- Zope - Zope lists

Re: [Zope] Session Management
by Anthony Baxter 05 Jan '00

05 Jan '00

>>> Pavlos Christoforou wrote > There is no global namespace pollution really. FSSession stores all > session info in a mapping object that does not participate in Zope's > transaction machinery. When FSSession is initially called the mapping > object is populated with the session info, which can be accessed like: > <dtml-var "FSSession['info']">. Ah - so rather than calling the session object, then looking up in REQUEST.SESSION, you just look up in the session object? Would it be possible to support both of these methods of operation? If you call the session object, it creates REQUEST.SESSION. If you call it's __getitem__ type methods, it does it directly. > At the end of the request, if any session data were modified/added then > the mapping object is marshalled back on the filesystem. Thus all the > session info is only visible through the FSSession object and its methods, > and changes are stored only once, at the end of a succesful request. *nod* ok, so you're only doing a single write? This is something I intend to fix in SQLSession, somehow - all changes to the session only get sent to the DB at the end, rather than straight away, as now. This means that if a value is changed 10 times during a request, 10 delete/inserts will happen. Fixing this safely is hard, and it's not something that's causing me a lot of problems right now, so I'm not too worried about it. > The reason I chose this approach over the SQLSession one is that this > allows one to get away with having to call the Session management object > before it can be used. Even though FSSession now requires one to call > FSSession initially, the mapping object methods can be rewritten to check > whether the session info has been loaded or not and act accordingly, thus > eliminating the need to call the session object first. I always put the call to the session object in my standard_html_header, so this isn't a problem. I'd _like_ to think that some time in the future there'll be some sort of session support bolted into the core of Zope, so that the session gets automatically called. (I tried using a 4am access rule, but this played badly with things - in particular, it shredded the management interface.) > Agreed. All the session values are in FSSession but the Session ID is used > often enough and having it in the REQUEST object makes things more > convenient. I prefer typing: > <dtml-var SessionUID> rather than <dtl-var "FSSession['SessionUID']">. No > big deal really. I can remove it if you think is unneccessary. Fair enough - I'm suprised that it's getting used that much, I only added SESSION.getName() in the last release (there'd been no requests for it before then). Is this for the session-in-url thing? > > [ url() method ] > This is mainly a convenience function (PHP session manager includes > something similar I believe). It was requested by a Zopista so I added > it. It is not really meant to be used as the default method. Most of the > times the programer will decide explicitly how to pass the sessionID > around. Fair enough, I guess. > Mashal vs cPickle ... > > My tests show that for a fairly complex structure marshal is roughly 2x > faster than cPickle in dumping objects and 3x in loading objects. I > figured in the rare cases that one needs to store more complex structures > than marshal supports, one can use a simple external method that > takes an object as an argument and returns the pickled string. I originally looked at marshal - but one of the earlier things I wanted to cache in a session was the result of an sql method. therefore I went with pickle over marshal. I'm also not convinced that the pickle/marshal difference isn't going to just be miniscule compared to the time to pull the session data off disk, or out of a DB - in general we're talking really small things. > And I will agree with you that an easy way to inspect session info is > nice. My approach is to include a simple utility with the distribution > that can pretty print session info from the command line. I wouldn't want > to use a less efficient internal represenation though. I was thinking about making it an option - that way, if you wanted to write an SQL process that went through the DB looking for objects that match a particular attr=value, you don't have to deal with decoding the objects yourself. It's no biggie for me right now, though, so unless someone submits a patch, it will stay on the todo list. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

Help! Import Problem
by Michael Fox 05 Jan '00

05 Jan '00

Hello, I am currently trying to import a Zope export from the same Zope Site when I receive the following message: Type Exists The permission Add FlexQuestions is already defined. It doesn't seem to import at all. Has anyone else encountered this error? Help is much appreciated. Regards, Michael Fox

1 0

Re: [Zope] Setting session data based on IP address?
by Anthony Baxter 05 Jan '00

05 Jan '00

>>> Timothy Grant wrote > As I have been working on this project, I have come across a situation > where it might be nice to automatically set some session information > based on the location of the user. (This app will be used across three > different locations). You need to think about what 'location' means. Does it mean 'the address of the user'? Does it mean 'the reverse lookup (or part thereof) of the IP address of the user'? Could you instead do it with multiple CNAMEs pointing at the zope server, then do it by looking at HTTP_HOST? (eg www.loc1.yourcompany.com, www.loc2.yourcompany.com, ...) > My first thought was using IP address, but there is a good chance that > at least one of the locations will be using a dial up account. Is there > an invisible way of doing this? It depends on the value of 'this' really :) Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0

Setting session data based on IP address?
by Timothy Grant 04 Jan '00

04 Jan '00

Hi again, As I have been working on this project, I have come across a situation where it might be nice to automatically set some session information based on the location of the user. (This app will be used across three different locations). My first thought was using IP address, but there is a good chance that at least one of the locations will be using a dial up account. Is there an invisible way of doing this? -- Stand Fast, tjg. Chief Technology Officer tjg(a)exceptionalminds.com Red Hat Certified Engineer www.exceptionalminds.com Avalon Technology Group, Inc. (503) 246-3630 >>>>>>>>>>>>EXCEPTIONAL MINDS, INNOVATIVE PRODUCTS<<<<<<<<<<<<

1 0

Zope Qube
by Joshua Brauer 04 Jan '00

04 Jan '00

Anybody here put Zope on a Qube from Cobalt? Suggestions or ideas would be appreciated.... # # # _____________________________________________ Joshua Brauer Box 915 http://www.brauer.org Fort Collins, CO 80522 Fax: (419) 793-4120 _____________________________________________ In flying I have learned that carelessness and overconfidence are usually far more dangerous than deliberately accepted risks. -- Wilbur Wright in a letter to his father, September 1900 ____________________________________________________

2 1

SECURITY ALERT
by Christopher Petrilli 04 Jan '00

04 Jan '00

Ok, now that we've got your attention... Thanks to Kevin Littlejohn's sleuthing, a sizable problem in the security machinery in DTML has been brought to our attention and resolved. Without delving too deeply into the obtuseness of the problem, let me first say that this is 1) very critical, 2) has an urgent fix. This problem is of most concern to anyone who opens their Zope site up to the general public (a'la zope.org) as it could allow "anonymous" people to do things which are most definitely not allowed. Unfortunately it was introduced many releases ago, but to our knowledge this is the first time anyone has discovered this problem. Fixes are contained in the CVS repository as well as: Zope 2.1.2 http://www.zope.org/Products/Zope/2.1.2/ Patch to 1.10.3 http://www.zope.org/Products/Zope/2.1.2/1104_patch.html It is important to note that the patch to 1.10.3 has some performance impact on users of this release. Unfortunately, we are no longer able to provide equal levels of support for users of 1.x and 2.x implementations of Zope. If there are reasons that your site is unable to transition to 2.x, please let us know so that we can work to resolve them in future releases so that we can finally retire the old 1.x line of code. If you have any questions regarding the impact to your site of the changes, please send them to support(a)digicool.com Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

1 0

Help: Apache Rewrite with RH6.1
by Guy Davis 04 Jan '00

04 Jan '00

I am not having much luck getting mod_rewrite to work with Zope. I am using Apache 1.3.9 and Zope 2.0.1 from rpm. If I turn off rewriting, I can access http://servername/cgi-bin/Zope.cgi just fine and I can get to the management screen. However, I'd like the rewrite to work. Right now all it returns with rewrite on is: Forbidden You don't have permission to access / on this server. Apache/1.3.9 Server at caldhcp082.arc.ab.ca Port 80 I have tried the following in httpd.conf: RewriteEngine on RewriteLogLevel 9 RewriteLog /var/log/httpd/rewrite_log RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule ^(.*) /home/httpd/cgi-bin/Zope.cgi$1 \ [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] as per the instructions found at: http://www.zope.org/Members/cavnit/apachevirt When I do this, the httpd error_log shows the following: [Tue Jan 4 14:03:38 2000] [error] [client 128.144.2.51] Options ExecCGI is off in this directory: /home/httpd/cgi-bin/Zope.cgi However, my httpd.conf contains: <Directory "/home/httpd/cgi-bin"> AllowOverride None Options ExecCGI FollowSymLinks Order allow,deny Allow from all </Directory> The rewrite log contains: 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (2) init rewrite engine with requested uri / 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (3) applying pattern '^(.*)' to uri '/' 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (4) RewriteCond: input='' pattern='^(.*)' => matched 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (2) rewrite / -> /home/httpd/cgi-bin/Zope.cgi/ 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (5) setting env variable 'HTTP_CGI_AUTHORIZATION' to '' 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (2) remember /home/httpd/cgi-bin/Zope.cgi/ to have MIME-type 'application/x-httpd-cgi' 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (2) local path result: /home/httpd/cgi-bin/Zope.cgi/ 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (1) go-ahead with /home/httpd/cgi-bin/Zope.cgi/ [OK] 128.144.2.51 - - [04/Jan/2000:14:03:38 -0700] [caldhcp082.arc.ab.ca/sid#815eed4][rid#8162ef4/initial] (1) force filename /home/httpd/cgi-bin/Zope.cgi to have MIME-type 'application/x-httpd-cgi' Any ideas? Thanks. -- Guy Davis mailto:davis@arc.ab.ca (403) 210-5334 Alberta Research Council

1 0

RE: [Zope] IE 4/5 error
by Martijn Pieters 04 Jan '00

04 Jan '00

> > You HTML would look something like this: > > > > <td align="right"> > > <form method="POST" action="Tickets/TicketForm"> > > <input type="submit" value="Scale Entry"></form> > > </td><td valign="bottom"> > > This is good information to have thank you. > > But in instances like a DB query form where you might use the > same form > to perform a search, or a record update or add a new record, it is > acceptable form to use the :method method? Yup, that would be a good example. I have also used it several times in a 'Are you sure' question. Yes would submit the form with hidden data, No would send the suer back to the form they were filling in, so they can correct.

1 0

RE: [Zope] Solaris 8 issue?
by Michel Pelletier 04 Jan '00

04 Jan '00

> -----Original Message----- > From: Richard Otten [mailto:rotten@colltech.com] > Sent: Tuesday, January 04, 2000 3:02 PM > To: zope(a)zope.org > Subject: [Zope] Solaris 8 issue? > > > Hi, > > I recently (earlier today) installed Zope for the first time. > I am installing it on an Ultra 1, running Solaris 8. > > For my first attempt, I installed the Solaris 2.6 binary version. > It seems to start correctly, however I do get this error when it > kicks off: > > 2000-01-04T19:33:37 PROBLEM(100) ZServer Computing default hostname > > So, not sure what might cause this error I blew away my > install, grabbed > the source, and built it myself (with gcc as the compiler). > > I still get that error. Hmm.. the logic in the code isn't entirely clear to me, the error implies that you can specify a hostname, but really it throws this error if you don't specify an IP address for ZServer to bind to (ZServer/medusa/http_server.py:559). It's definatly not a very clear error. If you don't specify an IP addr, ZServer attempts to look up the hostname from the ip address of the socket it creates. What is also not very clear is that if you ONLY get this error, then the reverse lookup is sucessful. If the lookup fails, then you will get another error ("Cannot do reverse lookup") and the IP addr of the socket will be turned into a string and used for the server name. Perhaps you could un-obfusicate this for us? Patches accepted. -Michel

1 0

RE: [Zope] Solaris 8 issue?
by Martijn Pieters 04 Jan '00

04 Jan '00

> Hi, > > I recently (earlier today) installed Zope for the first time. > I am installing it on an Ultra 1, running Solaris 8. > > For my first attempt, I installed the Solaris 2.6 binary version. > It seems to start correctly, however I do get this error when it > kicks off: > > 2000-01-04T19:33:37 PROBLEM(100) ZServer Computing default hostname > > So, not sure what might cause this error I blew away my > install, grabbed > the source, and built it myself (with gcc as the compiler). > > I still get that error. > > A quick search of the web pages and the list archives did not yield > anything that jumped out at me. (It was a rather cursory search...) > > Is there a list of ZServer errors somewhere and what they > might mean? > > I did a little 'grepping' through the source and didn't > find the error. > Again, I could have just looked in the wrong place. > > 1) Is this really a problem, or does it show up for everyone? > 2) Is anyone else successfully using Zope with Solaris 8? > Any 'gotcha's'? This is not an error, just a notification. Don't worry about it. -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

1 0