- Zope - Zope lists

Re: [Zope] scary security questions
by Dieter Maurer 12 May '00

12 May '00

Paul Abrams writes: > 2) Is there any way to turn off the manage screens, or set > them so that they can only be run locally? You can add a "domain" restriction to your "access" file. Then the admin can only connect from this domain. A domain can be a single host (given by hostname or internet address) or a real domain. - Dieter

1 0

Re: [Zope] heirarchical diretcory based on zcatalog
by Rik Hoekstra 12 May '00

12 May '00

<snip explanation of hierarchy need> David Kankiewitz (not sure if I spell his name correctly) implemented something very alike for the zdp site. We had a rather lengthy discussion on the ins and outs of such a hierarchy in February or March on the zdp list. You may want to check out the archives at http://lists.zope.org/pipermail/zdp/ for details. There is probably also more information at the zdp list. Sending a mail to the zdp list may also get you some information. The current organization of the zdp site in subjects and topics is based on David's work. You can have a look at it http://zdp.zope.org hth Rik

3 2

ODBC client for Zope on Linux/Unix
by Jerry Spicklemire 12 May '00

12 May '00

This could prove helpful. By using the ZopeDA for Sybase there may be a slim chance we can connect directly to MS SQL Server from Linux / Unix, at least some versions . . . "Linux can connect to Sybase SQL Server. What's more, it can also connect to Microsoft SQL Server. Some time ago, Sybase released an a.out version of their Client-Library (CT-Lib) for Linux." http://www.linuxgazette.com/issue18/sybase.html Whatever it takes . . . Jerry S.

3 2

Re: [Zope] Login and user security
by Tres Seaver 12 May '00

12 May '00

Peter Kropf <peterk(a)bayarea.net> > To: zope(a)zope.org > Subject: [Zope] Login and user security > > I'd like to setup a user security environment similiar > to that used on the Zope site. Users can signup, and > login to access personal pages and logout when done. > However, I'm a bit confused about things. Perhaps I > don't understand enough of the underlying security > model. Additionally, the how-to, FAQ and other docs > are difficult to follow. > > Has anyone published a sample like this? Or, perhaps, > has the Digital Creation people can provide the > source to the DTML pages and methods? Any pointers > would be fantastic. First, the DTML etc. used by the Zope management interface is all there in the Zope directory, typically under the lib/python/ subdirectory. The two directories of most interest are probably AccessControl (for the authentication/permissions stuff) and OFS (for the folder contents, etc.) Second, Steve Alexander's recommendation of the PTK is also worthwhile. http://www.zope.org/Products/PTK Tres. -- ======================================================================= Tres Seaver tseaver(a)digicool.com http://www.zope.org Digital Creations "Makers of Zope"

2 1

Cannot delete Object with wrong metatype
by Helmut Toplitzer 12 May '00

12 May '00

Hi! I'm trying to make a website for some weeks now and yesterday a noticed a real problem for me. One of the standardfiles index_html (DTML Method) changed it's metatype to a !Folder! I've tried to delete it several times with no success. Has someone a idea how to make it work again? Helmut

1 1

RE: [Zope] Which login-system to use ? (newbie addon)
by Coleman, Bryan 12 May '00

12 May '00

I want to tie the login to authentication from a database. That is I want to from the application add someone and then there information will become the login. I have absolutly no idea how to go about this. - Bryan > -----Original Message----- > From: tsarna(a)endicor.com [SMTP:tsarna@endicor.com] > Sent: Friday, May 12, 2000 9:23 AM > To: zope(a)zope.org > Subject: Re: [Zope] Which login-system to use ? > > In article <130790366046.20000512144824(a)funcom.com>, > Geir Bækholt <geirh(a)funcom.com> wrote: > > GUF and LoginManager look like the way to go, but which one > > would be easiest to implement with those requirements ? > > The only User Source currently availible for LoginManager is > GenericUserSource, which tries to emulate GUF. There is currently no > SQLUserSource included. So, it's no easier for one vs another -- the > work would be about identical (you could even copy your userAuthenticate > and such methods from one to the other if you wanted to switch). > > LoginManager does give you extra bells and whistles, though. > > What is the State of The LoginManager ? - is it correct that > > it is meant as a part of the PortalToolkit ? -Will it > > function separate from the PTK ?? > > Well, it was definately written with PTK's requirements in mind. > However, I can assure you it works without, as the authors have not yet > found time to even download PTK and play with it yet :-) > > Seriously, LoginManager is intended to be very flexible, and it has no > dependancies at all on PTK. The only connection with PTK (and the reason > it was originally included there) is that it has features PTK needs that > other userfolder's don't offer. It works perfectly fine without PTK. > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

does this exist: rating/survey system?
by srl 12 May '00

12 May '00

I'm looking for something to see if it exists, in any language. Perhaps someone here can help me. I want a generic rating/survey/comment system for a series of websites I'm building. They all need to have similar features for rating different kinds of things (books, movies, restaurants, doctors...) -visitors should be able to see ratings and user comments about an item (for example: how people rated this restaurant for food, service, price, etc, and comments by other users) -visitors should be able to add new items to rate, possibly with administrator oversight before posting I haven't played with the PTK yet. will it do things like this? for that matter, are there any Zope products that will do this, or part of this? Or anything not written for Zope? TIA, srl ----- Shane Renee Landrum slandrum<@>cs.smith.edu

1 0

Re: [Zope] scary security questions
by Tres Seaver 12 May '00

12 May '00

Paul Abrams <paulabrams(a)yahoo.com> > > We are putting our site up and have some questions about > Zope security relating to one of Zope's biggest > benefits...remote administration. If some kid obtained > access to the manage screens he could...well you know :( > > 1) What prevents someone from getting into the manage > screens by cracking the admin username:password? Are failed > login attempts logged anywhere? If not, is there any way to > log them short of hacking the zope python code? This is an excellent suggestion. Would you please post it to the Collector: http://classic.zope.org:8080/Collector/developer_input > 2) Is there any way to turn off the manage screens, or set > them so that they can only be run locally? When you create a user with 'Manager' role, you can set the domains / IP addresses from which that user is allowed to log in. > 5 er...3) Is there any way to run the manage screens on a > different port than the rest of Zope? (i.e. not port 80) > This would allow us to open/close that port in our firewall > whenever we needed to access the manage screens remotely, > or run it over a VPN. SiteAccess plus Apache/SSL will do this for you. > > What are other people doing to protect themselves? The 'superuser' is about to become almost useless for standard site management (see the recent "Trojan" announcement for details). This is a Good Thing(TM), as it will induce people to create "management" users, which are much simpler to secure. Tres. -- ======================================================================= Tres Seaver tseaver(a)digicool.com http://www.zope.org Digital Creations "Makers of Zope"

2 1

Re: [ZDP] Re: [Zope] heirarchical diretcory based on zcatalog
by Rik Hoekstra 12 May '00

12 May '00

>It just occurred to me that maybe NIP, the company I work for, should >start archiving the ZDP list into our archives at >http://zope.nipltd.com/public/lists.html along with the ones we do for >Zope, Zope-Dev, Zope-PTK and ZCommerce. > >If people think this is a good idea, I'll see what we can do :-) While ZDP is not as heavily used as some of the other lists, many of the dicussions are of high quality (ahem ;-)) I was (secretly) hoping you were going to say this ... Rik

1 0

Which login-system to use ?
by Geir B�kholt 12 May '00

12 May '00

Greetings Zopistas ! I have to implement a login-system for our site, pulling usernames and passwords from a database (Solid at the moment, but we'll probably move to Interbase soon). new users should be able to register through the web, without writing to data.fs. Most of the site should be accessible for anonymous users , while some sections should be restricted. Cookie based authentication is a neccessity.. I've looked around among the different userfolders on Zope.org, but it is not clear to me which one would suit us best.. GUF and LoginManager look like the way to go, but which one would be easiest to implement with those requirements ? What is the State of The LoginManager ? - is it correct that it is meant as a part of the PortalToolkit ? -Will it function separate from the PTK ?? -- Geir Bækholt web-developer/designer geirh(a)funcom.com http://www.funcom.com

2 1