- Zope - Zope lists

Authentication
by Sture Lygren 11 Oct '99

11 Oct '99

Hi! Could someone please tell me how I can let users change their passwords from within a dtml-method, and how I can make a logoff user method? Pointers to code/products to use is much appreciated Sture Lygren

5 6

RE: [Zope] list of naive questions
by Chris McDonough 11 Oct '99

11 Oct '99

Hmmm. I see. So you're looking to create a role per-instance that has *only* that rights to that permission and execute the method by proxying as that role. Taking a look at the source generated by the "Define Permissions" tab of the Zope management interface and other places: - There exists a method called "manage_defined_roles" which I assume to be present for all objects. You can add this to your *Class_add method in the zclass that creates the instance. It looks like you call it like this (within the method you're trying to add a role to -- untested --): <dtml-call "manage_defined_roles?role=rolename"> - There exists another method called "manage_role" which adds permissions to your role and accepts arguments something like this (again, untested): <dtml-call "manage_role?role_to_manage=rolename&permissions:list=permissionname> - And finally, there exists a method, "manage_proxy" that will allow you to assign a proxy role to a method, it looks like you call it something like this: <dtml-call "manage_proxy?roles:list=role"> Since you know that at least three roles exist from the root of any default Zope 2.x installation (anonymous, manager, owner), however, personally, I might try not to create a new role for that method, unless you're very, very concerned about security and you'd like to limit the role to that action only. I'd probably just give the permission to the manager role and proxy as manager. You're probably smarter, I'm just lazy :). HTH, Chris -----Original Message----- From: bruce(a)perens.com To: bruce(a)perens.com; chris(a)iqgroup.com; zope(a)zope.org Sent: 10/10/99 8:26 PM Subject: RE: [Zope] list of naive questions From: Chris McDonough <chris(a)iqgroup.com> > Why do you want to export a role with your product? Because the proxy method needs only _one_ permission, and I would set that permission in the role, and not hassle the administrator with the need to create it. All administrators who use the product will have to do the exact same thing - create a role with one permission, which is a pretty good definition of when software should do something for you. I have an object that users are allowed to create, but not modify afterward. But the usual method of creating objects in Zope is to create them and then modify their properties. Thus, there has to be a "constructor" method that can be called by unprivileged users and has permission to modify the properties of an object it's just created. Thanks Bruce

1 0

newbie question
by Terry Kerr 11 Oct '99

11 Oct '99

Hi, It is probably really easy, but how do I restrict access to surfers...like the .htaccess does in apache? I cannot find any documentation on this. terry

6 6

RE: [Zope] list of naive questions
by bruce＠perens.com 11 Oct '99

11 Oct '99

From: Chris McDonough <chris(a)iqgroup.com> > Why do you want to export a role with your product? Because the proxy method needs only _one_ permission, and I would set that permission in the role, and not hassle the administrator with the need to create it. All administrators who use the product will have to do the exact same thing - create a role with one permission, which is a pretty good definition of when software should do something for you. I have an object that users are allowed to create, but not modify afterward. But the usual method of creating objects in Zope is to create them and then modify their properties. Thus, there has to be a "constructor" method that can be called by unprivileged users and has permission to modify the properties of an object it's just created. Thanks Bruce

1 0

Re: [Zope] contrasting Zope vs. Vignette
by Christopher Petrilli 11 Oct '99

11 Oct '99

> First, I'd like to that Chris and Anthony who gave me some pointers > for things to look out for at the meeting with Vignette. I hope that > it is not inappropriate to post my reactions to this list. I think > many of us are interested in comparisons of Zope to other products. This is exceptionally valid I believe. While "we" might believe Zope is the best technology on the market, there are still many places where other products might have interesting ideas that could be "purloined" for our use in some form or another. > [...] but> mostly it is that Vignette has a marketing mindset and Digital > Creations has an engineering mindset. (Which I like, I should add.) Thank you. Part of it is that "engineering" doesn't sell a $1M deployment, marketing does. Make no mistake that while Vignette might be "off the shelf" software, it is hardly user installable, and often requires many hundreds of hours of consulting (at a rather high rate) to get to any point that is usable. That doesn't mean that Zope is "easier to use", I don't argue that. However, there's less invisible magic given you can look through the source code, as well as the fact that we are more open to discuss *why* something behaves a specific way. Often understanding *why* is more imported than *how* something behaves. > [workflow] We have some pretty amazing ideas for workflow, but I'll leave those to Paul to announce when we're ready. We do try not to announce things before they're at least semi-functional :-) > [comparison of Tcl v. Python scripting choices] My understanding is that much of Vignette is built in Tcl. Remember, you don't need a data type besides a string... strings are your friends :-) We have been, and continue to be, strong believers in the strength of object-oriented development. Because of that, we've realized one of the purest approaches on the web (I believe THE purest, but I could be wrong), and this is exceptionally powerful---but difficult to iterate in a "marketing brochure" or to someone who is not well steeped in the ideology. We are also believers in formal modeling (a'la UML) and process driven development (The DC Unified Process) which I think is a large distinguishing factor from any other company. Try asking for models of their work :-) > [discussion of caching approach] One of the things to note is that our approach to object invalidation is center to our scalability story---ZEO. ZEO is basically a distributed object replication system with real-time invalidation of objects. This is VERY powerful. > When the cache is not in use StoryServer appears quite slow. Even > with the cache they only claimed 1M hits/day using a dual CPU Ultra 2 > sparc, which sounds much less than Zope. While we're not a big SPARC shop, a minor projection of current benchmarks we've done with ZEO indicate that on a dual CPU box (with 2 ZEO clients, and a storage server) that we could achieve somewhere around 3.2M hits assuming a minimal level of dynamicism. Because of our strong dynamic nature, the more dynamic, the less throughput you get---it's just more cycles per request. I would say a HIGHLY dynamic site on such a box would perform around 1-1.5M hits live, as opposed to cached. > [canned tools] This is where the community comes in, in many ways. We do have some ideas, but we're just restricted in resources that we can dedicate to speculative development, no matter how confident we might be in its usefulness. > [Java v. Web interface] I think one thing that came up in a discussion with one of Vignette's integrators was that the Java GUI isn't that great in allowing for the delegation of authority. There's just not the kind of granularity in the security system that we provide, so that you can give a multitude of different people different capabilities without having to recreate your interface that many times. One thing I didn't hear any discussion of was the security model in Vignette---what is it? How is it controlled? How flexible? Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

5 4

RE: [Zope] list of naive questions
by Chris McDonough 10 Oct '99

10 Oct '99

Bruce, I am by no means a Python or Zope expert, but here goes: Why do you want to export a role with your product? Couldn't you just as easily allow the product admin to define a role which allows him/her to provide or deny permissions (defined in the class object) to the product container or its contained objects on a per-instance basis? Whenever I've made a Z Class, I've always allowed it to add permissions to my "Define Permissions" tab as it sees fit, then I've constructed my own roles within the instance that make use of those permissions. Are you defining new permissions within the class or something? As far as how to access the container's properties from DTML within a subobject (I think this is what you're asking), do this... create a dtml method within the container with this code:    etc...  PARENTS[0] is always the container object of the method its called from. PARENTS[1] is the container object of *that* container object. PARENTS[2] is the container object of that container object, and so on. PARENTS[-1] is the root object. Similarly, you can get a specific attribute of the containing folder by doing something like:  -----Original Message----- From: bruce(a)perens.com To: zope(a)zope.org Sent: 10/10/99 7:24 PM Subject: [Zope] list of naive questions I have read the ZDG. I'm not a Python or Zope expert. Here are a few things I haven't figured out: I have a ZClass Product. I see that I can give some of its DTML methods proxies using globaly-defined roles. I don't see how to create Product-specific roles and export them with the product. Thus, I am only able to set proxies to the roles of "manager", "owner", and "anonymous", which don't really know anything about my product-specific permissions. If I create a user folder in the product, it's sort of half-visible in the instance - I doubt that's what I want. How do you call a ZClass factory from DTML, and how do you pass the container object? Or do you simply not use the factory and just call the same things it calls, from your program? How does an object access its container? I have an object with ObjectManager as one of its base classes. That object contains other objects. The objects it contains want to access properties of the container. Thanks Bruce _______________________________________________ Zope maillist - Zope(a)zope.org http://www.zope.org/mailman/listinfo/zope (Related lists - please, no cross posts or HTML encoding! To receive general Zope announcements, see: http://www.zope.org/mailman/listinfo/zope-announce For developer-specific issues, zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev )

1 0

list of naive questions
by bruce＠perens.com 10 Oct '99

10 Oct '99

I have read the ZDG. I'm not a Python or Zope expert. Here are a few things I haven't figured out: I have a ZClass Product. I see that I can give some of its DTML methods proxies using globaly-defined roles. I don't see how to create Product-specific roles and export them with the product. Thus, I am only able to set proxies to the roles of "manager", "owner", and "anonymous", which don't really know anything about my product-specific permissions. If I create a user folder in the product, it's sort of half-visible in the instance - I doubt that's what I want. How do you call a ZClass factory from DTML, and how do you pass the container object? Or do you simply not use the factory and just call the same things it calls, from your program? How does an object access its container? I have an object with ObjectManager as one of its base classes. That object contains other objects. The objects it contains want to access properties of the container. Thanks Bruce

1 0

RE: [Zope] DTML vs. DW2 extensions
by David Kankiewicz 10 Oct '99

10 Oct '99

At 01:27 PM 10/7/99 -0400, Michel Pelletier wrote: > >> Is it possible to use; >> >> <dtml-var name="something" html_quote=""> >> >> instead? > >Sure. Although I would suggest html_quote=1 looks more 'pythonic'. >setting it to an empty string makes it looks like you are setting it to >a python false value. > >-Michel > Don't forget about the full syntax: <dtml-var name="something" fmt="html_quote"> Regards, David P.S. Is there any work being done or time frame for the XML compliant DTML syntax to be added?

3 5

Re: [Zope] dtml call for copying items?
by Kevin Dangoor 10 Oct '99

10 Oct '99

>Joseph Santaniello wrote: >> from form processor: >> >>  >>  >> <!-- stuff to change the new folder's name... >> >> I don't get any error on the copy, but the paste says the clipboard is >> empty. You could also go through one by one and use manage_clone: def manage_clone(self, ob, id, REQUEST=None): """Clone an object, creating a new object with the given id.""" Check out Zope/lib/python/OFS/CopySupport.py for more options. You can, in theory, use manage_copyObjects and manage_pasteObjects without cookies. manage_clone works pretty easily, though. Kevin

1 0

Re: [Zope] <dtml-with> Question
by Kevin Dangoor 10 Oct '99

10 Oct '99

-----Original Message----- From: Sascha Matzke <sascha(a)bespin.de> To: Kevin Dangoor <kid(a)kendermedia.com> Cc: zope(a)zope.org <zope(a)zope.org> Date: Sunday, October 10, 1999 2:29 PM Subject: Re: [Zope] <dtml-with> Question >Hallo, > >On Sun, Oct 10, 1999 at 02:16:12PM -0400, Kevin Dangoor wrote: >> It sounds like you're basically trying to do a namespace lookup. >> >> <dtml-with "_[objA]"> >> should do what you want. > >It doesn't... > >I have an variable named item with the value "Desk.Test.index_html". Aha. That is more complex. I don't know if this is the BEST way to do what you want, but you could do: <dtml-call "REQUEST.set('objnames', _.string.split(item, '.'))"> <dtml-with "_[objnames[0]]"> <dtml-with "_[objnames[1]]"> <dtml-with "_[objnames[2]]"> ...your other stuff... </dtml-with> </dtml-with> </dtml-with> Kevin

2 1