- Zope - Zope lists

Malicious HTML
by Graham Chiu 08 Mar '00

08 Mar '00

I wish to allow users to enter comments into my database which are then viewable thru the browser. Is there a Zope function that I can pass their text thru to remove all HTML? ------- Regards, Graham Chiu gchiu<at>compkarori.co.nz http://www.compkarori.com/dynamo - The Homebuilt Dynamo http://www.compkarori.com/dbase - The dBase bulletin

4 3

Re: [Zope] Creation of an ZClass Instance.
by M.J. Stahl 08 Mar '00

08 Mar '00

This is bizarre: I added this line to the form ACTION... after I took a look at how the management interface was adding the DCTask. manage_addProduct/DCTask%20/DCTaskClass_add (what the heck does the DCTask%20 do?) Before it couldn't find the product DCTask (attribute error) and now it finds the product but I get a key error. Error Type: KeyError Error Value: id This is the code that I have for adding the adding ID of the instance of the class (it provides a random ID or at least generates on) <dtml-call "REQUEST.set('id',_.random.random()*10000)"> <dtml-call "REQUEST.set('id',_.str(_.int(id)))"> I copied (and modifyed slightly) this from the How-To: AutoGenerate Random ID for objects (http://www.zope.org/Members/Bill/Documentation/AutoGenID) -M.

1 0

Z2.log and Date stamps 2nd Call for answers????
by CURTIS David 08 Mar '00

08 Mar '00

Friends of Zope, My Z2.log file entries which are in the /var/Z2.log are inconsistent with the actual system time. The Z2.log file shows 123.123.123.123 [08/Mar/2000:16:49:40-0700] The actual system time is 8:49 pacific time. NT 4.0 show (GMT-0800 UTC) Pacific time (US and Canada);Tijuana It and is set to automatically adjust for daylight saving time. I have a NT 4.0 windoze workstation machine that is running Zope latest version 2.1.4. and of course python 1.5.2. Is there a script file that needs adjusting to make the file log correctly? I know that -700 is UTC is Mountain Standard Time. Do Zope programmers like the warm southern climate better than the cold climates? In short can this "default" be changed.

1 0

Creation of an ZClass Instance.
by M.J.M. Stahl 08 Mar '00

08 Mar '00

I am new to Zope but I am very appreciative of the How-To's and Guides that have been produced by those that are more experienced than I in the use of Zope. I am currently working on intranet for the company I work for, and am having problems creating an instance of a ZClass, that I created, (DCTask, which is actually the product, DCTaskClass is the ZClass)through the a public interface (form that requires the entry of information that will be added to the instance in the form of properties, such as the description of the task and which department it is created for). The form that is used to submit a creation action resides in a created folder (http://diis/tasks/generator) and therefore does not reside in the folder where the DCTaskClass_add method resides. I think that my main problem, though I could be wrong, is that I haven't found a way to access the _add method from the /task/generator folder through the use of the <FORM ACTION="...">. I believe that once I have can access that file through the form action and have the ability to send all of the relivant information I will be able to create instances through the use of the public interface (ie. the form) Any help will most appreciated. Best regards, MJ Stahl

2 1

RE: [Zope] Sort order
by Jason Spisak 08 Mar '00

08 Mar '00

<dtml-in "mystuff" sort=id reverse> Just 'reverse' All my best, -- Jason Spisak 444(a)hiretechs.com

1 0

Re: [Zope] Malicious HTML
by auto44082＠hushmail.com 08 Mar '00

08 Mar '00

I shouldn't be that hard for you to write one yourself. I once wrote a function in perl using it's powerful patern matching which stripped out all HTML tags from an input text file. As I recall it took only 4 or 5 lines of code (including the function header). You should be able to do something similar in Python. -Andy IMPORTANT NOTICE: If you are not using HushMail, this message could have been read easily by the many people who have access to your open personal email messages. Get your FREE, totally secure email address at http://www.hushmail.com.

1 0

Zope Marketing (was Zope needs this (and Dynamo has it) )
by Jerry Spicklemire 08 Mar '00

08 Mar '00

John Goerzen wrote : >OK, but see you're trying to make Linux something it is not. Linux is >not about marketing. In my ongoing efforts to gain a bit of recognition for the capacity of Zope, Python, and all things Open Source, it looks to me as if Marketing Matters, regardless of my wishes. Even if, to me, the validity of Zope / Python is "obvious", it is not so clear to others, and especially others who make decisions about tool selection. At some point, if Zope / Python is to find a place in the larger world, these folks must be convinced. There may be a more palatable word, call it "education", "concsiousness raising", or some other more trendy phrase. Still, you can get the gist from the words, "selling", "marketing", or even "hype". Check out some of the articles by the folks at Bynari Associates (any search engine will get you there). You can see the need for marketing of Linux and Open Source tools in their daily business. In fact, the articles themselves are a form of marketing, gaining name recognition for Bynari (see, it works!) in the Open Source community, while sharing the benefit of their "real world" experiences of implementing "Linux" for paying clients. In short, the line between the coder and the customer relationship doesn't look quite so distinct from here. Later, Jerry S.

1 0

Simple Syntax Question
by James W. Howe 08 Mar '00

08 Mar '00

I have a method that I want to return a list. The problem is that one of the items in the list needs to have an embedded single quote character. I'm currently returning the list like this: <dtml-return "['item1', 'item2', 'item3']"> how can I recode this so that I can return items like "John's"? Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

3 3

Methods - inheritence vs acquisition
by Cary O'Brien 08 Mar '00

08 Mar '00

Ok, I've gotten pretty far with Zope this time. But (of course), I've got a bunch of questions. Starting with... 1) What is the algorithm for determining which method to call? The DTML documentation says "attributes, including inherited and acquired attributes, of the client passed in the call to the document template are searched" But in what order? There can be an index_html in the class, in a parent class, or somewhere up the acquisition tree. Which takes precedence? Does the product that a ZClass have anything to do with the search? What about Z-Super-Classes? Inquiring minds want to know. 1a) Why can't I have a method in a ZClass, but then override it in the instance? I.E. (Gaak, it has been a while since I've had to even think about C++) virtual methods? (Or have I got that wrong). 2) It seems that the examples require the user to generate forms by hand, which seems unnecessary. For example, (after a protracted struggle with the underlying python code) I wrote a method that would create an html table for any query, ripping the column names and data out of the result object. 2.1) Shouldn't this be a standard part of Zope? 2.2) If so, do you want this code? 2.2) Likewise for property edit forms. I did find some DTML that would do this, but shouldn't this be standard. 3) Anyone want to help me whip snmpy into shape and create soem nice Zope classes for accessing SNMP variables and tables in routers and such? Enough for now... -- cary cobrien(a)radix.net

3 3

RE: [Zope] Malicious HTML
by Marcus Collins 08 Mar '00

08 Mar '00

Or, use something like w3m http://ei5nazha.yz.yamagata-u.ac.jp/~aito/w3m/eng/index.html to take the html and turn it into plaintext. Pop it into an external method something like the following, and it should do the trick: ---html2msg.py from popen2 import popen2 def html2msg(htmlstring): try: (r, w) = popen2('/usr/local/bin/w3m -dump -S -cols 70 -T "text/html"') w.write(htmlstring) w.close() s = r.read() r.close() return s except: return 'Error converting article to plaintext.' --- It's an ugly hack, and you lose things like <br> and <p>, so you may want to replace \n with <br> afterwards. It does, however, do a brilliant job layout-wise: tables and lists remain fairly well formatted, for example. hth, -- Marcus > -----Original Message----- > From: Evan Simpson [mailto:evan@digicool.com] > Sent: 08 March 2000 15:06 > To: Michel Pelletier; Graham Chiu > Cc: zope(a)zope.org > Subject: Re: [Zope] Malicious HTML > > > ----- Original Message ----- > From: Michel Pelletier <michel(a)digicool.com> > > Graham Chiu wrote: > > > > > > I wish to allow users to enter comments into my database > which are then > > > viewable thru the browser. > > > > > > Is there a Zope function that I can pass their text thru > to remove all > > > HTML? > > > > Nope. There may be some standard python library module that I don't > > know about, however. Otherwise, you will have to write your own. > > On the other hand, if you tell the user up front that HTML > tags are not > allowed, you can simply html_quote the text. That will > prevent any tags > from rendering, and prevent normal uses of '<>&' characters > from breaking > anything. > > Cheers, > > Evan @ 4-am & digicool > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0