- Zope - Zope lists

Re: Module security assertions fail
by Josef Meile 02 May '04

02 May '04

Hi Matt, thanks for your reply. I think what you said sounds convincent, but: > I think the first case (TALES syntax) actually tries to *call* the > modules TranslationUtils, whereas the latter (python syntax) doesn't -- > it just references it. I think if you add a 'nocall' statement to the > first case it will do what you want e.g.: > > <span tal:define="TranslationUtils > nocall:modules/Products/JMUtils/TranslationUtils;"> > Something comes here > </span> This must be said on the zope book as well. On section python modules: http://zope.org/Documentation/Books/ZopeBook/2_6Edition/AdvZPT.stx You see that they import the module string as mstring then use the join method. They don't use the nocall statement, so I think with an own module should be the same. However, I read a little bit before this section and saw what you mean. I tried to do it as well and it didn't work either. The same Unauthorized exception was raised. Here is a small test case I did: ---->$Home_Instance/Products/FooContainer/FooPackage.py: from AccessControl import ModuleSecurityInfo #This three lines where suggested by Dieder. #I tried different versions and I got the same results security=ModuleSecurityInfo('Products.FooContainer.FooPackage') ModuleSecurityInfo('Products').declarePublic('FooContainer') ModuleSecurityInfo('Products.FooContainer').declarePublic('FooPackage') security.declarePublic('foo') def foo(): """This is only a test""" return "Just a test function" security.apply(globals()) ---->$Home_Instance/Products/FooContainer/__init__.py __doc__='''FooPackage''' __version__='0.1' #Here I'm importing the module, so that the security #declarations are excecuted (Suggested by Dieter) from Products.FooContainer import FooPackage ---->$Home_Instance/Products/FooProduct/FooProduct.py __doc__="""FooProduct module.""" __version__='0.1' from Globals import InitializeClass from Products.PageTemplates.PageTemplateFile import PageTemplateFile from AccessControl import ClassSecurityInfo from OFS.SimpleItem import SimpleItem manage_addFooProductForm=PageTemplateFile('zpt/FooProduct_Add',globals()) manage_addFooProductForm._owner=None def manage_addFooProduct(self,id,title='',REQUEST=None,submit=None): """Invoques the __init__ method of the FooProduct class""" fooProductObj=FooProduct(id,title) self._setObject(id,fooProductObj) return 'Object created' class FooProduct(SimpleItem): """FooProduct class definition""" security=ClassSecurityInfo() meta_type='FooProduct' #manage_options=SimpleItem.manage_options def __init__(self,id,title=''): """Contructor method to initialize the class properties""" self.id=id self.title=title InitializeClass(FooProduct) ---->$Home_Instance/Products/FooProduct/__init__.py __doc__="""FooProduct initialization module.""" __version__='0.1' from FooProduct import FooProduct, manage_addFooProductForm, manage_addFooProduct from Products.FooContainer import FooPackage def initialize(context): try: context.registerClass(FooProduct, constructors=( manage_addFooProductForm, manage_addFooProduct, ), icon='images/icon.gif', ) except: from sys import exc_info, stderr from traceback import format_exception from string import join type,val,tb=exc_info() stderr.write(join(format_exception(type, val, tb),'')) del type,val,tb ---->$Home_Instance/Products/FooProduct/zpt/FooProduct_Add.zpt <p tal:replace="structure here/manage_page_header">Default Header</p> <h4 tal:define="pageTitleScript python:here.manage_form_title(here,request, form_title='Add FooProduct')" tal:replace="structure pageTitleScript">Add myClass </h4> <div tal:define="FooPackage nocall:modules/Products/FooContainer/FooPackage; fooVar python:FooPackage.foo()" tal:replace="fooVar">Using FooPackage</div> <p class="form-help"> Optional fields are written in <b><i>italic</i></b> </p> <form action="someAction" method="post" enctype="multipart/form-data" tal:define="formAction python:'manage_addFooProduct'" tal:attributes="action formAction"> <table cellspacing="0" cellpadding="2" border="0"> <tr> <td align="left" valign="top"> <div class="form-label">Id</div> </td> <td align="left" valign="top"> <input type="text" name="id" size="40"> </td> </tr> <tr> <td align="left" valign="top"> <div class="form-optional">Title</div> </td> <td align="left" valign="top"> <input type="text" name="title" size="40"> </td> </tr> <tr> <td align="left" valign="top"></td> <td align="left" valign="top"> <input class="form-element" type="submit" name="submit" value=" Add "> </td> </tr> </table> </form> <p tal:replace="structure here/manage_page_footer">Default Footer</p> ---->End If somebody gets it working with the tales sintax: <div tal:define="FooPackage nocall:modules/Products/FooContainer/FooPackage; fooVar python:FooPackage.foo()" tal:replace="fooVar">Using FooPackage</div> and not with the python one: <div tal:define="FooPackage python:modules['Products.FooContainer.FooPackage']; fooVar python:FooPackage.foo()" tal:replace="fooVar">Using FooPackage</div> Just let me know. Otherwise, I'd think it's a bug and will reported it to the collector. One thing to remmember: If you try it with the python sintax and revert the changes on the zpt template without restarting zope, it will work. So, you will have to restart zope for each test. Regards, Josef Meile

1 0

VIRUS IN YOUR MAIL
by postmaster＠rproxy2.ccu.edu.tw 02 May '04

02 May '04

V I R U S A L E R T Our viruschecker found the W32/Netsky.p@MM virus(es) in your email to the following recipient(s): -> u9142060(a)ccu.edu.tw Please check your system for viruses, or ask your system administrator to do so. For your reference, here are the headers from your email: ------------------------- BEGIN HEADERS ----------------------------- Return-Path: <zope(a)zope.org> Received: from ccu.edu.tw (adsl-220-228-66-180.NH.sparqnet.net [220.228.66.180] (may be forged)) by rproxy2.ccu.edu.tw (8.12.11/8.12.11av) with ESMTP id i42Bv3xw034653 for <u9142060(a)ccu.edu.tw>; Sun, 2 May 2004 19:57:05 +0800 (CST) (envelope-from zope(a)zope.org) From: zope(a)zope.org Message-Id: <200405021157.i42Bv3xw034653(a)rproxy2.ccu.edu.tw> To: u9142060(a)ccu.edu.tw Subject: Mail Delivery (failure u9142060(a)ccu.edu.tw) Date: Sun, 2 May 2004 19:57:14 +0800 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_001B_01C0CA80.6B015D10" X-Priority: 3 X-MSMail-Priority: Normal -------------------------- END HEADERS ------------------------------

1 0

Symantec AVF detected a repairable/quarantined virus in a message you sent
by Marty Bauer 02 May '04

02 May '04

Subject of the message: RE: Protected message Recipient of the message: virii

1 0

Module security assertions fail
by Josef Albert Meile 01 May '04

01 May '04

Hi, sorry if you see this message twice, but I posted it yesterday and didn't found it on the list today. So here goes it again: I have two packages "TranslationUtils" and "JMZPTMacros", which I want to use from a zope product. I have implemented the module and class security assertions as indicated on the Zope Developer's Gide, but I got always an Unauthorized error (see the traceback attached at the bottom of this message). Here is the structure: * Some metal macros I want to use with my Products: MyInstanceHome/Products/JMUtils/JMZPTMacros * Some calls to the avalaible Translation services: MyInstanceHome/Products/JMUtils/TranslationUtils * Zope product, which uses the previous packages: MyInstanceHome/Products/JMColorPicker I've had success with JMZPTMacros, but not with TranslationUtils. Here is what I have done (Please note that I put some extra dashes at the begining of the lines, where the indentation is required): ----->Begin of MyInstanceHome/Products/JMUtils/__init__.py __doc__='''JMUtilities''' __version__='0.2' from Products.PythonScripts.Utility import allow_module, allow_class allow_module('Products.JMUtils') allow_module('Products.JMUtils.JMZPTMacros') allow_module('Products.JMUtils.TranslationUtils') #JMZPTMacros has a class inside. On the contrary, #TranslationUtils is only a package of functions from Products.JMUtils.JMZPTMacros import JMZPTMacros allow_class(JMZPTMacros) ----->End of MyInstanceHome/Products/JMUtils/__init__.py ----->Begin of MyInstanceHome/Products/JMUtils/JMZPTMacros.py from Products.PageTemplates.PageTemplateFile import PageTemplateFile from AccessControl import ClassSecurityInfo import Globals class JMZPTMacros: --security=ClassSecurityInfo() --security.declarePublic() --security.declarePublic('generic_add') --generic_add=PageTemplateFile('zpt/generic_add',globals()) --generic_add._owner=None --#The same was done with the rest of my templates on --#the zpt directory of JMUtils # finally Globals.InitializeClass(JMZPTMacros) ----->End of MyInstanceHome/Products/JMUtils/JMZPTMacros.py ----->Begin of MyInstanceHome/Products/JMUtils/TranslationUtils.py from AccessControl import ModuleSecurityInfo security=ModuleSecurityInfo() security.declarePublic('checkTranslationService') def checkTranslationService(): --"""Some code comes here #The same was done for the rest of the functions on this package #Finally security.apply(globals()) ----->End of MyInstanceHome/Products/JMUtils/TranslationUtils.py Then I have a manage_add page template with the following line inside: <span tal:define="TranslationUtils modules/Products/JMUtils/TranslationUtils;"> Something comes here </span> When I try to add the product on the zope manage interface, I get: Traceback (innermost last): Module ZPublisher.Publish, line 100, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 40, in call_object Module Products.JMColorPicker.JMColorPicker, line 24, in manage_addJMColorPickerForm Module Shared.DC.Scripts.Bindings, line 306, in __call__ Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec Module Products.PageTemplates.PageTemplateFile, line 106, in _exec Module Products.PageTemplates.PageTemplate, line 96, in pt_render - <PageTemplateFile at /temp/JMColorPicker_Add> Module TAL.TALInterpreter, line 189, in __call__ Module TAL.TALInterpreter, line 233, in interpret Module TAL.TALInterpreter, line 663, in do_useMacro Module TAL.TALInterpreter, line 233, in interpret Module TAL.TALInterpreter, line 406, in do_optTag_tal Module TAL.TALInterpreter, line 388, in no_tag Module TAL.TALInterpreter, line 233, in interpret Module TAL.TALInterpreter, line 459, in do_setLocal_tal Module Products.PageTemplates.TALES, line 220, in evaluate - URL: generic_add - Line 20, Column 2 - Expression: standard:'modules/Products/JMUtils/TranslationUtils' - Names: {'container': <__FactoryDispatcher__ instance at 9751938>, 'context': <__FactoryDispatcher__ instance at 9751938>, 'default': <Products.PageTemplates.TALES.Default instance at 0x8b337e4>, 'here': <__FactoryDispatcher__ instance at 9751938>, 'loop': <SafeMapping instance at 8778eb0>, 'modules': <Products.PageTemplates.ZRPythonExpr._SecureModuleImporter instance at 0x8b47c1c>, 'nothing': None, 'options': {'Kind': 'JMColorPicker', 'args': ()}, 'repeat': <SafeMapping instance at 8778eb0>, 'request': <HTTPRequest, URL=https://129.132.39.139:8080/temp/manage_addProduct/JMColorPicker/manage_addJMColorPickerForm>, 'root': <Application instance at 8999b40>, 'template': <PageTemplateFile at /temp/JMColorPicker_Add>, 'traverse_subpath': [], 'user': admin} Module Products.PageTemplates.Expressions, line 201, in __call__ Module Products.PageTemplates.Expressions, line 189, in _eval Module Products.PageTemplates.Expressions, line 145, in _eval - __traceback_info__: modules Module Products.PageTemplates.Expressions, line 340, in restrictedTraverse - __traceback_info__: {'path': ['Products', 'JMUtils', 'TranslationUtils'], 'TraversalRequestNameStack': []} Unauthorized: You are not allowed to access 'TranslationUtils' in this context But if I create the following pythonscript (no parameters and return value were given): from Products.JMUtils import TranslationUtils then I hit the test tab and try again to create an instance of my product, it will magically work till zope is restarted. Am I missing something? Thanks in advanced, Josef Meile _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

2 1

Using Access Rules
by Dennis Allison 01 May '04

01 May '04

I want to add some special checking to prevent direct, through the web access to authenticated users who, I discover, can get a second browser window and move around the site from URL independent of access path. Suppose I have pages stored in a folder structure rooted at /foo. The view security permission on /foo/... requires an Authenticated User. Normally pages are served from /foo/... under programatic control and additional constraints are applied. But, if the user creates another browser window and if he/she knows the URL (or the root URL) they can move about /foo/... however they want by simply entering the URL into the browser. (This works because they are authenticated and the authentication is shared in the browser.) An access rule seems to be the right mechanism for this sort of test, but I don't quite understand how to manage the control flow. I put the access rule in /foo. It gets executed when /foo is traversed. Now, it appears that the access rules are executed for side-effects only. If that's the case, the way an error message is returned to the caller is by modifying REQUEST to reference the error message object and not the object originally specified. Returning without changing the REQUEST allows Zope to continue traversing the path. Is my model correct?

3 13

ALERT!! Infected mail sent by you!
by postmaster＠hibox.hinet.net 01 May '04

01 May '04

ALERT!!!! Virus found! Original To: weihao(a)masterlink.com.tw Original Subject: information Original Date: Sat, 01 May 2004 04:59:28 +0100 Virus information: 1. W32.Netsky.B@mm was deleted from ims_temp_file_010226_message.000010/creditcard.exe For more information go to http://www.sarc.com/avcenter/cgi-bin/virauto.cgi?vid=15698 Virus Definitions dated: 20040428(038) HiNet hiBox! Powered by Symantec AntiVirus Scan Engine!

1 0

Completion for zope script
by kbond 01 May '04

01 May '04

Hello, Is there somewhere an editor that allow me to have the completion when I am writting my python script for zope? I am fighting with boa - constructeur in order to get it working with my installation but till now without any success. Thus i have added the following lines in "Explorer.gtk.cfg": zope = {Localhost: {'host': '127.0.0.1', 'httpport':'9080', 'ftpport': '8021', 'username': 'admin', 'passwd': '123', 'path':'/' , 'name': '','localpath':''}} and when I launch boa I get this error message: - Transport category not added: name 'Localhost' is not added any suggestion either to solve my boa pb or to point me to another editor with a completion for zope are more than welcome. thank you for your help

1 0

Re: [Zope] Error when start 2.7
by Dieter Maurer 30 Apr '04

30 Apr '04

Please stay on the list (readded). Damien Wyart wrote at 2004-4-30 18:08 +0200: > ... "zdaemon" startup problem on Linux 2.6 ... >Despite very careful searching, I haven't been able to locate these old >threads. Do you have a more precise reference ? I also need more >technical details about this issue. Search for "waitpid", maybe together with Linux 2.6. The patch author was convinced that "zdaemon" interchanged a flag (I think to "waitpid") between daemon and non-daemon mode. -- Dieter

2 1

Error importing website.
by Pedro Baptista 30 Apr '04

30 Apr '04

>>If possible, do not migrate by import/export but by copying your >>"Data.fs". Your sugestion, unfortunally didn't work. The same error is generated. Any ideas ? Thanks for your try. Pedro Baptista

3 2

__getattr__ and getPhysicalRoot()
by Stefan Bund 30 Apr '04

30 Apr '04

Hello list, I have been trying to implement a special __getattr__ hook now for some time and have come to a dead end. I know, __getattr__ hooks are evil and you should never need theme. I have read the threads about __getattr__ in the zope-dev list-archive. But I still need this. I want to implement a special reference pattern (Something like a combination of PortableHole and TransparentFolder). To this end, I need access to a Zope object specified by its absolute path (getPhysicalPath()) inside the __getattr__ method. The Problem is, __getattr__ is often called without an acquisition wrapper and therefore has no direct access to the Zope root object. I started to dissect the ZPublisher, ZServer, HTTPServer, HTTPRequest, Zope.App.startup.startup and some other source code only to find, that there seems to be *no* way to get at the *current* root object instance for the current thread, since __bobo_traverse__ of ZODB.ZApplication.ZApplicationWrapper does not save the root object anywhere. But I really can't open and close a new ZODB connection inside a __getattr__ hook ... Is there any way out of this dilemma? I Looked and ProtableHole's source, but the solution there doesn't work for me (getPysicalRoot is only defined in Application and is set to Acquisition.Acquired in Traversable. Without an acquisition context this doesn't help much ;-/) If there is no way to solve this problem, I'll have to use my second best solution and refactor my solution so I can override __of__ instead of __getattr__, but the __getattr__ solution would be much more flexible ... Stefan. -- -- *DON'T* TRY TO REACH ME DIRECTLY AT ABOVE EMAIL ADDRESS. Any reply -- received off-list at that address will be *silently* and -- *unconditionally* dropped. You can attribute this inconvenience to -- the proliferation of spammers on the Internet. I hope, you can -- understand my position and accept my counter measures.

3 3