- Zope - Zope lists

RE: [Zope] Request.py and duplicate column names
by TFE MMS JARVIS JOHN 03 Mar '99

03 Mar '99

Oops! The a.b_id=a.id was a typo in my mail. Sorry about that. I did mean a.b_id=b.id. I also tried out Brad Clements' suggestion (thanks, I would have never thought to write it that way!) but it raises the same exception. It works fine with the patch, though. Thank you for your responses! John Jarvis Tokyo Electron FE, Ltd. > -----Original Message----- > From: chris.hunter(a)humancode.com [SMTP:chris.hunter@humancode.com] > Sent: Wednesday, March 03, 1999 1:46 AM > To: bkc(a)murkworks.com > Cc: TFE MMS JARVIS JOHN; zope(a)zope.org > Subject: Re: [Zope] Request.py and duplicate column names > > > > Brad Clements wrote: > > > > On 2 Mar 99, at 18:40, TFE MMS JARVIS JOHN wrote: > > > > > 1. When trying to do a join (a lazy query, I know) like: > > > > > > select a.*, b.* > > > from tablea a, tableb b > > > where a.b_id=a.id > > Is there any chance that you're trying to do something > like: > > select * > from a, b > where a.b_id = b.id > ^ > Note that I'm joining a field in a to a field > in b here (not 2 fields in a) > > Hope this helps. > > --chris > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope

1 0

ZServer and MSIE
by Dave G 03 Mar '99

03 Mar '99

For those interested changing the "chunks=1" to "chunks=0" in http_server.py did in fact fix the incompatibility with MSIE and ZServer. Zope's, I don't consider this a bug with ZServer but with MSIE as this also plauged me using Frontier cgi's many times, the fix was the same. So I'm not creating a bug report unless you want this documented. DAve. >I too have noticed this on occasion. I believe that the problem has to do >with ZServer's attempt at chunking responses. > >The next version of ZServer will significantly alter the way ZServer >handles HTTP response munging issues like this, and hopefully will fix this >problem. > >Thanks for the bug report. > >-Amos > >P.S. Until then Brad Clements's advice to change use_chunked=1 to >use_chunked=0 in medusa/http_server.py may help. "On the Plains of Hesitation bleach the bones of countless millions who, at the Dawn of Victory, sat down to wait, and waiting -- died"

1 0

AUTHENTICATED_USER
by JP Glutting 02 Mar '99

02 Mar '99

Does anyone have any more information on AUTHENTICATED_USER? We saw a while back that it has properties (AUTHENTICATED_USER.has_role(['Manager', 'Editor'])). I would like to be able to get the user name, and use that to index simple files for users. Is there something like AUTHENTICATED_USER['UserName']?? This is essentially the information that is returned if you try . However, if you try something like , it does not work. The only way I have been able to use this information so far is to put <INPUT TYPE=hidden name=userID value=""> in a form, and pass it in a REQUEST to another page. But I want to be able to get this information directly. I have even tried REQUEST.set('myUser', AUTHENTICATED_USER) inthe header, but this has the same problem (unsurprisingly) as AUTHENTICATED_USER itself. Any hints? Thanks, JP

3 2

Re: [Crew] Re: [Zope] Re: [Crew] Re: External Methods?
by Aaron Watters 02 Mar '99

02 Mar '99

Suggestion: for python-python data transfer and storage XML-RPC is overkill. Python already has marshal which will be a lot faster and I think do the same thing. Also, if you haven't, please have a look at what I did using gadfly and cgi. I know it's more conventional and hence boring, but nevertheless... http://starship.skyport.net/crew/aaron_watters/kwParsing/chatcgi.cgi (source included). -- Aaron Watters

1 0

RE: [Zope] Re: [Crew] External Methods?
by Brian Lloyd 02 Mar '99

02 Mar '99

> I understand the security problems inherent in > ExternalMethods; unfortunately, > without them, Zope is merely an "also-ran" in the web > applicaton race, from my > perspective. DTML in isolation is not an "ASP-killer." > > I'm CC'ing the Zope list, in hopes that someone there can > either allay or slay > our fears. > > It seems to me that the security problem is that > ExternalMethods can get access > to "sibling objects" of the object on which they are invoked, > right? I mean, if > we could make the siblings inaccessible, and acquired > properties read-only, then > we should be ok, no? Ugh, I don't grok acquisition well > enough to tackle that > myself, I fear. Well, it's actually deeper than that. You are correct in saying that DTML alone is not an ASP-killer. Consider the similarities between Zope and, for example, ASP/COM (though the same holds true for practically any other system as well): ASP lets you use the services provided by (COM) objects, which may be provided by the server or provided independently. I'm sure that MS tries to make the server-provided objects fairly safe, but there is _nothing_ stopping a programmer from writing and installing a COM object with an evil() method that wipes out your C: drive, except the fact that presumably the sysadmin exercises some control over making these independent services available. The same holds true for Zope (and any other app server out there). Like ASP/COM, External Methods give you the ability to provide more powerful services for use by your application. It also gives you exactly the same problems (though I'm sure that evil() method could be developed in a quarter of the time in Python :) Basically, with power comes responsibility, and I can't really imagine any system that could _safely_ allow possibly-untrusted people to write (basically) arbitrary code. It's not even really a matter of what services are or are not available to those people. I'm sure that many, many hours and much brain-power went into the design of Java's security mechanisms. Even so, if I were a web site manager I still couldn't let untrusted users write their own arbitrary java code to run in my web or app server. Even after I had figured out a way to wall off every service I could think of that could possibly be harmful, the user could still probably just do the Java equivalent of: while 1: pass Zope DTML goes to a good deal of trouble to minimize these problems in DTML itself, and we would certainly consider any concrete ideas on how to make External Methods safer. Can you give me some examples of other app servers that you feel deal with safety of external services in a better way? I'd be happy to do some looking into how others are dealing with this. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

5 5

RE: [Zope] Anyone want to give a talk about Zope at WWW8?
by Paul Everitt 02 Mar '99

02 Mar '99

David wrote: > http://www.utoronto.ca/ian/WWW8/sessions.html > > See session 6, run by our friend Cameron Laird. Actually I emailed a talk proposal for the last one (Brian Behlendorf's Open Source one). --Paul

1 0

FTop level name
by rwolff＠noao.edu 02 Mar '99

02 Mar '99

This feels so dumb but: How do I change the manage page so it says, for example, "Plutonia" next to the top folder, instead of "Zope"?

1 0

ZMySQLDA installation
by Timothy Grant 02 Mar '99

02 Mar '99

Hi all, This is probably more of a newbie Linux question than a newbie Zope question, but I'm going to ask it here anyway: I would like to connect Zope to a database, so I have setup both PostgreSQL and MySQL. My reading tells me that MySQL is probably the better choice as a web backend (Any comments from those of you more knowledgable than I would be appreciated!) So I downloaded the MySQL source, compiled, installed and tested it. It looks like I did it right. I then downloaded the ZMySQLDA from the Zope site. I have followed the directions--I think, but get the following error when trying to do the initial make: [tjg@puddleglum src]$ make -f Makefile.pre.in boot rm -f *.o *~ rm -f *.a tags TAGS config.c Makefile.pre python sedscript rm -f *.so *.sl so_locations VERSION=`python -c "import sys; print sys.version[:3]"`; \ installdir=`python -c "import sys; print sys.prefix"`; \ exec_installdir=`python -c "import sys; print sys.exec_prefix"`; \ make -f ./Makefile.pre.in VPATH=. srcdir=. \ VERSION=$VERSION \ installdir=$installdir \ exec_installdir=$exec_installdir \ Makefile make[1]: Entering directory `/usr/local/zope/Zope-1.10.0pr1-linux2-x86/lib/pytho n/Products/ZMySQLDA/src' make[1]: *** No rule to make target `/usr/lib/python1.5/config/Makefile', needed by `sedscript'. Stop. make[1]: Leaving directory `/usr/local/zope/Zope-1.10.0pr1-linux2-x86/lib/python /Products/ZMySQLDA/src' make: *** [boot] Error 2 Any help would be greatly appreciated. -- Stand Fast, tjg. =================================================== Timothy Grant VP Technology/CTO Avalon Technology Group tjg(a)avalongroup.net www.avalongroup.net (503) 246-3630 voice (503) 246-3124 fax _______________________________________________ Zope maillist - Zope(a)zope.org http://www.zope.org/mailman/listinfo/zope

3 2

ZPublisher or Bobo and stdout
by Dr. Armin Tschammer 02 Mar '99

02 Mar '99

Hi, The followowing problem seems very fundamental to me. I already did a post to this group to this topic and I got the following answer: On Wed, 13 Jan 1999, Dr. Armin Tschammer wrote: > I publish the following Modul with Bobo: > Very simple: > > hello.py: > > import sys, os, time > import DocumentTemplate > > lib=sys.path[0] > sys.path.append(os.path.join(lib,'DT')) > > def hello(): > "Display a greeting" > # print "rrr" > X3 = DocumentTemplate.HTMLFile(lib+'/hello.dtml') > return X3() > Now, when I make the commentated line print "rrr" active, I get > Internal Server Error The "print" goes directly to the webserver, which confused it: it expects HTTP headers like "HTTP/1.0 200 Okay". The "return" sends your data to *Zope*, which then does the header stuff for you. Same with cookies, content-type, etc. Summary: dont use 'print', or redirect stdout to a log file. Now the problem is deeper, what shall I do when I am import C++ Modules in Python ( extending Python), and that modules are writing to the stdout via "cout" or "printf", I have no influence to that. If I change the stdout via "freopen( "file, "wr", stdout )" or stuff like that, I have no chance to switch back to the *real* stdout ( look at the c-faq of comp.lang.c ), and I *have to* switch back because of the cgi-mechnism, which uses ZPublisher. The only the chance to handle stuff like that is to work with two processes in the Zopemechanism. A Zopeserver which tells the Zope Client to start a pythonfunction. Now all stdout happens on the client and the server listen for a string on a socket ( or something similar ). Now when the server gets the string it does all necessary wrapping ( content-type and so on ), and send it to the Xserver via its stdout. Or is there a less complicate solution ? Thanks in advance Armin

2 1

RFQ: Upgd Netscape 2.x auth patch to Netscape 3.5.x
by Rob Page 02 Mar '99

02 Mar '99

Hello everyone: Some of you may know that many moons ago we (Brian) developed a plug-in for Netscape Enterprise Server (ES) 2.x (and FastTrack -- based on the same libraries) that addressed Netscape's nasty habit of removing authenticated_user information from the environment before calling CGI apps. Obviously, this has a deleterious effect on interesting zope applications. Fortunately (?), we are up to our armpits in projects and initiatives. As a result, we need someone to do a bit of work to upgrade the plug-in from ES 2.x to ES 3.5.x. I can provide the following files from our 2.x incarnation: o plug-in source code o obj.conf o magnus.conf The source code is only 153 lines of generously formatted C (w/lots of defs) so I'm hopeful that this isn't a HUGE task. I'm interested in hearing quotes from people in the community that have experience with the NSAPI and would, for a reasonable fee, develop, compile (Solaris 2.6 and NT4) and test an upgraded plug-in. The work would be contributed back under the ZPL. Naturally, I'd also entertain offers from people to do this for free! :^) --Rob P.S. - I KNOW there are some NSAPI wizards out there so don't be shy! -- Rob Page V: 540 371 6909 Digital Creations http://www.digicool.com

1 0