- Zope - Zope lists

Non-existing Zope-Security!!!
by Stephan Goeldi 13 Oct '00

13 Oct '00

OK let me state that I don't think so (subject line). I had to choose this subject, because it seems to me, that nobody was interested in my previous attempts to get information about my problem. So here is my newbie (?) question again: I have the folders: /www/folder1 /www/folder2 Apache redirects domain1 to folder1 and domain2 to folder2. The manager of folder1 is able to browse to /www and see what folders exist there. He shouldn't, because he only exists in the acl_user of /www/folder1. He even can look into the folder /www/folder2 (but not into the objects). Is it possible to disable the access for the folder1-manager above folder1? It doesn't seem to me. If it really isn't possible, there is no security at all for ISP uses of Zope. But I'm sure, there should be a possibility. I even created a local role in /www/folder1 too. Even with the local role I can browse /www and /www/folder2! Any suggestions? TIA -goe- _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

4 3

date comparison
by michael angelo ruberto 13 Oct '00

13 Oct '00

i want to create an index page that displays whether or not a page has been updated in the past 7 days or the past 20 days. however, i can't figure out how to get the bobobase_modification_date to compare with ZopeTime. can someone give me a clue before i rush blindly down Zope's undocumented dark alleys. mike

2 2

Any examples of use of manage_addFile()?
by complaw＠hal-pc.org 13 Oct '00

13 Oct '00

I want to create a user-interface so that users can upload files to my Zope site. I have done this with DTMLDocuments, however I don't quite understand how to get the file itself into the Zope site via ... self.manage_addProduct['OFSP'].manage_addFile() ..that is in Python. I looked through the HOWTO's but didn't find anything. Does someone have an example of a Form/DTMLMethod/Python script that does this sort of thing? Thanks in advance, Ron ./.

2 1

Re: [Zope] Variable name use in with statement
by Dieter Maurer 13 Oct '00

13 Oct '00

Burchill, Scott B. writes: > .... > I am finding myself doing the following and am sure > there is a simpler way to do this. > > Any help would be greatly appreciated! Thanks. > > <dtml-with bid_records> > <dtml-if "_.str(REQUEST.form['selection']) == 'walkon'"> > <dtml-with walkon> > <dtml-call "REQUEST.set('cur_bidder', bidder)"> > </dtml-with> > <dtml-elif "_.str(REQUEST.form['selection']) == 'fullhouse'"> > <dtml-with fullhouse> > <dtml-call "REQUEST.set('cur_bidder', bidder)"> > </dtml-with> > <dtml-else> > <dtml-with snoopy> > <dtml-call "REQUEST.set('cur_bidder', bidder)"> > </dtml-with> > </dtml-if> > </dtml-with> If you are sure, that only these values can occur in "selection" (as I expect, as otherwise, it would not be a selection), then you can use: <dtml-call "REQUEST.set('cur_bidder',_.getitem(REQUEST.form['selection']).bidder)"> Dieter

1 0

Re: [Zope] Authentication headers & firewall port redirection
by Dieter Maurer 13 Oct '00

13 Oct '00

Roland C. Reumerman writes: > Now it seems that somehow the combination of Zope-generated authenticated > headers and the firewall redirection rule do not match: does the header > include URL information? That would imply it tries to access > www.datadistilleries.com:8080/ddsn (Zope generated port) instead of plainly > www.datadistilleries.com:80/ddsn (firewall listen port). I know, that basic authentication is sent by the browser on a domain basis. I do not know, where the domain information originates, but it may well be Zope. You may want to use Shanes excellent "tcpwatch" utility to analyse what really happens between the server and your browser. Alternatively, you may have a look at SiteAccess. This Zope product helps you handle these forms of redirection. Even, if your authentication problem could be solved without it, you will soon hit other problems that require SiteAccess. Thus, go directly for it. Dieter

1 0

Re: [Zope] DTML Acquisition & NameSpace Help Needed.....
by Dieter Maurer 13 Oct '00

13 Oct '00

J Kinsley writes: > /FrameSet - DTML Method > ..... > XXX - How can I negate this? IE. <dtml-if "not section"> <dtml-unless section> > <dtml-if section> > <dtml-else> > <dtml-call "REQUEST.set('section', '/ViewFrame')"> > </dtml-if section> > > XXX - I do not think calling REQUEST.set() is the best way to > accomplish this. What is a better way? It is ineffective, as you do not use "topframe" later (in *this* request). > <dtml-call "REQUEST.set('topframe', '1')"> > > <frameset rows="60,75,*"> > <frame name="title_frame" src="&dtml-absolute_url;/TitleFrame"> > <frame name="banner_frame" src="&dtml-absolute_url;/BannerFrame"> > <frame name="view_frame" src="&dtml-absolute_url;&dtml-section;"> > </frameset> > ..... > XXX - I can not get this to work at all. Topframe should be set or > true if the visitor arrived in the /Files Folder from the top level > frameset and /Files/ViewFrame will be loaded into the view_frame > target. The frameset and its frames parts are fetched in *different* requests. The "REQUEST.set" only affects the REQUEST object for the frameset. The REQUEST objects for the frame components are not affected. You have two options: * a session product (there are some around on zope.org) it allows you to save information across web requests * passing the additional information through a query string key=value pair (do not forget to "url_quote_plus") > XXX - If this method is called from the top level FrameSet method, > how to I access dir and file from the original request? see above. Dieter

1 0

Re: [Zope] <dtml-if> and <dtml-var> question
by Dieter Maurer 13 Oct '00

13 Oct '00

complaw(a)hal-pc.org writes: > ... get today's date into a dtml-var ... <dtml-var "ZopeTime().Date()"> Look at the "DateTime" documentation, if this does not give you the needed date format. Dieter

1 0

Re: [Zope] Tiny tables
by Dieter Maurer 13 Oct '00

13 Oct '00

Graham Chiu writes: > I tried storing these in tiny tables, but it doesn't seem > that tiny tables allow one to store tokens. If I specify > the value as say, criteria:tokens, it gets changed to just > criteria. Probably, This is a ZPublisher feature. It interpretes ":<type>" suffixes of form variable and parameter names to call for a type conversion of the value. As far as I know, there is not escape possibility. Can you change the ':' into a different character? Dieter

1 0

RE: Variable name use in with statement
by Burchill, Scott B. 13 Oct '00

13 Oct '00

Ok, this worked : <dtml-with bid_records> <dtml-with "_.getitem(_['selection'])"> <dtml-call "REQUEST.set('cur_bidder', bidder)"> </dtml-with> </dtml-with> Thanks for the direction, Jerry! sbb > -----Original Message----- > From: Spicklemire, Jerry [mailto:Jerry.Spicklemire@IFLYATA.COM] > Sent: Friday, October 13, 2000 2:58 PM > To: 'sburch(a)ordway.org' > Cc: 'zope(a)zope.org' > Subject: Variable name use in with statement > > > Scott Butchill wonders if: > > "there is a simpler way to do this." > > Not much simpler, but how about: > > <dtml-call "REQUEST.set('user_select', ['walkon', 'fullhouse'])"> > <dtml-with bid_records> > <dtml-in user_select> > <dtml-if "_.str(REQUEST.form['selection']) == _['sequence-item']"> > <dtml-with "_['sequence-item']"> > <dtml-call "REQUEST.set('cur_bidder', bidder)"> > </dtml-with> > <dtml-elif "_['sequence-index'] == -1> > <dtml-with snoopy> > <dtml-call "REQUEST.set('cur_bidder', bidder)"> > </dtml-with> > </dtml-if> > </dtml-in> > </dtml-with> >

1 0

proxied proxies with Zope & Apache
by Aaron Straup Cope 13 Oct '00

13 Oct '00

Hi, I have Zope set up running with Apache/SSL using mod_proxy and the SiteRoot product. Everything works fine. The thing is, if I understand stuff correctly, all the requests to https://hostname.com get handed off to Zope. I would like to be able use the same hostname for plain old Apache-isms (cgi php etc) because the users of the site shouldn't have to rememeber YA-hostname. I would like to be able to do the following : https://hostname/foo-->https://zope.hostname/foo -->http://hostname:8080/foo https://hostname/bar-->/htdocs/bar a) hostname:443 ProxyPass /foo https://zope.hostname/foo b) zope.hostname:443 ProxyPass / http:hostname:8080/ (where the SiteRoot in the Zope tree points to https://zope.hostname) When I try to do this, regardless of whether I use mod_proxy or mod_rewrite, Apache returns a 403 error : "You don't have permission to access /documents on this server." Should the Zope SiteRoot point to https://hostname instead of https://zope.hostname? I know that I could set up multiple ProxyPass statements (and corresponding SiteRoot objects) in the Apache conf file, but I would really prefer to set up a standalone Zope https setup (mostly for administrative purposes) and then proxy those aspects of Zope that are pubic automagically to the default Apache setup. I am dreaming? The rewrite/proxy stuff is still like voodoo for me most days so any advice or suggestions would be welcome. Thanks,

1 0