- Zope - Zope lists

Re: [Zope] Defining my own security
by Steve Jibson 30 Apr '04

30 Apr '04

Thank you!! You got me started down the right road. I eneded up putting my check in the "__before_publishing_traverse__" method of my "Folder" and it seems to be doing exactly what I had hoped. Steve Matt Hamilton wrote: >>Okay, here goes... >> >>I have created a Zope Product that extends a Zope Folder object and I >>want to add a non-traditional security check before allowing users to >>"View" stuff in the "folder". For reasons that are too complicated to >>explain here, I can't use Zope roles and permissions for this check (in >>fact, this check should be done in addition to Zope's existing security >>mechanism checks). What I want to do is verify that a particular >>variable in the "Session" matches a specific property of the "folder". >>If it does not match, I want to raise an unauthorized error. >> >>Is this kind of thing possible? Any help will be appreciated. > > > Steve, > Yes this kind of thing is possible. The main question is what exactly > you want to protect. ie. is it a method call on that object (e.g. > objectValues). > > The general code would be something like: > > from zExceptions import Unauthorized > data = REQUEST.SESSION['my_session_var'] > if data != self.myproperty: > raise Unauthorized('You are not authorized to access this > resource.') > > > The more difficult question is where exactly in your code to put this. If > you want to protect the access of object within the folder, then I think > you will need to put it in __getitem__ somewhere. However I do remember > talking to someone else about this and one of the methods like that > overrides the security, or swallows the exception or something. You may > have to play areound with it, or try putting it in __bobo_traverse__ > > -Matt >

1 0

Re: [Zope] Defining my own security
by Matt Hamilton 30 Apr '04

30 Apr '04

> Okay, here goes... > > I have created a Zope Product that extends a Zope Folder object and I want to add a non-traditional security check before allowing users to "View" stuff in the "folder". For reasons that are too complicated to explain here, I can't use Zope roles and permissions for this check (in fact, this check should be done in addition to Zope's existing security mechanism checks). What I want to do is verify that a particular variable in the "Session" matches a specific property of the "folder". If it does not match, I want to raise an unauthorized error. > > Is this kind of thing possible? Any help will be appreciated. Steve, Yes this kind of thing is possible. The main question is what exactly you want to protect. ie. is it a method call on that object (e.g. objectValues). The general code would be something like: from zExceptions import Unauthorized data = REQUEST.SESSION['my_session_var'] if data != self.myproperty: raise Unauthorized('You are not authorized to access this resource.') The more difficult question is where exactly in your code to put this. If you want to protect the access of object within the folder, then I think you will need to put it in __getitem__ somewhere. However I do remember talking to someone else about this and one of the methods like that overrides the security, or swallows the exception or something. You may have to play areound with it, or try putting it in __bobo_traverse__ -Matt -- Matt Hamilton matth(a)netsight.co.uk Netsight Internet Solutions, Ltd. Business Vision on the Internet http://www.netsight.co.uk +44 (0)117 9090901 Web Design | Zope/Plone Development and Consulting | Co-location | Hosting

1 0

CallProfiler and Zope 2.7
by Brian Sullivan 30 Apr '04

30 Apr '04

Does anybody know if CallProfiler 1.4 (http://zope.org/Members/richard/CallProfiler) is compatible with Zope 2.7? I see various references to a call profiler included in 2.7 ( though I can't find any evidence of it) -- is there something already there? If not can I use CallProfiler 1.4? ( an attempt to include in the Products directory of my instance seems to make Zope fail to start up so I am guessing that it doesn't work or I misunderstand how to use it)

2 1

Looking for help on 3 issues
by Hauan, Michael J 30 Apr '04

30 Apr '04

Hello! We have funding to develop a site in support of the local community of peoplewith disabilities and are using Zope/CMF/Plone. Among the many issues involved in getting a site developed, we have found little in online searches about the following three and would greatly appreciate any advice or assistance on them: 1) user session tracking -- we want to study how users use the site, what pages they visit, how much content they contribute, how long these various activities take, etc. Is it possible to do this in Zope alone or must I wrap Zope in Apache and rely on Apache's log files (which won't give me *all* the info I need). 2) reducing viral load -- Zope/CMF/Plone has rich facilities for user's to upload content. Is there any Zope product or methods to scan uploads for viruses and/or search for them were they to arrive in order to ensure our site does not become a virus propagator? 3) ensuring user privacy -- our project wants to provide users the ability to securely store private and potentially sensitive information. Is there a type of folder object that accomplishes this? We imagine the contents of this folder being visible only to the authenticated user and no one else, including the site administrator or manager. Many thanks! mjh

3 2

problems with very long html output?
by Jim Abramson 29 Apr '04

29 Apr '04

I have a zope app that, under certain conditions, will output a very very long html file - the current case I'm looking at has nearly 32,000 lines. After about 3,000 lines, and around every 300 lines thereafter, I'm seeing some unsolicited crlf + output...it's almost always: 1f40 ...right there in the middle of whatever the dtml (in this case) rendered. For example, here is an actual excerpt of the html output: <input type="checkbox" name="rejectSidList:int:list" value="512199" onclick="if (this.checked) this.form.elements['skipSidLis 1f40 t:int:list'][44].checked=false; return true"> reject match So I know it's not a glitch in my dtml. The javascript there is perfectly contiguous in the dtml source. Does zope have a problem with very long iterations in dtml, or very long output? Any other ideas? I'm stumped. Thanks, Jim

2 1

Server Name
by Asad Habib 29 Apr '04

29 Apr '04

Hello. I am using REQUEST.SERVER_NAME to fetch the canonical name of the machine that Zope is running on but 'localhost' is returned instead. Does anyone know why this is happening? Any help would be greatly appreciated. Thanks. - Asad

2 1

Error when start 2.7
by Michael J. Maravillo 29 Apr '04

29 Apr '04

Hi everyone, I'm getting the following error when starting up zope. Despite the error though, zope seems to be running fine. I'd really appreciate any help. Starting zope: Traceback (most recent call last): File "/usr/lib/zope2.7/lib/python/Zope/Startup/zopectl.py", line 207, in ? main() File "/usr/lib/zope2.7/lib/python/Zope/Startup/zopectl.py", line 190, in main c.onecmd(" ".join(options.args)) File "/usr/lib/python2.3/cmd.py", line 210, in onecmd return func(arg) File "/usr/lib/zope2.7/lib/python/Zope/Startup/zopectl.py", line 134, in do_start ZDCmd.do_start(self, arg) File "/usr/lib/zope2.7/lib/python/zdaemon/zdctl.py", line 214, in do_start os.spawnvp(flag, args[0], args) File "/usr/lib/python2.3/os.py", line 543, in spawnvp return _spawnvef(mode, file, args, None, execvp) File "/usr/lib/python2.3/os.py", line 504, in _spawnvef wpid, sts = waitpid(pid, 0) OSError: [Errno 10] No child processes -- .--. Michael J. Maravillo http://maravillo.no-ip.com/ ( () ) Q Linux Solutions, Inc. office://+63.2.750.1800/ `--\\ Consultancy/Training/Support/Development http://www.q-linux.com/

2 1

How to support Chinese Characters in ZMI?
by Lian Liming 29 Apr '04

29 Apr '04

Hi, I find that the ZMI doesn't support Chinese very well. I type some chinese characters in the ZMI, and after "save change", the characters didn't display well. The default charset for ZMI is "ISO-8859" which doesn't support Chinese. I want to change it to "UTF-8" to support Chinese. My zope version is 2.6.4 and i don't want to upgrade to 2.7. Is there some way to solve the problem in v2.6? Thanks in advance!

3 2

Multiple FTP sessions for a user.
by Doug Filteau 29 Apr '04

29 Apr '04

I need to enable a non-anonymous username to have >1 session (like an anonymous user). The username is used in an MS Outlook macro to upload documents via FTP to the Zope server, which means that the possibility exists for multiple instances of the same username may be connected concurrently to the Zope instance. Currently, if a user connects to the Zope instance using the upload username, subsequent users get a "Connection closed by remote host" error. In addition, the FTP server seems to have a very long timeout setting. I've looked in the ZServer/Medusa code but haven't found the magic bullet for either problem yet. Any help would be appreciated. -- Doug

4 3

How to get Path to DTML Document.
by Martin Koekenberg 29 Apr '04

29 Apr '04

Hello, I want to create a snail trail to a DTML Document, something like this : Home | news | lates news. The titels are title of the folder structure. Is there a product for zope ore has anybody some code ?? Greetings, Martin Koekenberg

2 1