- Zope - Zope lists

Re: [Zope] dtml-with & misbehaving strings
by Thomas 02 Feb '00

02 Feb '00

Thank you very much Jim for the clear answer. One last problem. If I want to iterate through this list, ie the depth of my drilling is NOT fixed, is there a simple way to do this via dtml. I want the following: <dtml-with "_.getattr(_[myproperty[0]], myproperty[1],.....,myproperty[x])"> Some reason tells me this is not possible with dtml alone. Is it time for me to give up and start hacking it with an external method? Thanks again for your help, Thomas <snip> Yup. The namespace lookup expression: "_[name]" takes a single name, but you have given it a string containing two names. I suggest that "Games.Whatup" is really a path expression. (Note that dots are legal in Zope names and therefore not a good choice for path separators, but that's beside the point.) There isn't a general way, in DTML currently to take a string containing a path and convert it two an object. (If there was, it would use '/'s as path sperators, as in "Games/Whatup".) Now, suppose your property was defined with "lines" or "tokens", which is a list of strings, and that you know that it always contained a two-part path, then you could use something like: <dtml-with "_.getattr(_[myproperty[0]], myproperty[1])"> This gets the name from the namespace corresponding to the first element if myproperty and then gets an attribute from the resulting object using the second element. </snip>

1 0

Problem with ZODBCDA installation.
by Robert Geiger 02 Feb '00

02 Feb '00

I have followed the directions with the ODBC adapter to no avail. I place it in the top level zope dir on NT server machine and restart. This is all the instructions say to do. I do not see the adapter. What else do I have to do to get this to work??? Thanks in advance for any assistance.

2 1

Usage of AUTHENTICATED_USER
by Shane Hathaway 02 Feb '00

02 Feb '00

Zopistas, I've been beating my head on the wall about this issue for weeks now. I need to be able to access the User object so that I can run a has_permission check in Python. However, I haven't been able to find a reliable way to access the current authenticated user in Python code. In fact, I have found a small security hole. If a user has permission to add folders, there is nothing stopping the user from putting their own default User Folder in it. There is a check that is supposed to prevent that depending on permissions, but it's easy to circumvent. This is unlikely to be a major issue so I'll just say what's involved in exploiting the hole. The manage_addFolder method, used to create a new folder, takes the current REQUEST as an argument. All one needs to do is call manage_addFolder without a REQUEST argument, and the extra security checks are disabled. Thus anyone who can create folders can also create default user folders. The issue is that there is no apparent way for a method such as manage_addFolder to get the current User object to perform a proper security check. Getting it using REQUEST['AUTHENTICATED_USER'] isn't reliable. In fact, it is possible to call <dtml-call "REQUEST.set('AUTHENTICATED_USER', bogusSuperUser)"> which works but fortunately doesn't have much effect at present. (bogusSuperUser would be a folder with DTML methods has_permission, has_role, validate, etc. and would masquerade as a SuperUser object.) Summary: I need to perform extra security checks similar to what manage_addFolder does, but it must be secure, unlike manage_addFolder. All advice is welcome. Shane Hathaway

1 0

IE 5.0 and Session Management.
by Timothy Grant 01 Feb '00

01 Feb '00

Hi all, I just got bit by a really interesting something, I have a resolution, but I'd like to get a resolution to the problem. I do all my development work on Linux using Netscape Navigator. My client has Netscape running in their home office. Everything works great on my machine and on my clients machines in their home office. However... ...They have another office that is currently running IE5.0 everywhere. My programme crashes beautifully when run under IE5.0. I think the problem has something to do with cookies and Session management, but am at a loss as to just what is wrong. Here's the details: I use SQLSession for session management. It works great for all my users on Netscape, if I display the entire request using <dtml-var REQUEST> I see the SESSION key and all of its contents. If I'm on IE5.0, and go to the same URL, the SESSION key appears to be completely empty. I have turned off *all* security settings on IE5.0 just in case it was a security issue, but to no avail. Any ideas would be phenomenally appreciated. -- Stand Fast, tjg. Chief Technology Officer tjg(a)exceptionalminds.com Red Hat Certified Engineer www.exceptionalminds.com Avalon Technology Group, Inc. (503) 246-3630 >>>>>>>>>>>>Linux...Because rebooting isn't normal<<<<<<<<<<<<

1 0

Re. Question on Folder Structure strategy
by Jerry Spicklemire 01 Feb '00

01 Feb '00

Just to second Evan's motion, "site relative" links will make it much easier to move the Zope pieces you're building to another Zope instance, if and when the time comes. It's pretty painless to simply "Export" a subfolder, and then "Import" into another Zope, knowing that everything will still work, even though the DNS address, and name (alias), of the host has changed. This is quite common in a corporate environment with separate dedicated host machines, e.g., development, testing, and production. In this case only the latter would be a live Web server with real end users hitting Zope "pages", as opposed to us synthetic developer, and tester types. If you use absolute paths, you'll either have to go through all those hard coded addresses, and change them, which is nothing but completely avoidable drudgery, when you use the "site relative" approach. Sure, you could keep your systems on separate LANs that can't "see" each other, or do some fancy DNS manipulations and redirections so you can have duplicate names on different host machines. This latter notion isn't all that uncommon, Network Address Translation (NAT) has lot's of appropriate uses, but in this case it would just make your life unneccesarily more complicated than it needs to be. I've moved data from my desktop Zope (Win '95), to a testing host (NT), and finally to Sun Solaris, without having to change anything! Don't ask why we're not using Linux, it makes me very grumpy . . . Later, Jerry S.

4 4

ZClass Inheritance
by Robert W. Erb 01 Feb '00

01 Feb '00

My question concerns the arrangement of ZClasses derived from other ZClasses I've defined. <pre> If I have: product ZMyProduct class ZMyClass defined in ZMyProduct class ZMyChildClass based on ZMyClass, also in ZMyProduct class ZMyGrandChildClass bases on ZMyChildClass, also in ZMyProduct I end up with one product, ZMyProduct, with three ZClasses defined in it. Is this the correct way to this kind of thing? Is there a way to prevent the product from getting cluttered with ZClass definitions? </pre> Thanks. -- bob

1 0

sql method attributes
by Joseph Kocherhans 01 Feb '00

01 Feb '00

Hello, I read some place that a ZSQL method can get attributes from two places: variables and through HTTP. If I use something like method?argv=argv it works fine. But I also have argv defined as a property. For some reason the method doesn't recognise this. Is my understanding of how ZSQL methods are supposed to work flawed? In other words how can I pass an argument to a ZSQL method without having to include it in a URL or a form. Thanks, -Joseph Kocherhans

1 0

Need some help wrt URLs and methods...
by Tony McDonald 01 Feb '00

01 Feb '00

Hi all, I have a (very heavily used) system that allows downloads of many different file types from a filesystem (ie located outside the Zope system) to people. The URLs are somwthing like http://blah/blee/get_file?filenumber=213 get_file is an external python method that does all the good stuff of database lookup and logging off downloads. The system gets the file from the unix filesystem and does some machinations with headers such as contennt-type and content-disposition to *try* and get the browsers to behave themselves. What I'd like to do is have something like http://blah/blee/get_file/results.rtf which helps to make the browser download the file correctly. The problem is that the Zope system says that the URL doesn't exist. Is there any way around this (I know that ZSQL methods manage it with traversal, but I can't figure out how to do it with this setup I have). Any thoughts gratefully received! :) Tone

2 1

user Nobody?
by addyd＠unk.edu 01 Feb '00

01 Feb '00

Did I just read somewhere that beginning with a recent Zope release that the server no longer runs as user Nobody (for security reasons)? I've read so much stuff on Zope in the last week that I don't remember where I saw that or what it now runs as. Assuming someone gives me that name (please?) does that mean that the install HOWTO is already out-of-date (last modified 1/17/2000) and I need to substitute the new name for everywhere the HOWTO says "user nobody"? Or do I still follow the HOWTO to the letter? I'll be using 2.1.2 on LinuxPPC (Python 1.52). Many thanks! Darren Addy University of Nebraska at Kearney

2 1

RE: [Zope] DCOracle for 8.1.5 (8i)
by Michel Pelletier 01 Feb '00

01 Feb '00

I don't know what the status on 8i compatability is, have you tried it? It might just work. Note that Oracle's client libraries change in non-backwards compatable ways quite often. You many need to make minor adjustments to the code. We do not have 8i, and the only way we're going to look at it is if one of our customers requires 8i compatability or wants to specificly pay for 8i integration. -Michel > -----Original Message----- > From: zwang(a)turbolinux.com [mailto:zwang@turbolinux.com] > Sent: Friday, January 28, 2000 1:14 PM > To: zope(a)zope.org > Subject: [Zope] DCOracle for 8.1.5 (8i) > > > Does anyone here know when will the Adapter for Oracle 8i be > ready for us to > use? Any plan at all? If there is any, what is the time frame? > > Thanks. > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

4 3