- Zope - Zope lists

RE: [Zope] = replaced with == in sendmail!!!!!
by Jay, Dylan 16 Apr '99

16 Apr '99

> -----Original Message----- > From: Michel Pelletier [mailto:michel@digicool.com] > Sent: Friday, 16 April 1999 00:31 > To: Jay, Dylan; 'zope(a)zope.org' > Subject: RE: [Zope] = replaced with == in sendmail!!!!! > > > I have the following inside a sendmail tag > > > > /completeReg?MagicNumber= > > > > However in the mail that is sent this comes out as > > > > http://blah.com/completeReg?MagicNumber==23423434 > > > > This is incredibly fustrating and I can find no way around > this. Even > > > > /completeReg?MagicNumber > > > > produces the same result. Whats going on? > > > > I have no idea, but try: > >  > > just for the heck of it and tell us what happens. I couldn't get it to work but I'm pretty sure it wouldn't anyway. I had a look at the MailHost code and found some quoting stuff that if I knew more about python I might be able to do work out the problem with. Down the bottom of MailHost.py in the MailHost product is the following ESCAPE = '=' MAXLINESIZE = 76 HEX = '0123456789ABCDEF' def needsquoting(c, quotetabs): if c == '\t': return not quotetabs return c == ESCAPE or not(' ' <= c <= '~') def quote(c): if c == ESCAPE: return ESCAPE * 2 else: i = ord(c) return ESCAPE + HEX[i/16] + HEX[i%16] def encode(input, quotetabs): """Encode a string to Quoted-Printable""" output = '' for line in string.split(input, '\n'): new = '' prev = '' for c in line: if needsquoting(c, quotetabs): c = quote(c) if len(new) + len(c) >= MAXLINESIZE: output = output + new + ESCAPE + '\n' new = '' new = new + c prev = c if prev in (' ', '\t'): output = output + new + ESCAPE + '\n\n' else: output = output + new + '\n' return output I presume some quoting needs to go on in order for the message to be sent to the smtp server. This seems to be buggy. Can anyone tell me how to fix this as it is quite urgent.

2 1

RE: [Zope] (no subject)
by Jay, Dylan 16 Apr '99

16 Apr '99

> -----Original Message----- > From: Rob Page [mailto:rob.page@digicool.com] > Sent: Friday, 16 April 1999 07:51 > To: 'Jay, Dylan' > Cc: 'zope(a)zope.org' > Subject: RE: [Zope] (no subject) > > > Jay: > > > I am trying to update my database using url traversal. I'm > > pretty sure I > > need to give proxy permission in order to do update the > > database however > > there seems no way to do this. eg > > > > I am using a url like this > > http://provision.auslabs.lucent.com/cgi-bin/provision.exe/Dow > > nload/qryComple > > teReg/MagicNumber/60330800/completeReg > > The example you included below has a heterogeneous mix of SQL > statements... some pass-through (e.g., UPDATE) which return no values > and SELECTs which do. I'm not sure if it's a bug or not but I'm under > the impression that you ought not mix SQL like this. No, you can mix SQL like this. The manual says that as long as there is only one SELECT in there you should be fine. And this is the case when I test sql statement and when I do a  however it doesn't seem to work with the single parameter access url notation. > <out on a limb> > > I'd suggest decomposing this one SQL Method into three separate > SQLMehthods and calling them from the action document. For example: > > dtCompleteARegistration == > >  >  >  > > > </out on a limb> > > > where qryCompleteReg is > > > > UPDATE users > > SET roles = 'Customer' > > WHERE username = > > ( SELECT unregUsers.username > > FROM unregUsers > > WHERE MagicNumber =  > > ) > > > >  > > > > SELECT users.username, fullName, email > > FROM users, unregUsers > > WHERE MagicNumber =  AND > > unregUsers.username = users.username > > > >  > > > > DELETE > > FROM unregUsers > > WHERE MagicNumber =  > > > > Testing this sql_mehtod using the manage interface works > > perfectly but when > > I use it from the url above it seems to work however doesn't > > actually do the > > UPDATE or DELETE (The SELECT works however). > > --Rob >

1 0

RE: [Zope] standard error msg
by Michel Pelletier 16 Apr '99

16 Apr '99

> -----Original Message----- > From: John Eikenberry [mailto:jae@kavi.com] > Sent: Thursday, April 15, 1999 6:29 PM > To: zope(a)zope.org > Subject: [Zope] standard error msg > > > > Is the standard_error_message supposed to be used in all cases that an > error is raised? It doesn't seem to be getting used when I get a 404 > (NotFound) error. All it returns is the basically formatted > error "Sorry, > the requested document does not exist." and the traceback (and title). > > I've tried changing the standard_error_message doc method but it never > appears for this type of error. How can I get it to use the > standard error > document. > John, standard_error_message is only called when the error is raised in the object database. If the browser requests an object that doesn't exist, ZPublisher raises it's own error. This is compounded by the fact that pcgi has a whole slew of *real* pretty error messages that have an even more interesting "format". :) It is generaly agreed that the Module that ZPublisher publishes should define hook methods when ZPublisher encounters various error conditions in the context of the protocol being used (for example, in XML-RPC, what sense does '404' make and who cares about a pretty formated HTML response?). This is where even we get confused. Do I hear the sound of a volunteer? :) -Michel > Thanks, > > --- > > John Eikenberry > [jae(a)kavi.com - http://taos.kavi.com/~jae/] > ______________________________________________________________ > "A society that will trade a little liberty for a little order > will deserve neither and lose both." > --B. Franklin > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

DTML methods bafflement
by Martijn Faassen 15 Apr '99

15 Apr '99

Hi there, I thought I'd figured out DTML methods, but here's something that I intuitely think is possible, but gives me an error (in Zope 1.10.2). It has to do with DTML methods (or documents, I don't think there's a difference) calling each other. My basic understanding: A DTML method is a callable object, that functions as a method of a Zope folder. DTML methods can call other DTML methods, with the #call tag:  The call tag doesn't give any return value. The #var tag does; it gives as return value the rendered HTML of the called DTML object. You can supply arguments to your calling DTML methods: DTML method - 'caller'  DTML method - 'callee' <p>The arg was: </p> This works as expected when rendering 'caller', you see: The arg was: Foo! Now, here comes the confusing part -- passing an argument along: First, we rewrite caller to this:  Then we make a DTML method called 'baffle':  When I try to view that DTML method, I get an error (appended at the end). Why does this happen? I expect it's not a bug but a failure to understand on my part. In my understanding, methods of objects can pass values on to each other. If it is my error, then perhaps we need some document that describes what exactly is going on when DTML methods call each other, how arguments are passed. I've been browsing through the source but so far I'm not enlightened. I'm wishing for some easy to remember algorithm/structure that's applied here. A related question; in my perhaps broken view of DTML methods as methods can get arguments, the concept of an 'argument list' (somewhat like in Z SQL methods) for DTML methods (and documents) would be useful. I realize acquisition can produce a whole lot of potential arguments (actually being acquired as attributes), but perhaps there should be some way to call up a list of everything that's in the namespace of a particular DTML method (in particular circumstances). Something like that would help my understanding, and might help debugging in general. Regards, Martijn (and here's the promised error traceback from Zope:)  </BODY></HTML>

3 4

RE: [Zope] (no subject)
by Rob Page 15 Apr '99

15 Apr '99

Jay: > I am trying to update my database using url traversal. I'm > pretty sure I > need to give proxy permission in order to do update the > database however > there seems no way to do this. eg > > I am using a url like this > http://provision.auslabs.lucent.com/cgi-bin/provision.exe/Dow > nload/qryComple > teReg/MagicNumber/60330800/completeReg The example you included below has a heterogeneous mix of SQL statements... some pass-through (e.g., UPDATE) which return no values and SELECTs which do. I'm not sure if it's a bug or not but I'm under the impression that you ought not mix SQL like this. <out on a limb> I'd suggest decomposing this one SQL Method into three separate SQLMehthods and calling them from the action document. For example: dtCompleteARegistration ==    </out on a limb> > where qryCompleteReg is > > UPDATE users > SET roles = 'Customer' > WHERE username = > ( SELECT unregUsers.username > FROM unregUsers > WHERE MagicNumber =  > ) > >  > > SELECT users.username, fullName, email > FROM users, unregUsers > WHERE MagicNumber =  AND > unregUsers.username = users.username > >  > > DELETE > FROM unregUsers > WHERE MagicNumber =  > > Testing this sql_mehtod using the manage interface works > perfectly but when > I use it from the url above it seems to work however doesn't > actually do the > UPDATE or DELETE (The SELECT works however). --Rob

1 0

RE: [Zope] sql INSERT during query
by Rob Page 15 Apr '99

15 Apr '99

Jay: > I think the problem lay in the fact that I was trying to do > another query > inside an "in" tag or the equivalent. Reading between lines > of the SQL > Database users guide I believe it says this can't be done. I quote > "It is often neccessary to execute more than one SQL > statement in a single > HTTP REQUEST. SQL database Methods define a variable > sql_delimiter that can > be used to divide individual SQL statements." You should be able to do something like:      The sql_delimiter thing is meant to imply that you may want to, in the same REQUEST INSERT into one or more tables as in: INSERT INTO customers ( customer_id, last_name, first_name, phone ) VALUES ( , , , , )  INSERT INTO orders ( customer_id, part_number ) VALUES ( , , ) > I am currently trying to use a single sql method that does > everything I > wanted. > > On a related note, how do I include the text of an sql > method inside another > sql method? <UNTESTED>I don't think you can</UNTESTED>. You could define a few DTML Documents and run them together in a SQLMethod as in: sqlDoSomthing defined as:    Hope this helps! --Rob

1 0

RE: [Zope] Zope with Apache on NT
by Rob Page 15 Apr '99

15 Apr '99

> -----Original Message----- > From: TFE MMS JARVIS JOHN [mailto:jarvis.sd082@ex.tel.co.jp] > Sent: Wednesday, April 14, 1999 12:31 AM > To: Rob Page > Cc: 'zope(a)zope.org' > Subject: RE: [Zope] Zope with Apache on NT > > > I don' t know if this will help much but I have version > 1.3.4 working. > The Zope install is named George so, > > RewriteEngine on > RewriteCond %{HTTP:Authorization} ^(.*) > RewriteRule ^/Zope/(.*) /Apache/cgi-bin/George.exe/$1 > [E=HTTP_CGI_AUTHORIZATION:%1,T=application/x-httpd-cgi,L] > > This doesn't seem much different from yours but I also > had to append: > > <Directory /Zope> > Options All > AllowOverride None > </Directory> > <Directory /apache/cgi-bin/george.exe> > Options All > AllowOverride None > </Directory> > > before I could get it to work. Only adding ExecCGI option > still gave me 403 and authorization errors. > Options All seems a bit extreme, > but I didn't feel like messing with it a whole lot at the time... BTW, this worked like a champ for Apache 1.3.6 for NT-- although, like you, I've not yet taken the time to figure out why the Options All is necessary! Thanks a million! --Rob

1 0

RE: [Zope] Feature requests and questions
by Michel Pelletier 15 Apr '99

15 Apr '99

> -----Original Message----- > From: Brad Clements [mailto:bkc@murkworks.com] > Sent: Wednesday, April 14, 1999 8:55 AM > To: Zope > Subject: RE: [Zope] Feature requests and questions > > > On 13 Apr 99, at 17:29, Ken Manheimer wrote: > > > (No, my mouth is not actually watering.) Plus, having a > two-way interface > > with email in zope is a really interesting prospect, adding > value to zope > > as well as to systems that use it. There are some really > interesting > > opportunities here - email systems like, but less monolithic than, > > > > I've been thinking about how to implement a generic "message > store" in > ZBase (bobo?) that can be tapped with services interfaces, such as > > 1. html - aka, confera or prettier (perhaps Notmail) > 2. nntpd - nntp server as part of Zserver, not meant to > replace a full- > blown NNTPD > 3. Pop3 > 4. Imap - The big one, a full-featured Imap server based on I've thought about #4, but haven't had any time to realize any code over it. My idea was to use Medusa as a frontend into an imap server based on ZODB. I think a prototype with incomplete/minimal IMAP functionality could be demonstrated in a couple days with good models. The concept would be a protcol-interpreter application which accessed objects in a persistent database. Creating mailboxes would use Zope's container and aquisition philosopy, and individual messages could be persistent instances of custom wrapped rfc822.Message objects. Zope's indexing machenery could be used as a big win compared to other imap servers. Most imap servers (that i've seen) allways take the brute force approach to mail searching, which makes them a bit chuggy when searching through very large mailboxes. 'Insert Mysterious Zope/IMAP Server Here' could index all the messages as they're added to boxes. Medusa could then act as the frontend ZServer style to the imap database. -Michel

1 0

RE: [Zope] permission and role questions
by Michel Pelletier 15 Apr '99

15 Apr '99

> -----Original Message----- > From: Rob Page [mailto:rob.page@digicool.com] > Sent: Thursday, April 15, 1999 11:02 AM > To: 'Keith Rohrer' > Cc: 'zope(a)zope.org' > Subject: RE: [Zope] permission and role questions > > > Keith: > > I can answer some of the more basic questions -- you ask some toughies > so I'm hopeful others can add some insight. > > > 1) How does one examine the logged-in user's username from > > DTML? I think I > > just need the variable name here... > >  > I hate to call ya out on this one Rob, but 1) in order for the above DTML to work it must be quoted (because it's an expression) and even the quoted form:  is equivilent to:  > > <UL> > <LI><A HREF="PublicRoom">Public Room</A></LI> > >  > <LI><A HREF="Room1">Room 1</A></LI> >  > >  > <LI><A HREF="Room2">Room 2</A></LI> >  > > </UL> > You will need to quote all of these too.

1 0

RE: [Zope] permission and role questions
by Michel Pelletier 15 Apr '99

15 Apr '99

> -----Original Message----- > From: Keith Rohrer [mailto:KRohrer@hnv.com] > Sent: Wednesday, April 14, 1999 8:05 PM > To: 'Zope Users List' > Subject: [Zope] permission and role questions > > > I'm working on designing a web application, and right now I'm > particularly > scrutinizing Zope's permission model. In trying to think how > I'd use it to > do what our existing, highly custom system does today, I wonder: > > 1) How does one examine the logged-in user's username from > DTML? I think I > just need the variable name here...  AUTHENTICATED_USER is a user object returned by the acl_users object. In the case of a regular Zope User Folder, an etcUserFolder, or a UserDb folder, the AUTHENTICATED_USER object is a AccessControl.User.BasicUser instance. In the case of an IMAPAdapter object, it is an IMAPUser instance. The above var tag will render the user name of AUTHENTICATED_USER. > > 2) Once I know the user ID, how can I get a list of places the user is > permitted, so that all users can enter via one "front door" > that always > shows exactly those rooms the user may enter? > User have Roles. Roles are abastractions like Manager, SalesGuy, IMAPUser, or whatever else you want to call a Role. Object and methods in Zope have certain permissions. You can turn on or off certain permissions for certain Roles on individual objects and methods in Zope. Exactly how this access control model works is detailed in the Zope Managers Guide starting around page 17. > 3) Is there any form of permission inheritance or > impersonation implemented? > Our application interfaces with other systems, and maps some > local user IDs > to remote user IDs. Assistants log in with their own IDs, then pick a > "primary" user on whose behalf to work; the system then uses > the "primary" > user's permissions and presents the "primary" user's remote > credentials. > I'm thinking I'll have to do this myself, since I need to > keep both IDs > around for auditing info...fortunately I'm already expecting > to use a custom > authentication layer (ever try to time out a session with basic > authentication?). Objects can acquire permissions from the objects that contain them. If you set a certain flavor of access control on a folder, you can specify that you want the contents of that folder to acquire their parent's permission settings. 'Acquire Permisssions' is the default on all permissions. > > 4) The security screen's permission settings have "acquire" > checkboxes, > whose point is obvious, and per-role checkboxes. I take it > those enable > permissions? So we can allow inherited permissions, and we > can explicitly > add permissions, but there's no way to add-only-if-inherited or > inherit-but-deny-particular-loons-anyway? Also, the permissions on > intervening levels of the tree are not checked, only inherited, right? 'Acquisition' isn't a name we use to mean 'Inheritance', Acquisition is actualy a complimentary mechanism to inheritance. There are several good documents on it here (http://www.zope.org/Documentation/Reference) and this morning I released some rough draft documentation that included some acquisition stuf on the the zdp list (http://www.zope.org/mailman/listinfo/zdp) By checking the acquire box in the security tab, you are telling that object to accept the same permission settings as the parent that contains it. The parent may also be acquiring from *its* parent, and so on, till it reaches the root folder. At each step in the object heirarchy, you are given the ability to make security restrictions less general and more specific to your application. > > 5) If I define users at a high level, can I grant those users > roles defined > at deeper levels? This would make my job with point (2) much > easier, as I > could create roles Foobar_Peon and Foobar_Boss in the Foobar > folder, then > offer the user buttons into Foobar if they have > Foobar_whatever roles... Users 'at higher levels' cannot be given Roles defined below them, but this behavior is easy to emulate with the system, just give them a higher level role that is the superset (contains all of) the permissions that the role you want them to be lower has. Users have Roles, and Roles are collections of permissions. You can have a Role which allows many permissions defined higher up, and the more specialized you get (farther down) you can create more restricted roles that are subset (contain a portion of) the higher level role. > > 6) Is there any plan for, or how hard would it be to > implement, a "reverse" > permission manipulation screen where the role is fixed and > the subsystems > are columns? > I'm not sure why you would want to do this. I'm guessing it's possible and cleaner to do whatever you have in mind with the current method. -Michel > > I'm largely looking at Zope and ACE--and may wind up using them in > conjunction somehow--to recommend as frameworks; ACE (plus > TAO) has good RPC > and OS abstraction layers for C++, while Zope is a much > richer framework for > web applications. If I have to write in permission checking > and proxy users > along with the audit trail and the actual application > functionality, no > biggie... > > Keith (I may need to inhale the developer docs now...) > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0