- Zope - Zope lists

Re: [Zope] some newbie quesions...
by Juri Jensen 06 Feb '00

06 Feb '00

>> 2. Alongside with this I've got a webforum based on the Perl-based Sporum. >> Does any product exist with the same features as Sporum? I would like to keep >> it all Zope-based (more control, easier etc.). > >There are a couple of Zope products which could help you here: > Squishdot implements a Slashdot-style weblog >(http://www.zope.org/Members/butchland/Squishdot) > KM|NetNews implements a CNN|News-style site >(http://www.zope.org/Members/tazzzzz/kmnn) Thanks, but unfortunately It's not that kind of forum I'm looking for. I need some features like dividing in categories, subscription for mail delivered digests, etc. I will use the Squishdot product to present news etc. >Hope this helps! >Tres. -- mvh./Best regards Juri Jensen ----------------------------------- Pingvin Partner - Linux løsninger email: juri(a)jones.dk -----------------------------------

1 0

CERT -- Malicious HTML Tags
by Tres Seaver 06 Feb '00

06 Feb '00

CERT has released a fairly dire advisory on the dangers of dynamic page generation when coupled with untrusted content submission: http://www.cert.org/advisories/CA-2000-02.html Anyone care to comment on Zope's vunlerability here? For instance, the ZGotW site allows submissions in structured text, plain text, and HTML -- but now I am probably going to htmlquote() the last, which kills a lot of the point of it, no? The key issue lies in embedding <SCRIPT>...</SCRIPT> chunks (or their immoral equivalents, <OBJECT>, <EMBED>, and <APPLET>). Consider, for instance, those nasty pop-up windows launched by some "free" webspace providers; then consider what happens in Squishdot, ZGotW, or any other site which permits users to enter arbitrary HTML as part of the feedback/collaboration process. Not a pretty scene! Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

8 8

New HowTo: Gain Enlightenment by Grokking Object Orientation
by Chris McDonough 06 Feb '00

06 Feb '00

I've put up a new HowTo at http://www.zope.org/Members/mcdonc/HowTo/gainenlightenment titled "How To Gain Enlightenment By Grokking Object Orientation". It's useful if you're a Perl or ASP programmer first coming to Zope or if object oriented programming is new to you. -- Chris McDonough Digital Creations, Inc. Zope - http://www.zope.org

1 1

Re: [Zope] some newbie quesions...
by Tres Seaver 06 Feb '00

06 Feb '00

Juri Jensen <juri(a)jones.dk> wrote: > What I need is: > > 1. A way to let the users subscribe to get a login and a password. They > fill in their e-mail address and a name, and get a mail with a password random > generated. Their request should be checked by someone in charge before they'll get > authorized. The "real" answer to your prayers is the Portal Toolkit, which DC is rolling out as an alpha release as we speak. The only issue is that it is not-yet-ready-for-prime-time. See http://www.zope.org/Products/PTK Phil Harris had a nice "first cut" at this problem in his zGold product -- unfortunately, it seems to have dropped off the 'Net. The last email address I have for Phil is phil.harris(a)zope.co.uk; the last known whereabouts of zGold was: http://media-1.ml.uwcm.ac.uk:8080/zGold > > 2. Alongside with this I've got a webforum based on the Perl-based Sporum. > Does any product exist with the same features as Sporum? I would like to keep > it all Zope-based (more control, easier etc.). There are a couple of Zope products which could help you here: Squishdot implements a Slashdot-style weblog (http://www.zope.org/Members/butchland/Squishdot) KM|NetNews implements a CNN|News-style site (http://www.zope.org/Members/tazzzzz/kmnn) Hope this helps! Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

4 4

filling ZClass addForm with default values?
by Darran Edmundson 06 Feb '00

06 Feb '00

In addition to defining the various names and types of my ZClass's properties in its property sheet, I have also set a few default values. The question is: what is the easiest way of getting these default values to show up in the class's addForm? Is it necessary to use a fully qualified path from the ZODB root, e.g., something like <dtml-var "Control_Panel.Products.MyProduct.MyClass.propertysheets.common.Basic.prop1" > Generall speaking, I seem to have problems referring to data in the Products hierarchy. As always, any help is much appreciated. Cheers, Darran.

1 0

Building tables with dtml
by Berthold Stoeger 06 Feb '00

06 Feb '00

Hello, zope gurus! I've run into yet another newbie problems trying to build tables with DTML: * I need to know which position in the current batch i'm rendering. for this i use the expression: _['sequence-index'] - _['sequence-step-start']. Isn't there something easier? And btw sequence-step-start is not documented => this cost my some nerves. * The tables i build should always have the same numbers of lines, filling the rest of the table with empty lines if necessary. the code i use goes like this (inside dtml-if "sequence-end"): <dtml-in "_.range(_['sequence-index'] - _['sequence-step-start'] + 1, tablesize - 1)"> <dtml-var "standard_empty_line(_.None, _, num=_['sequence-item'] )"> </dtml-in> Again, couldn't this be done more easily? What about implementing 2 new modes: one which calls the <dtml-in> body exactly size times, and sets sequence-item to None when no more lines are available and another one which lets the last batch fit exactly? * I use dynamic dtml-methods to build the tables, and sometimes need more than 1 table per document. So it is very important, that i can use dynamic variablenames. but using start="_[varname]" did not work. Is there a way to do this? if not, would a patch that fixes the problem go into release or would i have to patch every new version of zope? * How can i use dynamic C-formats with dtml-var? I build the table from table definitions, containing a format string. Do i have to use DocumentTemplates? * I noticed that when throwing an error inside a <dtml-in previous|next> tag, the dtml-else path gets executed. i find this annoying as it makes debugging pretty hard. sorry, if all these are faqs... cu, bertl ps: please answer via private mail, i cant follow the list because the disk of the mailserver im using is full since 2 days :(

1 0

Re: [Zope] Malicious HTML in (Squishdot) postings
by Tres Seaver 05 Feb '00

05 Feb '00

Squishdot <squishdot(a)yahoo.com> wrote > Hi all, > > CERT has issued a security advisory regarding improperly checked output from dynamic > pages. > > The CERT advisory can be found at: > > http://www.cert.org/advisories/CA-2000-02.html. > > Unfortunately, Squishdot is vulnerable to such problems. However, I (and others in the Zope > community) am trying to find a permanent solution to this. Of course, your help is also > welcome (code patches accepted :^)) > > While each site (e.g. depending on the audience, accessibility, amount of traffic) is vulnerable > in varying degrees to these types of problems, I would urge each administrator to evaluate > their own security policies regarding these problems and take steps appropriate for their own > circumstances. > > In the meantime -- temporarily -- the best way to deal with the problem is to turn moderation > on for everything, and then properly check each posting manually. > > Regards, > > Butch What we need is a handy-dandy-clean-up-user-submitted-HTM-to-take-home-to-Mama function, coded in Python. It would need to strip out / quote ANY "unapproved" tags (for structured text, would it be enough just to quote "&", "<", and ">"?). The list of allowable tags might be passed in as a list, but a first cut could just hardcode "[ 'em', 'strong', 'ul', 'ol', 'li', 'dl', 'dt', 'dd' ]" (or whatever) and be fine. Anyone feel inspired to write it? -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

1 0

Problem with Properties and Methods
by Borno Janekovic 05 Feb '00

05 Feb '00

Hi, I think again a simple quuestion. In a dtml-document I am calling a dtml-method from a subdirectory <dtml-var "directory.method()"> In the subdirectory the method is looking like: <td colspan=3 bgcolor="<dtml-var color_number>"> color_number is a property in the root directory - with type string and value "#eeeecc" If I test the method directly with view it works correctly If I call it in the document from the rootdirectory I get the following error ---------------------------------------------------------------------------- Error Type: KeyError Error Value: color_number Troubleshooting Suggestions This resource may be trying to reference a nonexistent object or variable color_number. The URL may be incorrect. The parameters passed to this resource may be incorrect. A resource that this resource relies on may be encountering an error. For more detailed information about the error, please refer to the HTML source for this page. If the error persists please contact the site maintainer. Thank you for your patience --------------------------------------------------------------------------- What am I doing wrong? Should I better use a dtml-method on in the root directory or why should I use properties? Thanks Borno -- Sent through Global Message Exchange - http://www.gmx.net

2 1

some newbie quesions...
by Juri Jensen 05 Feb '00

05 Feb '00

Hi, I'm pretty new in this zope world (just played with zope for a week), and I'm also new in the world of programming (I started working with Python a month ago), but I hope that someone could shed some light on how I should solve this problem: I've been working on this pilotproject consisting of a website with documentation only avaiable for authorized people (with a username and a password). The documentation content is variable and should be easy to alter just by placing a new (or revised) document in the right scetion, and voila! the new documentation is avaiable. I started out making som scripts in Python doing the building of a new index.html based on the contents of a section. But if the were any changes in the look of the site, I would have to change the scripts :-( So I stumbled over Zope. Thank God for that (and all you people who created it of course!!). This seems to be the ideal solution. But as the documention to zope is not that matured, it's quite hard for me to find out how to build this. Therefore I'm asking you for some help. Normally I would work with it untill I get a hang af it, but I have a deadline for a working demo hanging over my head, and I really believe that Zope is the right solution. What I need is: 1. A way to let the users subscribe to get a login and a password. They fill in their e-mail address and a name, and get a mail with a password random generated. Their request should be checked by someone in charge before they'll get authorized. 2. Alongside with this I've got a webforum based on the Perl-based Sporum. Does any product exist with the same features as Sporum? I would like to keep it all Zope-based (more control, easier etc.). I hope someone can point me in the right direction (with som codesnippets or links to HOWTOs etc.). Thanks! -- mvh./Best regards Juri Jensen ----------------------------------- Pingvin Partner - Linux løsninger email: juri(a)jones.dk -----------------------------------

1 0

YANQ (Yet another newbie question)
by John E. Vincent 05 Feb '00

05 Feb '00

Okay I've got products down pretty good but I can't find what I want to do in any documentation. I have a feeling this simply a matter of semantics and I don't know exactly what to look for when searching. What I want to do is call a product I've created from a link or via a URL. What should I be searching for? Are there any specific security concerns calling something this way instead of via normal methods. It would really make the application I am working on easier. Thanks in advance -- John E. Vincent http://www.lusis.org - opensource(libre) webhosting http://www.jyradelix.com - Jyradelix Designs http://www.lusis-integrations.com - Lusis Network Integration Consultants --------------- "Some people call me crazy but I prefer to think of myself as a freelance lunatic" - me

1 0