- Zope - Zope lists

Re: [Zope] Zope and security.
by Simon Michael 10 Nov '99

10 Nov '99

"Stuart 'Zen' Bishop" <zen(a)cs.rmit.edu.au> writes: > Hmm.... I see the need for a 'SecurityReport' Product - a document that > scans the permissions on the current folder down and displays a tree > detailing who has what rights. Excellent idea.

1 0

Summary of DB Discussion
by Karl Fast 10 Nov '99

10 Nov '99

I thought it might be worthwhile to sum up the various points about databases and zope and linux that were made today. Please correct any mistakes and provide any comments you have. - Zope has strong database connections for Oracle and Solid, with DB2 in the works. These are all officially supported DA's. - There is an ODBC DA, but it works only on Windows because there isn't a good ODBC implementation on Linux. This isn't Zope's fault. - There are DA's for MySQL and PostgreSQL, the two open source databases (yeah, yeah, MySQL isn't truly open source--although one of the older version is). They work, although both are still in development (is this active?) and some people have had troubles getting them to compile. This seems especially true of the MySQL DA judging from pleas for help sent to the zope list, although this may be more of a reflection of MySQL's popularity over PostgreSQL. - The big criticism against MySQL is the lack of transaction support. MySQL is not popular with the DC folks because of this. Their customers use DB's with transaction support (Oracle, Sybase, and DB2) and their main concern is developing and supporting DA's for DB's their clients use. - DC is looking for someone in the zope community to take ownership of the MySQL DA (what's the status of the PostgreSQL DA?) - Despite it's lack of transaction support, it was agreed that MySQL (a) is popular (b) is very fast and a good choice for sites that do high volume queries, but relatively simple and low-volume updates (c) will be getting transaction support "real soon now" according to the web site (d) should have a good, up to date, Zope DA - PostgreSQL, the other open source DB, does support transactions. There is a Zope DA. Some people suggested that PostgreSQL is a bit buggy. Other said that it works great. Everyone agreed that it's a bit on the slow side, especially when compared to MySQL. What am I missing? What did I get wrong? ----------------------------------------------------------------- Karl Fast

5 4

Entity Syntax draft howto
by Alexandre Ratti 10 Nov '99

10 Nov '99

Hello, I uploaded a draft (mini) howto about the DTML entity syntax. It is based on information collected on this mailing list. You can read it here : <http://www.zope.org/Members/AlexR/EntitySyntax>. Feel free to send me your feedback. Cheers. Alexandre

1 0

Uploading folders
by Oscar Picasso 10 Nov '99

10 Nov '99

Is it possible to upload a complete folder from a end user local disk to a Zope site using a Web interface. I prefer a standard Web interface like the one used to upload single files rather than something like a Java applet. Any idea? Pointer? Thanks ****************************************************** Oscar Picasso picasso(a)videotron.ca ******************************************************

1 0

newbie questions
by Arjan Scherpenisse 10 Nov '99

10 Nov '99

Hi all, My first posting on this list :-) I have two questions for you: * How do i get a list of all subfolders off the current folder, using dtml-in ?? Or better, how do i get a list of subfolders which contain a property i specify? * How do i get the name of the current object in the situation that i am in the method index_html of the folder News. The value i want to get is 'News', but how do i get it? TIA, -- Arjan Scherpenisse, A.Scherpenisse(a)zap.a2000.nl ICQ# 27592135

5 4

Can't use MailHost from inside of standard_error_message?
by Andrew Wilcox 10 Nov '99

10 Nov '99

Hi, I've been working on customizing standard_error_message to send me email when an error occurs. I setup a MailHost, which I called "MailHost" :-) in the root Zope folder. This code works fine from a regular DHTL document: <dtml-sendmail mailhost="MailHost"> To: Andrew Wilcox <circle(a)gwi.net> From: Zope Service <circle(a)gwi.net> Subject: ***Error An error occured. </dtml-sendmail> However, when I tried it in standard_error_message, it didn't work. (What I got was the standard Zope error screen, instead of my modifications). I was able to get to work by using the smtphost attribute instead: <dtml-sendmail smtphost="mail.myisp.com"> To: Andrew Wilcox <circle(a)gwi.net> ... However, I was curious why it couldn't find my MailHost from inside the error routine. Thanks! Andrew

1 0

RE: [Zope] How to distinguish between objects with and without ac cess restrictions
by Brian Lloyd 10 Nov '99

10 Nov '99

> > Try this and let me know how it works: > > > > <dtml-in "objectValues(['Folder'])" skip_unauthorized> > > <LI><A HREF="<dtml-var id>"><dtml-var title></A> > > </dtml-in> > > > > > I think you misunderstand his question...he wants anonymous > users in the top > level folder to be able to run this code in viewing the top > level folder so > that they see both public and private sub-folders, because > those anonymous > users may also be users who have ids/passwords, but they may > also be the > non-users. When they access a private sub-folder only then > should they be > prompted for a password. Ah - setting proxy roles is the best approach then. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Re: [Zope] Collector reports not being visible is annoying
by Andrew 10 Nov '99

10 Nov '99

Martijn Faassen <m.faassen(a)vet.uu.nl> said: > flight(a)mathi.uni-heidelberg.de wrote: > > > you guys at DC, > > > > I guess it's for security reason's, but I feel it a little bit annoying > > that most open bug reports in the collector (the ones "under review") > > are not readable for normal humans. > [snip problem description and solution] > > I agree. I think most bug reports should be visible instantly as well. > When reporting a bug it's hard to see if someone already reported it > before. > > I imagine Digital Creations is planning an overhaul of the system, any > news on that? > I agree. AND.. How can the community help fix bugs if we don't know what they are? :-) Drew

1 0

Objet : Re: [Zope] Setting SERVER_NAME for ZServer
by Francois-Regis CHALAOUX 10 Nov '99

10 Nov '99

Ok, but how ? >>> Michel Pelletier <michel(a)digicool.com> 08/11/99 18:01:00 >>> Itamar Shtull-Trauring wrote: > > How do I set the internal server name for ZServer? Right now it's taking > one from the hostname, which in this case is wrong (virtual hosting) and > causes problems. ZServer currently isn't smart enough, you would need to patch it. -Michel _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope No cross posts or HTML encoding! (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1

Collector reports not being visible is annoying
by flight＠mathi.uni-heidelberg.de 10 Nov '99

10 Nov '99

you guys at DC, I guess it's for security reason's, but I feel it a little bit annoying that most open bug reports in the collector (the ones "under review") are not readable for normal humans. Most other projects have their BTS completely open, and it seems to be viable. Some would argue that this is what made open source projects so successful (Debian says "we won't hide our problems"). Perhaps it would be possible to make this review period much shorter in general, so that each report is checked for immediate security relevance in one or two days, and is then made readable, even if it was not yet reviewed in full ? Perhaps add a checkbox "Potential security risk" to the report form, so that the reporter can give a hint on the severity of the bug. The way it currently is, if I want to check problems with ZClasses, there are 65 reports. More than the half of them is under review, and in general the subject of the report is not so clear that I can see if it refers to the problem I'm running into. Gregor

2 1