- Zope - Zope lists

Re: [Zope] why use eGroups for the list archives?
by alan runyan 15 Feb '00

15 Feb '00

eGroups times out every other time I use it --I search, server times out. I search again, it works. I dont know of a better way, but i tend to spend lots of time in the archives looking for answers and it is painful :( anyone search for something get results, type another phrase in and get, "We were unable to find any results for your query. Reason: No group specified." which makes me go back to Zope search form on zope.org each time to make a search how about NNTP? not linked to usenet. something where client side tools are more useful (NT by day, linux by night) to browse topics/threads more efficiently. ideally it would look really swank to have all messages catalogued and served by Zope. ~alan

1 0

PARENTS
by Pedro Silva 15 Feb '00

15 Feb '00

Hi there, Idon't understand very well the PARENTS, but I know that I have to use them in my case. What I want to do is, something like the following example: Group1 Sub1 ==> link to msg Sub2 ==> link to msg Group2 Sub1 ==> link to msg Sub2 ==> link to msg When I click in one of these links, it will show the msg page. In here I have to know which link was clicked to can display the information of that link. Something like this: Group1 - Sub1 Messages: 1 - message #1 2 - message #2 Or Group1 - Sub2 Messages: 1 - message #1 2 - message #2 One of this examples will show up, in the first if we had clicked in Group1 Sub1 link and in the second, if we had clicked in Group1 Sub2. And so on. To do this I know that I will have to use the parents to know which link was clicked, but I don't know how. Can anyone help me? Please send you answers to: psilva(a)ruido-visual.pt Thanks, Pedro

2 1

Re: [Zope] Authenticating many users to manage only their own folders?
by Phil Harris 14 Feb '00

14 Feb '00

Darran, I would create the users in a root level UserFolder and then assign the user local roles within their own forlder. This can be done programmatically, something like: def add_User(self, username=None,password=None,confirm=None,domains=[],roles=[]): ###### # let's create the user ###### self.acl_users._doAddUser(name=username,password=password,domains=domains,ro les=roles) ###### # now create the home directory for this member ###### self.members.manage_addFolder(id=username,title='',createPublic=0,createUser F=0) title="%s's Homepage" % username s="""<dtml-var standard_html_header> <h2><dtml-var title_or_id></h2> <p>This is the default page created for a Member, it has very little content, as you can see. <p>To see a better example of how Zope works look at the <a href="&dtml-SCRIPT_NAME;/zGold/QuickStart">QuickStart</a> documentation. <p>Also see the <a href="&dtml-SCRIPT_NAME;/zGold/Example">XML examples</a>. <p>Most of all have fun!. <dtml-var standard_html_footer>""" eval("self.members.%s.manage_addDTMLDocument(id='index_html',title=title,fil e=s)" % username) ###### # now set them as manager of this domain ###### eval("self.members.%s.manage_addLocalRoles(userid='%s',roles=['Manager'])" % (username,username)) return " " You might want to investigate alternatives to the eval bits though, could be a bit of a security problem. HTH Phil phil.harris(a)zope.co.uk -----Original Message----- From: Darran Edmundson <Darran.Edmundson(a)anu.edu.au> To: zope <zope(a)zope.org> Date: 14 February 2000 15:21 Subject: [Zope] Authenticating many users to manage only their own folders? >My first real foray into security ... > >root > People (define Admin role here) > robert > acl_users (robert,Admin) > douglas > acl_users (douglas,Admin) > william > acl_users (william,Admin) > . > . > >I want to configure my site such that users can only >edit their own property sheets. My naive way of >accomplishing this is to create an Admin role >in People's permissions that has management_screen >access. I then add a UserFolder in each person's >ZClass with them as the sole user (Admin role). > >It works but there are problems with my naive >approach: > >1) It's cumbersome. I have to create a UserFolder > and User for each person I add (though I guess > I can do this programatically in my constructor). > To create this, I need to allow UserFolder additions > in my ObjectManager-derived class. Now the logged-in > user also has UserFolders as an addable object ... > >2) Users can see the acl_users folder in the management > screen. They can delete it. And if I change Admin > so that they can't "delete objects", they can't delete > *any* objects, including instances of other objects > they've themselves created in this folder. > >It's 1:40am here in Oz and I'm shattered having taken >the day off from my "real" job to make it a long weekend >of Zoping. I'd love to awake in the morning to an email >chorus of advice. This has got to be a common-enough >scenario, authentication, not people skipping work to >Zope ... > >Cheers, >Darran. > > > >_______________________________________________ >Zope maillist - Zope(a)zope.org >http://lists.zope.org/mailman/listinfo/zope >** No cross posts or HTML encoding! ** >(Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

Re: [Zope] building a revisitable object list???
by Tres Seaver 14 Feb '00

14 Feb '00

Evan Simpson <evan(a)digicool.com> wrote: > ----- Original Message ----- > From: Tres Seaver <tseaver(a)palladion.com> > > That 'leaves.update(..}' is a really ugly workaround to the fact that > > PythonMethods won't allow the "natural" dictionary manipulation: 'leaves[ > > leaf.id ] = leaf'. While I understand not wanting to allow key > replacement in > > "global" dictionaries, can we lose this restriction for "local" ones? > > Yes we can, provided you code carefully. See my PROPOSAL: in Zope-dev a few > weeks ago. > > > (OTOH, we > > need to look at potential security issues around the use of update(), > too). > > Too true. Any exposed list or dict needs a sharp examination. > > Cheers, > > Evan @ digicool Hmm, maybe we need to wrap any "global" dictionary / list in a "readonly decorator", and let lists/dictionaries declared locally be the "normal" ones. Actually, looking at the stock Python UserDict, we could just wrap any dictionary exposed inside a PythonMethod (DTML, too?) in a UserDict: its __init__() method already makes a (shallow) copy of the dictionary passed to it. Any key assignments done would thus be localized (although mutable values inside the source dictionary could still be munged). Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

2 1

SQL Question - GUF related
by James W. Howe 14 Feb '00

14 Feb '00

I'm moving forward in working with the GenericUserFolder. I'm adding a database interface to pull user names out of a database table. I have created an MS Access database with a couple of users. I have created an ODBC connection object in my acl_users folder and tested it to make sure it works. I then created a SQL method called "getUserList()" which should answer a collection of user ids. Using the Test feature, I get back expected results. I tried to change the userList method defined for my GenericUserFolder to use these results. Basically I do the following: <dtml-return "getUserList()"> However, when I click on the UserList tab, I get no names. I've tested the SQLmethod and it works fine. I also created another method, called testList which just contains the following: jwh jorge If I use testList in my userList method, I get the expected results. I'm sure that I'm doing something stupid, but for the life of me I can't figure out why the userList method fails when I access a SQLMethod but not when I access a DTMLMethod. Another thing, if I try to "view" my userList method when it references the SQLMethod, I get a resource not found error, but when I view the method when it references a DTMLMethod, I get the two names. Any ideas on what is going on here? I'm assuming it has something to do with the way the SQLMethod answers its results? Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

2 1

Zope crashing with Z SQL Methods
by Richard Dougherty 14 Feb '00

14 Feb '00

Hi When I execute SQL (using a Z SQLMethod) which causes an error, Zope crashes. Errors include malformed SQL (if I make a typo, for instance), and inserting a duplicate primary key. This happens with more than one flavour of database (PygreSQL through ZPyGreSQLDA-rjr 0.3, and Gadfly). We're running Zope 2.1.2, but my sysadmin tells me this error has been happening with previous versions too. Our version is installed from RPMs, using PCGI+Apache. We also seemed to have this problem when we were using ZServer. Thanks for any help. Richard

1 0

GenericUserFolder Exception
by James W. Howe 14 Feb '00

14 Feb '00

In trying to figure out why I'm having trouble with GenericUserFolder, I finally got some useful information. When I try and display the userList, I'm actually getting an exception inside of GUF. The exception occurs on this line (137) of code from genericUserFolder.py: data = self.userList.im_func(self,self.REQUEST) The exception is an attribute error on im_func. Since I assume that this code must work in some environments I'm wondering if I just don't have something configured correctly. I'm still poking around trying to figure this stuff out and if I gain any more insight I will pass it along. In the meantime, if anyone has run into this problem before and knows how to correct the situation, I would appreciate hearing about it. Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

2 1

GenericUserFolder - Working now
by James W. Howe 14 Feb '00

14 Feb '00

I just got the GenericUserFolder to work under Zope 2.1.3. To make things work, I edited the code in GenericUserFolder.py and User.py and removed any reference to the im_func attribute. For example, in GenericUserFolder there was this line of code: data = self.userList.im_func(self,self.REQUEST) which always caused an exception. I changed it to this: data = self.userList(self,self.REQUEST) I also fixed places in User.py which referenced im_func. I simply removed the reference, restarted Zope and now GUF seems to be doing what I expect. Is there something about this version of Zope such that the im_func attribute doesn't need to be called? Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

1 0

RE: [Zope-PTK] PROPOSAL: A Confidence Mechanism in User Role Management
by Chip Vanek 14 Feb '00

14 Feb '00

I love this Confidence Rheostat! Along with an integrated content tagging framework you can really tailor security to need. Your POST via SSL & volatile cookie/tokens make it work. I just have couple of concerns and one addition. I am just seeing this thread so forgive me if this has been asked and answered. Would this mechanism allow for chaining of access requests? Something analogues to "Oh, you want to see THAT file, well I don't know but, I know you does, hang on.." So specific resources or capabilities would delegate access authorization to other systems. Can this dynamic security mechanism store different confidence levels for different conditions? Multiple user logon in one 6 hour period from client location in time zone 10 hours apart could trigger higher required confidence. With these type of fundamental security model changes it would be great to enable a very fine grained distributed security model. This would enable any system user to create, manage, and use system security capabilities. A user could then share one file from their Member Folder with other select system users. They could also allow only a subset of these users to "vouch" for access by other not originally on the list. This could be a very lightweight list of "locks" associated with each resource and list of "keys" associated with any consumer of a resource. Your SSL enabled creation of a cookie token would be just a special case of one of these "keys". Each "Key" would have a TTL and a set of resource locks it might be able to open. I am sure that all of this is way more then you had in mind to solve. At the least I would hope that this mechanism would allow any two portals to share the client cookies confidence level. I understand that there needs to be distinct cookies for each site and each client machine. The target would be to simplify the life of an honest users you is the member of multiple portal communities and uses multiple machines. A ring of cooperating portals could automagically generate a new cookie if a valid cookie from a brother portal was found. Actually this last idea seems totally undoable but, the need still exists. Sorry for the long message. In any case, if your proposal could be quickly implemented it would be so much better then the way things work now. Best, Chip Vanek chip(a)upcast.com >-----Original Message----- >From: zope-ptk-admin(a)zope.org [mailto:zope-ptk-admin@zope.org]On Behalf >Of Christopher Petrilli >Sent: Thursday, February 10, 2000 6:08 AM >To: Rob Page; Mike Pelletier >Cc: zope-ptk(a)zope.org >Subject: Re: [Zope-PTK] PROPOSAL: A Confidence Mechanism in User Role >Management > > >On 2/9/00 11:47 PM, Rob Page at rob.page(a)digicool.com wrote: > >>> So, if cleartext is less trustworthy because it's sniffable, it >>> follows that using cleartext once compromises the secure >>> channels as well, and so they should be no more trusted >than cleartext >> UNTIL >>> the password's been changed. Oh. But, if you are now >> less-than-confident >>> of the remote user, you can't let them change the password so as to >> become trusted >>> again! D'oh. Seems like a Catch 22, I must not be getting >something. >> >> This is a valid point. This is why many sites have you >login over SSL. >> Perhaps they assign you an expiring cookie which you can carry around >> and over unsecure channels. Ideally, password specification and >> password presentation are all done over secure comm - then you don't >> have to discount the confidence in the password as an accurate >> authentication mechanism. > >This is what I was mentioning at the bottom of another email, >which is that >you have the following chain of events: > > * User is presented a login form over HTTP > * Form is POSTED via SSL, which sets a cookie in the browser > * Cookie is volatile and used for auth during session > >The cookie must be something non-guessable, so I proposed the >following: > > base64(sha1(username + ip_address + random_int)) > >This gives you a token that should not be "guessable" and in >addition, as >long as you keep the random integer chosen around, you can >validate that the >cookie is valid using 2 options: > > * Recompute auth information and compare (the correct way, >long story) > * Store IP address and precalced cookie, and compare those. > >Chris >-- >| Christopher Petrilli Python Powered Digital >Creations, Inc. >| petrilli(a)digicool.com http://www.digicool.com _______________________________________________ Zope-PTK maillist - Zope-PTK(a)zope.org http://lists.zope.org/mailman/listinfo/zope-ptk

2 1

Re: [Zope] why use eGroups for the list archives?
by Willem Broekema 14 Feb '00

14 Feb '00

Hi Darren, The list is archived at more places, for example at http://marc.theaimsgroup.com/ (well, http://marc.theaimsgroup.com/?l=zope&r=1&w=2 to be exact :-) They have a bunch of archives of other lists, like Linux, PHP, Apache, KDE, SQL, PHP... You can even search in all, or in a section of some lists, which is very useful if you want info about, say, Zope vs. Midgard, as you will get results from both Zope as Midgard lists. (By the way, Google.com does a surprisingly well, too, returning many relevant mailing list posts) - Willem __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

1 0