- Zope - Zope lists

Security question
by Daniel.Weber＠SEMATECH.Org 17 Mar '00

17 Mar '00

As far as authorization goes, I've noticed that I get prompted for a user-name/password only once during a session. After you've been validated, it appears zope does not prompt you again for that browser session. The reason I'm concerned is that if I have to do maintenance on someone else's web browser, how do I ensure that after I leave a person cannot use the back button or history list to gain manager access to the site? Do I have to exit the browser when I'm done?

4 3

Re: [Zope] Two Q's: (1) Nested dtml-in's, (2) dtml-in arguments
by Douglas Bates 17 Mar '00

17 Mar '00

Ken Kinder <kkinder(a)messagemedia.com> writes: > I have two related questions that I would love for someone to answer... > * Does anyone know what possible problems come up from nested dtml-in's? > * If I have a SQL Method which takes parameters, how do I pass them > thru dtml-in? Yes, you can nest dtml-in's and you pass the parameters to the SQL method by explicitly invoking it as an expression, not just as a name. (It happens that I asked a very similar question of this list recently, which is why I now know the answers.) My example, stripped down a bit, looks like <dtml-var standard_html_header> <dtml-in search_author size=50 start=query_start> ... <tr> <td class="center"><dtml-var year null=""></td> <td><dtml-var title null=""></td> <td><dtml-in expr="return_authors(seq=seq)"> <dtml-var name>; </dtml-in></td> </tr> ... </dtml-in> I hope this is enough to get you started. Contact me directly if you would like more explanation.

1 0

RE: [Zope] Security question
by Chris McDonough 17 Mar '00

17 Mar '00

Daniel, THis is a limitation of HTTP basic authentication and is not a Zope-specific problem. Either quit the browser before you leave or write a short dtml method: <dtml-raise Unauthorized> Logout </dtml-raise> and call it before you leave. Note that you need to call it, then click "OK", or you will still be logged in. -----Original Message----- From: Daniel.Weber(a)SEMATECH.Org [mailto:Daniel.Weber@SEMATECH.Org] Sent: Friday, March 17, 2000 5:27 PM To: zope(a)zope.org Subject: [Zope] Security question As far as authorization goes, I've noticed that I get prompted for a user-name/password only once during a session. After you've been validated, it appears zope does not prompt you again for that browser session. The reason I'm concerned is that if I have to do maintenance on someone else's web browser, how do I ensure that after I leave a person cannot use the back button or history list to gain manager access to the site? Do I have to exit the browser when I'm done? _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

dtml-echo?
by jessica lee tishmack 17 Mar '00

17 Mar '00

Thanks for the reference to the DTML Guide...it has helped a lot. I have come across something that I couldn't seem to find an answer to. I have the following line in my original code that I uploaded from an existing HTML directory...I can't seem to find a dtml tag that will replace the echo statements here... href="http://validator.w3.org/check?uri=http://dnrdb.cbi.tamucc.edu:80/ ;weblint" I found this snippet of code for an echo and set, but my attempts at modifying it to work for this have failed.   Thanks in Advance, Jessica

4 5

Odd AttributeError (__call__)
by Ronald L. Chichester 17 Mar '00

17 Mar '00

I have three instances of Zope running on three different machines (all dual PPro). On the first two machines, a simple <a href="otherfolder">Click here to move to the other folder</a> works just fine to hyperlink to the index_html in the "otherfolder" folder. However, on the third machine (ironically the one that I want to deploy to) the same hyperlink encounters the following error: Zope Error Zope has encountered an error while publishing this resource. Error Type: AttributeError Error Value: __call__ In all three instances, the security is set up the same way on all documents, images, and folders accessed. Incidentally, the deploy server and one of the working ones are running Zope 2.1.4. The other working one is running 2.1.3. Does anyone have an idea what my problem is? Thanks in advance, Ron ./.

1 0

Performance and Concurrency (Repost)
by Cary O'Brien 17 Mar '00

17 Mar '00

[I'm posting this again because, suprisingly, there was no response] I was reading the thread about Zope vs AOLServer and performance and threading and all that. I've done some work with other interpreters embedded in the apache child processes (tcl, mod-perl) so I started wondering if this would work for zope. Somewhere I think there is a Python interpreter embedded a'la mod-perl. If not, I'm pretty sure it can be done without too much grief, using mod-perl and mod-dtcl as starting points or examples. It seems to me this would allow utilization of multiple processors, esp for apps with a database backend, since the work would be split up over n frontend apache server processes and n backend database processes (at least for oracle an PostgreSQL)[1]. All without worrying about threading... But... What happens when multiple processes attempt to access the zame ZODB Data.fs file? Is it multi-process safe? Thread safe? How big are the sections protected by the mutexes? (or more importantly how long do they take to execute)? Thanks, -- cary [1] m apache talking to n database backend process, m > n, might be even nicer in some cases. Gotta write that PostgreSQL backend multiplexor someday.

2 1

Re: [Zope] Zope does not start completly
by Tres Seaver 17 Mar '00

17 Mar '00

Curtis Maloney <curtis(a)umd.com.au> wrote: > > On Fri, 17 Mar 2000, Steffen Lemke wrote: > > Hello there > > > > I' ve got some difficulties with the very final step of ZOPE-Installation: > > I made the start-script as root (-> python wo_pcgi.py) and got all the > > neccessary scripts. Then I chown and chgrp all files to my ZOPE-user and > > tried to start up the server. Unfortunately the script has got some > > endless-loop or so and I have to break (Ctrl-C) in order to get my prompt > > and logout. I do have access to the server via WWW but only until I break > > the script. > > > > Do you know some hint? > > Thank you very much! > > > > Stef > > > > If you're using the 'start' script, background it: > > $> start & > > The ampersand means "background this" I'm guessing that Steffen is using the "default" start script, which passes the "-D" parameter to Zope -- it is therefore running in "debug mode", and writing error messages to the console. Backgrounding it will work, sort of, but will leave Zope expecting to write to the controlling tty -- if it goes away (i.e., Steffen logs out), then Zope will die hard when trying to write to it. A better fix is to edit the start script and remove the "-D" from the command line. Without the "-D", Zope will daemonize itself, and the backgrounding won't be needed. Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

1 0

beginner's question: references
by Perrin Harkins 17 Mar '00

17 Mar '00

This is such a stupid question, but I can't seem to figure it out from the docs. How do I make an object in Zope reference another object? I don't mean containing like a folder, I mean one object referencing another in a different part of the hierarchy. For example, if I make a class to represent movies, and another to represent theaters and I want the movies to reference the theaters they're playing at and vice versa. How does Zope handle this? Please try to frame an answer in the context of ZClasses, since that's what I'm using. (Or tell me if ZClasses can't do this yet.) Thanks, Perrin

5 6

RE: problems with jcNTUserFolder
by Ava 17 Mar '00

17 Mar '00

> Hello, > > I tried your Zope product jcNTUserFolder 0.0.3 under Zope 2.1.4. > I was able to create a NT User Folder and I could see the > users defined on > my NT system. But when I try a link to the folder containing > the NT User > Folder I always get the message: > > Error Type: AttributeError > Error Value: 'None' object has no attribute 'getDomains' > > Probably my installation of your product is wrong. Do you > have any idea what > went wrong? Stupid bug :-) here is the patch against lib/python/Products/jcNTUserFolder/NTUserFolder.py: 164a165 > userobjects = filter(None, userobjects) if you don't have patch.exe (which is likely to be the case, as you run Zope on Windows...), the above patch means that you have to add the line userobjects = filter(None, userobjects) at line 165 of the file so the code: def getUsers(self): """ Return a list of *local* user objects Only users whose settings are not to be acquired are returned XXX should I include the defined ntdomain users ? """ userobjects = [] resume = 1 while resume: users, junk, resume = win32net.NetUserEnum(None, 0, ... userobjects.extend(map(lambda user, self=self: self ... return userobjects is turned into: def getUsers(self): """ Return a list of *local* user objects Only users whose settings are not to be acquired are returned XXX should I include the defined ntdomain users ? """ userobjects = [] resume = 1 while resume: users, junk, resume = win32net.NetUserEnum(None, 0, ... userobjects.extend(map(lambda user, self=self: self ... userobjects = filter(None, userobjects) return userobjects You could also download the latest jcNTUserFolder-0.0.4 at http://www.zope.org/Members/jephte/jcNTUserFolder Remember: Zope must run as a service or the user have "act as part of the operating system" for jcNTUserFolder to work! regards, jephte clain

1 0

security question
by Brad Crittenden 17 Mar '00

17 Mar '00

hello: for my zope, the root directory is protected so that anonymous users have no permissions. in addition to root, two other users are defined and given the role 'internal'. one of the users has a username/password. the other allows access based upon IP range. this works as intended. i now want to give anonymous users permission to access /subfolder/index_html. this dtml method accesses a database and uses LocalFS. my first attempt to realize this was to assign the appropriate permissions to Anonymous for index_html. when this failed, i went to the /subfolder security and modified permissions there that seemed relevant. i tried many combinations until finally giving up and granting all available permissions to Anonymous at the /subfolder and /subfolder/index_html levels. so now, all permissions are checked for 'acquire' and for 'Anonymous'. even this does not work! users attempting to access http://myzope/subfolder/index_html are greeted with an authentication dialog. so, despite the fact that security seems to be a pretty simple concept i seem to be missing something fundamental. any insight would be appreciated. thanks, bac

2 1