- Zope - Zope lists

Security + XMLRPC
by chas 13 Oct '99

13 Oct '99

Using Zope for B2B. Partner websites take orders from their staff or clientel and relay those orders to us. So, the actual communications between these participating companies' servers and our own server are totally automated. Security exists at 3 layers : a) Host/IP - we've already filtered hosts that can connect to us based on IP. But, since IPs can be spoofed, we may buy hardware VPN solutions. (problem : hardware vpn can be expensive for our partners or even impossible if they are colocating) b) Protocol. At the moment I've got a prototype running with XMLRPC which was damned easy to create. However, there is no security mechanism built into XMLRPC (or at not that I can see). So, all data is transfered in the clear. c) The data/information itself. Since there is no authentication with XMLRPC, the data itself is encoded (using rotor and other simple python encryption modules) with a unique key that we will provide to each participating company/site. I really like using XMLRPC but is the above simply a disaster waiting to happen ? Would CORBA, HTTPS (ie using SSLeay), or SSH be better suited ? And is anyone already doing anything like this ? Thanks in advance, chas

4 3

How to stuff a tree from a SQL query?
by Steen Suder 13 Oct '99

13 Oct '99

As posted the other day, I'd like to create a (multilevel) tree from the results of a SQL query. With insightful input from Hannu, I've simplified my db design to something more useful. I have, among other fields, a node_id and a parent_id. This should be sufficient to create a tree of "one way linked lists" as I remember them from class. Now my question is: How do I stuff the results from the SQL query into the tree? Stuffing files and folders into a tree is no problem. -- Best regards / Mvh., Steen Suder Linux Systems Administrator Use "sfs @T sciatl DOD dk" for email

1 0

Unauthorized problem
by Gilles lavaux 13 Oct '99

13 Oct '99

(Sorry, I send this also to zope-dev by mistake.) Hello, Moving stuffs from zope1 to zope2 I got an unauthorized problem: I do a search with the ZopeFind method in folder where I have a lot of rights. I use a 'formatResult' method with the code bellow. The problem appear when I try to acess properties (the title) of the documents I found. If I am manager it works. giving ALL possible rights to my user doesn't solve the problem. I try to read the document properties (title) with a <dtml-with "sequence-key"> <dtml-var title> </dtml-with> yesterday I had problem using images inside the 'tree' tag, today problem accessing object properties inside the 'with' tag. Is there more problems/rules with the tags in zope2 than in zope1 or is it just me? The code from my findFormat is bellow, thanks for any info:  Search result from :  <blockquote>   Found  candidate(s)        <a href="/ShowDoc?doc_id=&curr_dir=&REFRESH=YES&VIEW=DOC"> </a>  <a href="/"> </a>  TEST:  THIS IS THE PROBLEM:    ''  etc.... Gilles Lavaux

1 0

Le Zope de Microsoft
by Gerard Mulot 13 Oct '99

13 Oct '99

Le Zope de Microsoft http://msdn.microsoft.com/isapi/msdnlib2.idc?theURL=/library/backgrnd/html/… regards Gerard Mulot

1 0

RE: [Zope] Linux.com community ad
by Slaets, Maarten 13 Oct '99

13 Oct '99

how about: This site should've been - Powered by Zope Maarten Slaets KPNQwest Belgium Contact info: http://www.fonky.com/vcard/MaartenSlaets/ > -----Original Message----- > From: Phil Harris [mailto:phil@philh.org] > Sent: woensdag 13 oktober 1999 9:51 > To: Robert Leftwich; Chris McDonough; zope(a)zope.org > Subject: RE: [Zope] Linux.com community ad > > > Zope - The last word in object publishing > > -----Original Message----- > From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of > Robert Leftwich > Sent: Wednesday, October 13, 1999 3:55 AM > To: Chris McDonough; zope(a)zope.org > Subject: RE: [Zope] Linux.com community ad > > > Chris McDonough wrote : > > Any ideas or contributions in the form of > > graphics are appreciated... > > > > "Zope - Zero Outdated Pages - Ever !" > > "Zope - as dynamic as the Web" > > "Zope - delivering data dynamically" > > "Zope - dynamite digital creations" > > or should that be - > > "Zope - dynamite Digital Creations" :-) > > or even - > > "Zope - dynamic Digital Creations" > > and an obscure (and possibly totally inaccurate) - > > "Zope - SOAP done right" > > and finally (before I go completely off the rails) - > > "Zope - slippery when wet" > > Robert Leftwich > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (Related lists - please, no cross posts or HTML encoding! > > To receive general Zope announcements, see: > http://www.zope.org/mailman/listinfo/zope-announce > > For developer-specific issues, zope-dev(a)zope.org - > http://www.zope.org/mailman/listinfo/zope-dev ) > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (Related lists - please, no cross posts or HTML encoding! > > To receive general Zope announcements, see: > http://www.zope.org/mailman/listinfo/zope-announce > > For developer-specific issues, zope-dev(a)zope.org - > http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

Can't use DTML in How-To?
by Loren Stafford 13 Oct '99

13 Oct '99

I'm trying to write a new How-To (see http://www.zope.org/Members/lstaffor/zProperties ) that includes HTML examples. So I wanted to use something like: <pre> <dtml-var ConstructorFormOld html_quote> </pre> ...to process the examples for me. But it seems an HTML How-To is not scanned for DTML. Is that true? Is there another (easy) way to do it? -- Thanks -- Loren

2 1

RE: [Zope] Authentication
by Jay, Dylan 13 Oct '99

13 Oct '99

> -----Original Message----- > From: Phil Harris [mailto:phil@philh.org] > Sent: Sunday, October 10, 1999 04:51 > To: kedai > Cc: zope(a)zope.org > Subject: RE: [Zope] Authentication > > > kedai, > > To my understanding, once a user is authenticated the > AUTHENTICATED_USER > object is available everywhere the user goes. > > I hope I'm right as my new site depends on it, ;¬) This is true for cookie based authentication such as in UserDB however it is NOT true for basic authentication (ie normal acl_user folder). Basic authentication will only send authentication info when an area is restricted. ie any areas that an anonymous user can view will have AUTHENTICATED_USER set to "Anonymous User". There is nothing that can be done about this unless you resort to cookies or someother user session method (a BIG gap missing in Zope). > Phil > phil(a)philh.org > > > -----Original Message----- > From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On > Behalf Of kedai > Sent: 09 October 1999 02:35 > To: Phil Harris > Cc: zope(a)zope.org > Subject: Re: [Zope] Authentication > > > On Fri, Oct 08, 1999 at 10:44:15AM +0100, Phil Harris wrote: > > Sture, > > > > Have a look at http://d031.ml.uwcm.ac.uk/z/zGold. > > > > It's something I made as a demo for a conference I attended. > > > > There is a downloadable version that you can use to see how > I did what I > > did. > > > > HTH > > > > Phil > > phil(a)philh.org > hi phil, > i downloaded zGold and experimented/dig into the zope mine ( > well, it is to > me). > > however, i can't decide how i can bring the authenticated_name along > everywhere i go. tried setting a cookie, but can't decide > how to pass the > cookie as the AUTHENTICATED_USER.name across other path; ie > when accessing > other folders not in the zGold folders. > > pointers? docs? thanks > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (Related lists - please, no cross posts or HTML encoding! > > To receive general Zope announcements, see: > http://www.zope.org/mailman/listinfo/zope-announce > > For developer-specific issues, zope-dev(a)zope.org - > http://www.zope.org/mailman/listinfo/zope-dev ) > > > >

2 1

Zope Schedule Task
by Kam Cheung 13 Oct '99

13 Oct '99

Is there a way to schedule Zope to do perform some actions? For example, can I set Zope to export a folder every night at 10 pm? Of course, since a method in Zope can be called by a url, I can write a script to visit the method every night, but I would like to find out if it can be done inside Zope. kam

2 1

Fw: [Zope] Zope and Database user authentication
by Jim Sanford 13 Oct '99

13 Oct '99

I handled this by creating a username and password in the top level acl_users folder. I then wrap every call to retrieve data in a call (<dtml-in "Query.UserSettings()"> )to an SQL method that returns permissions and other settings for the authenticated user's name. The SQL methods have embedded tests for what data can be returned based on the user settings. Jim Sanford ----- Original Message ----- From: Stuart 'Zen' Bishop <zen(a)cs.rmit.edu.au> To: Frank-Dieter Berg <Frank-Dieter.Berg(a)d2mannesmann.de> Cc: <zope(a)zope.org> Sent: Tuesday, October 12, 1999 7:28 PM Subject: Re: [Zope] Zope and Database user authentication > On Tue, 12 Oct 1999, Frank-Dieter Berg wrote: > > > Is there any way to provide individual user logins for relational > > databases through ZOPE. So a user can access his own database account > > with his rights controlled by the databaserather by a fixed database > > connection? > > > > Tanks for some help. > > I came up with a fairly non-scalable way of doing this: > > Create a database connection in a folder called something generic like > 'CurrentUserConnection', with only manager with rights to it. > > Create your SQL methods using CurrentUserConnection as their connection > ID > > Create a sub folder for each user, each one containing a database > connection called 'CurrentUserConnection', which logs on as that particular > user. > > If you are paranoid, delete, rename or move the original > CurrentUserConnection > > In theory this would do what you are after, but I havn't tested it. The > trick is to see if a ZSQL method aquires its database connection, or if > is is somehow a stronger link. > > I think It would be very nice to make basic user objects folderish, > and extend the aquisition rules to check the contents of the currently > authenticated user's folder. I'd submit this to the collector if > I didn't have to leave for a meeting right now... <exit stage left> > > ___ > // Zen (alias Stuart Bishop) Work: zen(a)cs.rmit.edu.au > // E N Senior Systems Alchemist Play: zen(a)shangri-la.dropbear.id.au > file://__ Computer Science, RMIT WWW: http://www.cs.rmit.edu.au/~zen > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (Related lists - please, no cross posts or HTML encoding! > > To receive general Zope announcements, see: > http://www.zope.org/mailman/listinfo/zope-announce > > For developer-specific issues, zope-dev(a)zope.org - > http://www.zope.org/mailman/listinfo/zope-dev ) >

2 1

RE: [Zope] Linux.com community ad
by Chris McDonough 13 Oct '99

13 Oct '99

that's pretty funny... you think the joke would be understood? -----Original Message----- From: ron(a)hksi.net To: zope(a)zope.org Sent: 10/13/99 12:38 AM Subject: RE: [Zope] Linux.com community ad Zope... Be the Content. Zope... Objectified Content. Zope... pure objects, pure content. Zope... We Object to Your Content. (hmmm, kinda like that one.) Ron _______________________________________________ Zope maillist - Zope(a)zope.org http://www.zope.org/mailman/listinfo/zope (Related lists - please, no cross posts or HTML encoding! To receive general Zope announcements, see: http://www.zope.org/mailman/listinfo/zope-announce For developer-specific issues, zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev )

1 0