- Zope - Zope lists

RE: [Zope] AUTHENTICATED_USER, and what you can do with it.
by Michel Pelletier 03 Mar '99

03 Mar '99

> -----Original Message----- > From: Martijn Pieters [mailto:mj@antraciet.nl] > Sent: Tuesday, March 02, 1999 9:35 AM > To: JP Glutting; zope(a)zope.org > Subject: [Zope] AUTHENTICATED_USER, and what you can do with it. > > This is an excellent post. I want to add that _getPassword() is a handy function also if you want to use your Zope user to authenticate into an external system, like POP3 or IMAP. -Michel > Use  > > More hints linke this can be found in the User.py file in your > lib/python/AccessControl directory. > > The following functions could be usefull: > > getUserName(self): Return the username of a user > getRoles(self): Return the list of roles assigned to a user. > getDomains(self): Return the list of domain restrictions for a user > allowed(self, parent, roles=None): Check wether the user has > access to parent > hasRole(self, parent, roles=None): Check wether the user has > the specified > roles > has_role(self, roles): Check wether the user has the specified roles > > allowed & hasRole are one and the same. When called with > parent=None, it > just returns wether the user has the named roles. has_role > also checks for > roles, but doesn't automatically include the Anonymous role. So, > hasRole(None, 'Anonymous') always returns true, but > has_role('Anonymous') > returns false for every user that has been authenticated. > > Note that AUTHENTICATED_USER is always defined, also for > anonymous access. > > Here is a little example of what you could do with these functions: > > Display user info > You are the user named . > >  > You have the following roles: > >  > <LI> >  >  > You have no roles defined. >  > > >  > You are allowed to log in from the following domains: > >  > <LI> >  >  > You can log in from any domain. >  > > >  > You have the 'Manager' role. >  > >  > You have the 'Anonymous' role. You are therefore an anonymous > user. >  > >  > You have the 'nonexistent' role. >  >  > > The last call to has_role is to show that the user defined in > the 'access' > file in the root folder of your Zope installation, has ALL > roles, including > non-existent ones. And even more interesting, the call to > getRoles() will > get you 'manage', a misspelled version of the 'Manager' role. This is > probably the only way to reliably recognize the superuser. > > > -- > M.J. Pieters, Web Developer > | Antraciethttp://www.antraciet.nl > | Tel: +31-35-6254545 Fax: +31-35-6254555 > | mailto:mj@antraciet.nl http://www.antraciet.nl/~mj > | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 ------------------------------------------ _______________________________________________ Zope maillist - Zope(a)zope.org http://www.zope.org/mailman/listinfo/zope

5 5

Zope 1.10.2 dies every so often.
by Jose.Lacal＠icn.siemens.com 03 Mar '99

03 Mar '99

Folks: My installation of Zope 1.10.2 dies every so often, from once a week to twice a day (like today). I am running Red Hat 5.0 on a 486 / 32 Mb RAM. I upgraded from Zope 1.9.0 to 1.10.2 /var/server.errors says: WARNING: Python C API version mismatch for module _pg: This Python has API version 1007, module _pg has version 1006. brfw1ext.fl.icn.siemens.com - - [02/Mar/1999 16:36:46] "GET /documents/portable.pdf HTTP/1.1" 200 - Traceback (innermost last): File "ZopeHTTPServer/ZopeHTTPServer.py", line 388, in handle_request self.process_request(request, client_address) File "lib/python1.5/SocketServer.py", line 239, in process_request self.finish_request(request, client_address) File "lib/python1.5/SocketServer.py", line 243, in finish_request self.RequestHandlerClass(request, client_address, self) File "lib/python1.5/SocketServer.py", line 362, in __init__ self.handle() File "lib/python1.5/BaseHTTPServer.py", line 258, in handle method() File "ZopeHTTPServer/ZopeHTTPServer.py", line 292, in do_GET self.publish_module() File "ZopeHTTPServer/ZopeHTTPServer.py", line 305, in publish_module publish_module( File "lib/python/ZPublisher/Publish.py", line 893, in publish_module if response: stdout.write(response) File "ZopeHTTPServer/ZopeHTTPServer.py", line 240, in write self.handler.wfile.write(self.data[:start]+IOError: (32, 'Broken pipe')brfw1ext.fl.icn.siemens.com - - [02/Mar/1999 16:36:47] "GET /documents/portable.pdf HTTP/1.1" 200 -Traceback (innermost last): File "ZopeHTTPServer/ZopeHTTPServer.py", line 388, in handle_request self.process_request(request, client_address) File "lib/python1.5/SocketServer.py", line 239, in process_request self.finish_request(request, client_address) File "lib/python1.5/SocketServer.py", line 243, in finish_request self.RequestHandlerClass(request, client_address, self) File "lib/python1.5/SocketServer.py", line 362, in __init__ self.handle() File "lib/python1.5/BaseHTTPServer.py", line 258, in handle method() File "ZopeHTTPServer/ZopeHTTPServer.py", line 292, in do_GET self.publish_module() File "ZopeHTTPServer/ZopeHTTPServer.py", line 305, in publish_module publish_module( File "lib/python/ZPublisher/Publish.py", line 893, in publish_module if response: stdout.write(response) File "ZopeHTTPServer/ZopeHTTPServer.py", line 240, in write self.handler.wfile.write(self.data[:start]+ IOError: (32, 'Broken pipe')brfw1ext.fl.icn.siemens.com - - [02/Mar/1999 16:36:54] "GET /documents/portable.pdf HTTP/1.1" 200 - Obviously I have something wrong here. Any ideas? TIA.

2 1

RE: [Zope] Request.py and duplicate column names
by TFE MMS JARVIS JOHN 03 Mar '99

03 Mar '99

Oops! The a.b_id=a.id was a typo in my mail. Sorry about that. I did mean a.b_id=b.id. I also tried out Brad Clements' suggestion (thanks, I would have never thought to write it that way!) but it raises the same exception. It works fine with the patch, though. Thank you for your responses! John Jarvis Tokyo Electron FE, Ltd. > -----Original Message----- > From: chris.hunter(a)humancode.com [SMTP:chris.hunter@humancode.com] > Sent: Wednesday, March 03, 1999 1:46 AM > To: bkc(a)murkworks.com > Cc: TFE MMS JARVIS JOHN; zope(a)zope.org > Subject: Re: [Zope] Request.py and duplicate column names > > > > Brad Clements wrote: > > > > On 2 Mar 99, at 18:40, TFE MMS JARVIS JOHN wrote: > > > > > 1. When trying to do a join (a lazy query, I know) like: > > > > > > select a.*, b.* > > > from tablea a, tableb b > > > where a.b_id=a.id > > Is there any chance that you're trying to do something > like: > > select * > from a, b > where a.b_id = b.id > ^ > Note that I'm joining a field in a to a field > in b here (not 2 fields in a) > > Hope this helps. > > --chris > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope

1 0

ZServer and MSIE
by Dave G 03 Mar '99

03 Mar '99

For those interested changing the "chunks=1" to "chunks=0" in http_server.py did in fact fix the incompatibility with MSIE and ZServer. Zope's, I don't consider this a bug with ZServer but with MSIE as this also plauged me using Frontier cgi's many times, the fix was the same. So I'm not creating a bug report unless you want this documented. DAve. >I too have noticed this on occasion. I believe that the problem has to do >with ZServer's attempt at chunking responses. > >The next version of ZServer will significantly alter the way ZServer >handles HTTP response munging issues like this, and hopefully will fix this >problem. > >Thanks for the bug report. > >-Amos > >P.S. Until then Brad Clements's advice to change use_chunked=1 to >use_chunked=0 in medusa/http_server.py may help. "On the Plains of Hesitation bleach the bones of countless millions who, at the Dawn of Victory, sat down to wait, and waiting -- died"

1 0

AUTHENTICATED_USER
by JP Glutting 02 Mar '99

02 Mar '99

Does anyone have any more information on AUTHENTICATED_USER? We saw a while back that it has properties (AUTHENTICATED_USER.has_role(['Manager', 'Editor'])). I would like to be able to get the user name, and use that to index simple files for users. Is there something like AUTHENTICATED_USER['UserName']?? This is essentially the information that is returned if you try . However, if you try something like , it does not work. The only way I have been able to use this information so far is to put <INPUT TYPE=hidden name=userID value=""> in a form, and pass it in a REQUEST to another page. But I want to be able to get this information directly. I have even tried REQUEST.set('myUser', AUTHENTICATED_USER) inthe header, but this has the same problem (unsurprisingly) as AUTHENTICATED_USER itself. Any hints? Thanks, JP

3 2

Re: [Crew] Re: [Zope] Re: [Crew] Re: External Methods?
by Aaron Watters 02 Mar '99

02 Mar '99

Suggestion: for python-python data transfer and storage XML-RPC is overkill. Python already has marshal which will be a lot faster and I think do the same thing. Also, if you haven't, please have a look at what I did using gadfly and cgi. I know it's more conventional and hence boring, but nevertheless... http://starship.skyport.net/crew/aaron_watters/kwParsing/chatcgi.cgi (source included). -- Aaron Watters

1 0

RE: [Zope] Re: [Crew] External Methods?
by Brian Lloyd 02 Mar '99

02 Mar '99

> I understand the security problems inherent in > ExternalMethods; unfortunately, > without them, Zope is merely an "also-ran" in the web > applicaton race, from my > perspective. DTML in isolation is not an "ASP-killer." > > I'm CC'ing the Zope list, in hopes that someone there can > either allay or slay > our fears. > > It seems to me that the security problem is that > ExternalMethods can get access > to "sibling objects" of the object on which they are invoked, > right? I mean, if > we could make the siblings inaccessible, and acquired > properties read-only, then > we should be ok, no? Ugh, I don't grok acquisition well > enough to tackle that > myself, I fear. Well, it's actually deeper than that. You are correct in saying that DTML alone is not an ASP-killer. Consider the similarities between Zope and, for example, ASP/COM (though the same holds true for practically any other system as well): ASP lets you use the services provided by (COM) objects, which may be provided by the server or provided independently. I'm sure that MS tries to make the server-provided objects fairly safe, but there is _nothing_ stopping a programmer from writing and installing a COM object with an evil() method that wipes out your C: drive, except the fact that presumably the sysadmin exercises some control over making these independent services available. The same holds true for Zope (and any other app server out there). Like ASP/COM, External Methods give you the ability to provide more powerful services for use by your application. It also gives you exactly the same problems (though I'm sure that evil() method could be developed in a quarter of the time in Python :) Basically, with power comes responsibility, and I can't really imagine any system that could _safely_ allow possibly-untrusted people to write (basically) arbitrary code. It's not even really a matter of what services are or are not available to those people. I'm sure that many, many hours and much brain-power went into the design of Java's security mechanisms. Even so, if I were a web site manager I still couldn't let untrusted users write their own arbitrary java code to run in my web or app server. Even after I had figured out a way to wall off every service I could think of that could possibly be harmful, the user could still probably just do the Java equivalent of: while 1: pass Zope DTML goes to a good deal of trouble to minimize these problems in DTML itself, and we would certainly consider any concrete ideas on how to make External Methods safer. Can you give me some examples of other app servers that you feel deal with safety of external services in a better way? I'd be happy to do some looking into how others are dealing with this. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

5 5

RE: [Zope] Anyone want to give a talk about Zope at WWW8?
by Paul Everitt 02 Mar '99

02 Mar '99

David wrote: > http://www.utoronto.ca/ian/WWW8/sessions.html > > See session 6, run by our friend Cameron Laird. Actually I emailed a talk proposal for the last one (Brian Behlendorf's Open Source one). --Paul

1 0

FTop level name
by rwolff＠noao.edu 02 Mar '99

02 Mar '99

This feels so dumb but: How do I change the manage page so it says, for example, "Plutonia" next to the top folder, instead of "Zope"?

1 0

ZMySQLDA installation
by Timothy Grant 02 Mar '99

02 Mar '99

Hi all, This is probably more of a newbie Linux question than a newbie Zope question, but I'm going to ask it here anyway: I would like to connect Zope to a database, so I have setup both PostgreSQL and MySQL. My reading tells me that MySQL is probably the better choice as a web backend (Any comments from those of you more knowledgable than I would be appreciated!) So I downloaded the MySQL source, compiled, installed and tested it. It looks like I did it right. I then downloaded the ZMySQLDA from the Zope site. I have followed the directions--I think, but get the following error when trying to do the initial make: [tjg@puddleglum src]$ make -f Makefile.pre.in boot rm -f *.o *~ rm -f *.a tags TAGS config.c Makefile.pre python sedscript rm -f *.so *.sl so_locations VERSION=`python -c "import sys; print sys.version[:3]"`; \ installdir=`python -c "import sys; print sys.prefix"`; \ exec_installdir=`python -c "import sys; print sys.exec_prefix"`; \ make -f ./Makefile.pre.in VPATH=. srcdir=. \ VERSION=$VERSION \ installdir=$installdir \ exec_installdir=$exec_installdir \ Makefile make[1]: Entering directory `/usr/local/zope/Zope-1.10.0pr1-linux2-x86/lib/pytho n/Products/ZMySQLDA/src' make[1]: *** No rule to make target `/usr/lib/python1.5/config/Makefile', needed by `sedscript'. Stop. make[1]: Leaving directory `/usr/local/zope/Zope-1.10.0pr1-linux2-x86/lib/python /Products/ZMySQLDA/src' make: *** [boot] Error 2 Any help would be greatly appreciated. -- Stand Fast, tjg. =================================================== Timothy Grant VP Technology/CTO Avalon Technology Group tjg(a)avalongroup.net www.avalongroup.net (503) 246-3630 voice (503) 246-3124 fax _______________________________________________ Zope maillist - Zope(a)zope.org http://www.zope.org/mailman/listinfo/zope

3 2