- Zope - Zope lists

Sybase and DateTime.py: _validTime()
by Hung Jung Lu 04 Feb '00

04 Feb '00

Hi, There is a bug in \lib\DateTime\DateTime.py, this particularly concerns Sybase database users. In the lines: def _validTime(self,h,m,s): return h>=0 and h<=23 and m>=0 and m<=59 and s>=0 and s<=59 Please change s<=59 to s<60. This bug is causing Sybase to crash whenever a table contains a date value with s>59, e.g: s=59.23 regards, Hung Jung (I have submitted to the Zope bug collector) ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Zope HTML Quality
by Jacob Gorm Hansen 04 Feb '00

04 Feb '00

Hi, I noticed that the HTML generated by the Zope management interface is rather low quality, with lots of color,align, etc. attributes (which are deprecated in favor of CSS), and unclosed option tags etc. Of course I can fix this myself in my local Zope, but are there any plans to aim for, say, XHTML compliance? Keeping up with standards makes more sense than staying 100% compatible with obsolete browsers IMHO. Best regards, Jacob

4 4

RE: [Zope] Re: newbie questions about security
by Chris McDonough 04 Feb '00

04 Feb '00

It's not possible to do this with Zope permissions (or any other HTTP-based package permissions, AFAIK). In Zope, either a user can view the image or they can't based on their role memberships. Zope has no concept of where in the tree the user "is" when he calls an image. This is reasonable because an image isn't associated in any way with an HTML file in a request. When a user calls a for page in their browser, the HTML representing a page gets fed into the browser, and the browser calls the images up one-by-one independent of the HTML. A new session is established for each image brought up. Each session must either authenticate itself anew to the server or it must be allowed to access files on the web server without requiring credentials. Therefore, you have no way of determining whether the request to an image is associated with an earlier call to the HTML page or not (unless you use some sort of heuristics to determine timing between hits or something, which we don't). Am I misunderstanding the question? > -----Original Message----- > From: danny shevitz [mailto:danny_shevitz@yahoo.com] > Sent: Friday, February 04, 2000 2:11 PM > To: zope > Subject: [Zope] Re: newbie questions about security > > > Thanks for the response. You were correct about the > permission of /Root > versus /Home. After making /Root hidden to Anonymouse I > couldn't access > /Home because standard_html_header and footer were being > acquired. This > again shows that permissions are determined by the permission of the > parent in acquisition, not the child. > > I still have a question about setting up an /Home/img folder for > images. > I want to access the images from /Home but to not have them > be directly > viewable via a URL, e.g. /Home/img/image1. Is this possible? > > So far any combination of permissions that I have been able to come up > with between /Home/img, /Home/img/image1, and /Home/img/index_html has > the side effect that if /Home can access the image, so can the > Anonymous URL /Home/img/image1. I can independently set the permission > of /Home/img, just not the subimages. > > thanks, > Danny > __________________________________________________ > Do You Yahoo!? > Talk to your friends online with Yahoo! Messenger. > http://im.yahoo.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] Re: newbie questions about security
by danny shevitz 04 Feb '00

04 Feb '00

no, you aren't misunderstanding. You answered my question. I'm a newbie, not just to zope but to web authoring as well. So I have and answer to my question, and realistically, if a user can view the image directly it's no big deal. It just seems a little weird that by definition you can directly view a company logo if it appears on a homepage. After this discussion I guess the question could be rephrased simpler as: is it possible to view an image in another document, but not directly? thanks, Danny __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

1 0

Re: [Zope] SybaseDA-2.0b2-src.tgz
by Hung Jung Lu 04 Feb '00

04 Feb '00

>From: Christopher Petrilli <petrilli(a)digicool.com> > >Can you please specify what the exact behaviour problem IS? We treat any >NUMBER data type with DECIMAL(10,0) or greater as a python long because it >can not be represented accurately in a 32-bit integer. The option (as was >treated before) is to return a float, but this is losing accuracy. ---------------------------------------------------------------- :) Sure enough, the DECIMAL data type problem persists in SybaseDA-2.0b2. ---------------------------------------------------------------- :) I nagged quite a bit in the zope mailing list about the SybaseDA DECIMAL data type problem, even posted a patch for it. Chris McDonough was kind enough to send everything to the Collector, too. The relevant threads can be views at Egroups.com under http://www.egroups.com/group/zope/showthread.html?start=21025 http://www.egroups.com/group/zope/showthread.html?start=21108 ---------------------------------------------------------------- It is very easy to cause the crash. Install your SybaseDAv2, restart Zope, create (add) an instance of "Sybase DataBase Connection", click on it, make sure that is it connected. Now, go to the "Test" tab, issue the SQL command: create table test (id decimal(10)) Hit "Submit Query". Good. The table is created. Now, go to the "Test" tab again, issue the SQL command: select * from test Voila, crash. Error Type: sy_occ.error Error Value: Invalid buffer element type ... File /usr/local/bs_zope/lib/python/Products/SybaseDAv2/db.py, line 239, in query sy_occ.error: (see above) The error does not happen when you have 9 or fewer digits in your DECIMAL data type declaration. ---------------------------------------------------------------- How to fix it? Simply follow the instructions given in my posting (the message number 21108 with the URL provided above.) Of course, I don't know what other data type problems the adapter might have, nor whether my patch was done properly or not. But at least for now, it works for me. :) regards! Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re. Scheduler product, anyone?
by Jerry.Spicklemire＠IFLYATA.COM 04 Feb '00

04 Feb '00

I had to do this just yesterday, and the urllib.py module made it absolutely painless. Here's the simplistic little script I came up with, whcih could be called by cron, or some other task manager. Later, Jerry S. --------------------------------------------------- """ urlgrabr.py is a simple script to hit an URL, retreive the generated output, and manipulate it, e.g. save it as a file, python urlgrabr.py http://server/folder/object file=filename.html based on parameters. Default is simply to request the URL, and exit, dumping all data. """ import urllib import sys import string c_url = sys.argv[1] c_action = None u_url = urllib.urlopen(c_url) if len(sys.argv) > 2 : c_action = sys.argv[2] if string.lower(c_action[:5]) == "file=" : f_action = open(c_action[5:], "w") # file name for l in u_url.readlines() : if string.strip(l[:-1]) : f_action.write(l) f_action.close()

1 0

Re: newbie questions about security
by danny shevitz 04 Feb '00

04 Feb '00

Thanks for the response. You were correct about the permission of /Root versus /Home. After making /Root hidden to Anonymouse I couldn't access /Home because standard_html_header and footer were being acquired. This again shows that permissions are determined by the permission of the parent in acquisition, not the child. I still have a question about setting up an /Home/img folder for images. I want to access the images from /Home but to not have them be directly viewable via a URL, e.g. /Home/img/image1. Is this possible? So far any combination of permissions that I have been able to come up with between /Home/img, /Home/img/image1, and /Home/img/index_html has the side effect that if /Home can access the image, so can the Anonymous URL /Home/img/image1. I can independently set the permission of /Home/img, just not the subimages. thanks, Danny __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

1 0

What's wrong with this code?
by Helge Tesdal 04 Feb '00

04 Feb '00

This is a part of the navbar on our site. When I try to access this directly through a folder (without the header), Zope seems to go into an seemingly infinite loop. Let's call the navbar 'test', and put it in the root folder. It contains the code below. Then make a folder testfolder, and call the navbar like this http://machine/testfolder/test On our machines, Zope goes into an infinite loop. By removing lines, it seems to recover from the "loop" more quickly. Seems like a n^x loop, where n is the number of lines. By removing the <dtml-in PARENTS skip_unauthorized> part it works. Is this somehow iterating all the lines in the dtml-method? Normally this is not a problem, as the header adds the <html> tags, which seems to make it work, but what worries me is that anybody can stop our site by trying to access this directly. Here's the code of the navbar: <dtml-unless expr="PARENTS[0]==PARENTS[-1]"> <dtml-if "meta_type == 'Artist'"> <dtml-call "REQUEST.set('artist_alias', id)"> <dtml-else> <dtml-in PARENTS skip_unauthorized> <dtml-if "meta_type == 'Artist'"> <dtml-call "REQUEST.set('artist_alias', id)"> </dtml-if> </dtml-in> </dtml-if> </dtml-unless>  <table border="0" width="100%" bgcolor="#000000" cellspacing="0" cellpadding="0"> <tr> <td width="100%"> <table border="0" width="100%" cellspacing=1 cellpadding=3> <tr bgcolor="#7D8DAF" align="center" valign="center"> <td width="100%">Manager-meny</td> -- Helge Tesdal tesdal(a)stud.ntnu.no

2 4

Renaming Properties
by James W. Howe 04 Feb '00

04 Feb '00

Is there some way to rename a property of a ZClass other than deleting the property and adding an new one of a different name? I've been working on a ZClass and have several instances in my database. I've now learned some more things about my domain and realize that some of the names of my properties should be different. Is there an easy (or moderately easy) way to accomplish this? Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

1 0

Newbie: Create items in Zope from external form?
by Chip Vanek 04 Feb '00

04 Feb '00

Hi, I have a simple question (I hope;) How do you create a DTML method item in Zope from an external form? I would like to allow users to create items in their home Zope folder using a post form from without logging into Zope first. The form itself could be served from the Zope server. I know that you can pass the login information in the URL but, what should the the DTML method look like to take variables from the posting form and writing a new DTML method in the users home folder? I would like to create a form and post to URL like below and get back a confirmation message from Zope that it worked OK. http://host.dom.com:8080/Members/user/createItem?__ac_name=uname&__ac_passwo rd=pwd Thanks for any pointers you provide. I have read all of the documentation on Zope.org, understand a fraction of it and have a site up and running. The mailing lists have been great to work through other problems I had but specific pointer would help now. Chip Vanek e-Mail: chip(a)upcast.com Office: 650-625-8929

1 0