow. How do I "leave" the POST requesting and break out of it to do a GET request?? Is there a header I can set? <pseudo code> <dtml-call "RESPONSE.setHeader('REQUEST_METHOD: GET')"> </pseudo code> Any smart suggestions more than welcome! Peter

6 8

Re: [Zope] FrontPage Extensions incompatible with Zope?
by Dieter Maurer 07 Mar '01

07 Mar '01

Fred Yankowski writes: > There are at least three categories of trouble using FrontPage with > Zope, that I know of: > > 1) FrontPage generates files and folders whose names start with "_", > thereby breaking a cardinal Zope naming rule and causing those > files and folders to be inaccessible (if done via LocalFS) or > outright impossible (in Zope proper/ZODB). That is Zope specific. Other HTTP servers will not mind names beginning with '_'. > 2) FrontPage uses custom HTTP-based RPCs to do file upload and > administration. I know next to nothing about this, but I'm pretty > sure that Zope does not support this extended HTTP protocol > directly. Seems like it could though. Hugh, what is that "custom HTTP-based RPCs"? Never heard about this! Why does "FrontPage" not simply use "PUT"? > 3) FrontPage uses its own library of server-based features, such as > for counters. Seems, it wants only work together with IIS? Dieter

3 2

ZPyGresDA
by HENRY Katell 07 Mar '01

07 Mar '01

Hi, I would like to know if someone knows the web site from which I could download the ZPyGresDA ??? Thanks Katell

2 1