- Zope - Zope lists

Re: [Zope] Running Management Interface on Separate HTTP Port
by Hung Jung Lu 24 Feb '00

24 Feb '00

"roland reumerman" <zope_dd-(a)hotmail.com> wrote: >the issue of SECURITY. The Zope web app server and accompanying Oracle >database will be run off the same machine on the extranet, so there's no >security issue with our itnranet there. However, the consultant from the >firewall company recommended that we use different HTTP ports for the >customer interface/application and the management interface. If you are serious about security, you should install two copies of the Zope server. One development copy, and one production copy. Development copy lives inside the firewall, production copy lives outside. You update the production copy only once a while (say, once a month or once a week.) The best strategy is to make the production copy READ-ONLY. Since you are using Oracle database, this shouldn't be a problem. ---------------- And now a question from me to zopists: is there a way to disable all management commands on a Zope site? Or do I have to use Apache re-write rules to block all URLs ending in things like .../manage, .../REQUEST, .../manage_workspace, etc? Seems a lot of work to me. regards, Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Access control & Acquisition...
by Jon Prettyman 24 Feb '00

24 Feb '00

Given a layout such as this: /Control_Panel/Products/UserProperties/UserPropertyClass/ /nmn/premium/acl_users(GenericUserFolder)/userA(role subscriber) /nmn/premium/user_profiles |role subscriber has permission to add UserProperties[s] |role subscriber has permission to View Management Screens |role subscriber has permission to Access contents Scenario: anonymous user access /nmn/premium causes GUF user login logs in as jjp(has role subscriber) sees /nmn/premium/index_html jjp access /nmn/premium/user_profiles/manage sees manage screen with [ADD]UserProperties jjp selects [ADD]UserProperties causes GUF user login screen the log shows that jjp tried to access /nmn/Premium/Users/manage_addProduct/UserProperties/UserPropertiesClass_factory and failed with a 500 Looking at GUF debug messages, it looks like the authentication ``crawls'' up and fails at the root. After perusing the Acquisition Algebra paper Jim Fulton wrote, I see: Acquisition and Security Based on aq_inner Can't access a protected object unless the user database is a common ancestor. Without these rules, it would be possible to "steal" access through acquisition. Is this second item what is causing me to fail? If so, any insights ino how I can work around it? TIA -Jon

2 1

startup at boot - what user to run zope as
by Andy Heath 24 Feb '00

24 Feb '00

Hi, bit of a zope newbie. running on a unix box. I'd like a zope server to startup automatically at boot (so auto-reboot after power failure works ok). Question is - what user should I run zope as - is it safe to run as root? If not, then how can I start it as some other user without giving write permission the the zope/var directory for the pid. Should it be owned by and running as nobody:nogroup? I have complete control of the box so any workable solution possible. Andy -- ------------------------------------------------- Andy Heath a.k.heath(a)shu.ac.uk The Open University +44 (0) 114 2885738

3 2

RE: [Zope] sequence-key usage
by Martijn Pieters 24 Feb '00

24 Feb '00

From: Jim Sanford [mailto:snafford@bellsouth.net] > Thank You. > > I was trying to use sequence-key to get the column names for > ZSQL method query. > > I get an "unscriptable object" error when doing so. > > Is there someway to access the column names of a ZSQL method > query from DTML? Please keep mailing to the list, I don't have all the answers (whatever everyone may say). I believe you can access the metadata only from External Methods. See this How-To for some hints: http://www.zope.org/Members/jpenny/Accessing_a_ZSQL_Method_from_an_Exter nal_Method -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

1 0

Re: [Zope] Object ids in the select
by Hung Jung Lu 24 Feb '00

24 Feb '00

"sin hang kin" <iekentsi-(a)infoez.com.mo> wrote: > ><form action="setmember" method="post"> ><select name="members" size="10" multiple> ><dtml-in catalog> > <option value="<dtml-var catalog.getobject(data_record_id_)>"> > <dtml-var title> > </option> ></dtml-in> ></select> ><input type="submit" value="addmembers"> ></form> > >How I can retrieve the object-ids in setmember. If setmember is a python >method, what is passed to it? (1) First of all, change the name of your selection variable from "members" to "members:list". Whenever you are doing a multiple selection, you SHOULD append the ":list" qualifier, otherwise you get into trouble with the particular case of single item selected. You may also want to get into the habit of using the ":method" tag for the submit button names. This helps when you have multiple submit buttons. <form action="myFolderURL" method="post"> .... <input type="submit" name="myDTMLMethodName:method" value="addmembers"> .... If you can't find documentation on the ":list" and ":method" tag, don't worry, you are not alone. :) (2) The returned ids are in REQUEST.Form.members, or directly accessble also as REQUEST.members or simply members. It's a Python list. So you can do things like <dtml-in members> ... do things with <dtml-var sequence-item>, or _['sequence-item'] </dtml-in> (3) I wouldn't recommend an external method to handle form requests. If you really want to handle things using external methods, then your declaration should not have any argument except self. def setmember(self): .... Then you access the rest through self.REQUEST or self.aq_acquire('attributeName'). Most people use DTML methods/documents to handle form requests. >I have the which collect objects in its attribute as a list. I don't understand what you mean here. English problem? regards, Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

manage_exportObject
by Daniel G. Rusch 24 Feb '00

24 Feb '00

No responses the first time, so I'll try again, Does anyone know how to export an object (Folder or such) from outside of the Folder that contains the item to be exported without hard coding the path. In otherwords I would like to be able to have a user interface which would allow a person, with an export role, to be able to enter a list of fully qualified Items to be exported. Consider: FolderA FolderB ItemToExport I can export ItemToExport from FolderA by calling: <dtml-with "FolderA.FolderB"> <dtml-call "manage_exportObject(id='ItemToExport')"> </dtml-with> but I don't want the FolderA.FolderB to be hard coded. I would like it to be a var that I pass into the method. Something like: <dtml-with FullPath> what should the syntax be. Thanks, DR P.S. since the id in the manage_exportObject argument list is a string, I can handle making that a var instead of hardcoding the value: ItemToBeExport.

1 0

Random header tags in structured text?
by Milos Prudek 24 Feb '00

24 Feb '00

Why would structured text rendering randomly put html header tags around some text? I have a index_html with this content: <dtml-var glossary_h> <dtml-var os fmt=structured-text> <dtml-var sw_linux fmt=structured-text> <dtml-var glossary_f> The os DTML document has this content: Operating system -- Computer operating system (OS for short) is the basic program. Your computer must have an operating system in order to work at all. Examples of operating systems include Linux, BeOS, and Microsoft Windows. If you use Linux, your programs should also be for Linux (see <A HREF=sw_linux>Linux software</A>). If you use Linux, your programs should also be for Linux (see <A HREF=sw_linux>Linux software</A>). The glossary_h has this content: <HTML><HEAD><TITLE></TITLE></HEAD><BODY BGCOLOR="#FFFFFF"> <H4>Header</H4> The glossary_f has this content: <H4>Footer</F4></BODY></HTML> When index_html is rendered, the first "if you use Linux" sentence is normal, but the second one is surrounded by <h3> tags. If there are three such lines, then the third one is surrounded by <h3>, etc. This does not happen for DTML document "sw_header", which is also just a structured text. My Zope is version 2.1.1, source release, Linux. -- Milos Prudek

2 1

Zope 2.0.1 tree-tag problems
by katrin 24 Feb '00

24 Feb '00

Hi, Can anyone tell me how the tree-tag bug concerning expand_all was fixed in Zope 2.1.0? I can't install Zope 2.1.0 because then the patched version of the Confera Topic won't work anymore (don't know why). Please, I really need your help with this. Thanks, Katrin

1 0

Testing CatalogAware ZClasses
by Tom Deprez 24 Feb '00

24 Feb '00

Hi, Thanks for the help so far. I'm trying to make a very small knowledgebase kit to get familiar with the ZClasses and ZCatalog. I thought on the following : 1. I make a container ZClass which can contain other container ZClasses and KBItem (see 2) 2. I make a ZClass called KBItem. This contains the information of the problem. It also holds a string which is the same as the category string of its Container ZClass. It also holds a token variable with all the parent container classes. (How can I get all the category strings of all the containers to which the KBItem in this token variable?) How can I make it so, that the KBITems are cataloged on this token variable? Something I'm really not sure of : Can KBItem adjust itself (thus it's category string and token variable) when it is moved? Can a ZClass know when it is moved inside the ZODB? Will the catalog also be auto-updated? Thanks in advance, Tom.

1 0

how do I add XML document via dtml and set properties of XML document
by Rowan Hick 24 Feb '00

24 Feb '00

I can't figure this one out, I've managed to display an XML document and parts of an XML document but can't figure out how to ADD an XML document -( I would be doing the usual of displaying a form and submitting the results. Has anyone got any sample DTML code they could share, it would be MOST appreciated :-) Thanks Rowan Hick Business Analyst, Soft Tech NZ LTD www.softtechnz.com

2 1