- Zope - Zope lists

Re: [Zope] cookie Crumbler problem
by Chris Withers 26 Mar '04

26 Mar '04

Joshua Newman wrote: > Code for form: (in html without the end brackets) (when you're posting in plain text, it's fine to put in real html ;-) > input name="prop" type="hidden" value="<dtml-var prop>" > textarea name="propval" rows="15" cols="65" wrap="hard" > /textarea > if ( context.index_html.hasProperty(REQUEST['prop']) ): > context.index_html.manage_changeProperties({ REQUEST['prop'] : propval }) > else: > context.index_html.manage_addProperty(REQUEST['prop'], propval, 'text') oh how many times I've wishes for an "addOrChangeProperties" method ;-) > What's interesting is that it works when a user is already > authenticated and makes it to the edit form. It fails only when the > form is arrived at by an anonymous user and has to authenticate in the > middle of the form submission when the python script requires > privileges in order to change properties. Bingo :-) Of course that'll happen thinking about it. Cookie auth involved http redirects, which means different requests. the solution is to make your form only viewable by authenticated people :-) > I'm using Cookie crumbler (newest version). And I've tried making the > individual pages secured but the same problem occurs. When the form > is secured it disables the passed variables needed to use the form. Then you need to make whatever passes those variable not anonymously viewable as well. Either that, or store stuff in the SESSION instead of the REQUEST, since that'll last through redirects. cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

Problem with VirtualHostMonster
by FLORAC Thierry 26 Mar '04

26 Mar '04

Hi, I was using Zope "SiteRoot" product until now (without any problem) to handle my Zope virtual hosting behind an Apache server with rewrite rules. I've tried recently to use VirtualHostMonster product, but had to face a little problem : - if I load an object and call his "absolute_url()" method, everything is OK - if I load an object, store it in a REQUEST variable or on the stack with "<dtml-with>" or "<dtml-let>", and call "absolute_url()" on this object, the URL is not rewritten. Is there any way to handle this problem ?? Thanks, Thierry

2 5

Security issue FIXED by installing VerboseSecurity?
by Milos Prudek 26 Mar '04

26 Mar '04

I am trying to move my application from Zope 2.5 to Zope 2.7. There was the security audit, so problems are expected to crop up. But I stumpled across something unexplicable... Pretty innocent Python Script gives error "ValueError: unpack list of wrong size". To investigate the error, I installed VerboseSecurity. The error dissappeared. I removed VerboseSecurity. Error appeared. I installed VerboseSecurity again. Error disappeared. How is this possible? I did not even set ZOPE_SECURITY_POLICY=PYTHON, because I was not sure if Zope 2.7 reads environment variables. Yet VerboseSecurity "fixed" the error. I don't like this kind of fix... especially since I do not understant it. Here's the script in question: Dct={} Dct['readers'] = context.readers+1 context.propertysheets.data.manage_changeProperties(Dct) It's the third line that caused the error. This script runs "proxy Manager" because it updates a property even if the user is not the owner of the ZClass instance that this script belongs to. Here's the traceback: Traceback (innermost last): * Module ZPublisher.Publish, line 100, in publish * Module ZPublisher.mapply, line 88, in mapply * Module ZPublisher.Publish, line 40, in call_object * Module OFS.DTMLMethod, line 130, in __call__ <DTMLMethod instance at 4187a320> URL: http://localhost:9080/choroby/ucho/skalni/obecne/1/index_html_top/manage_ma… Physical Path:/www.orl.cz/choroby/ucho/skalni/obecne/1/index_html_top * Module DocumentTemplate.DT_String, line 474, in __call__ * Module Shared.DC.Scripts.Bindings, line 320, in __render_with_namespace__ * Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec * Module Products.PythonScripts.PythonScript, line 318, in _exec * Module None, line 3, in inc_readers <PythonScript at /www.orl.cz/choroby/ucho/skalni/obecne/1/inc_readers> Line 3 * Module AccessControl.Owned, line 123, in getWrappedOwner ValueError: unpack list of wrong size -- Milos Prudek _________________ Most websites are confused chintzy gaudy conflicting tacky unpleasant... unusable. Learn how usable YOUR website is! http://www.spoxdesign.com

3 5

RE: [Zope] Programmatically deleting objects
by Horak, Karl 26 Mar '04

26 Mar '04

Chris, I'm perfectly happy to toss the whole dtml mess overboard because it's so awkward. The only reason I went toward using this ridiculous querystring is that a test case worked with literals and '.' instead of '/'. I'd much rather pass tree-item-url, which has the slashes in the first place. I appreciate the ZPT solution but the whole idea is to have a single method at the top of the tree and manage the objects down in the leaves from there. I have about 20 folders two levels down the tree and I'm sure the customer will want subfolders below that eventually. Meanwhile, have a little patience with us newbies--you can't memorize the manual in a day. And the manual could certainly use some improvement, to wit, if dtml is frowned upon, put ZPT first and clearly mention that it is the preferred approach and should be learned first. Even my Python guru down the hall finds some parts of Zope less than transparent. You shouldn't have to read source code in the .py files to get things done. Karl -----Original Message----- From: Chris Withers [mailto:lists@simplistix.co.uk] Sent: Thursday, March 25, 2004 2:53 AM To: Horak, Karl Cc: 'zope(a)zope.org' Subject: Re: [Zope] Programmatically deleting objects Horak, Karl wrote: > I've given up on using the ZMI's system of checkboxes named with object ids > and calling the manage_delObjects:method from a submit button. Instead I'm > now simply generating a URL that passes a querystring with the path to the > item and the item name: > > <A HREF="goDelete?item=<dtml-var id>&delPath=<dtml-var > expr="aq_parent.aq_parent.id">.<dtml-var expr="aq_parent.id">"> That is truly horrible :-( > Thus, I have two variables, delPath = 'ORDlibrary.BC' (or whichever > subfolder) is the container of the item to be deleted, item = > 'filename.ext', which is the object's id. > > The goDelete method is some variation on: > > <dtml-call expr="REQUEST.delPath.manage_delObjects([REQUEST.item])"> > (This generates an AttributeError stating 'str' object has no attribute > 'manage_delObjects') > > Or: > > <dtml-call > expr="_.getitem(REQUEST.delPath).manage_delObjects([REQUEST.item])"> > (This generates a KeyError with an Error Value of 'ORDlibrary.BC') > > The odd thing is that using explicit strings as you pointed out in your > suggestion works fine: > <dtml-call expr="ORDlibrary.BC.manage_delObjects([REQUEST.item])"> Urm, you need to learn some python... If you really insist on persuing this insane course, your code would need to be: <dtml-call expr="restrictedTraverse(REQUEST.delPath.replace('.','/')).manage_delObjects ([REQUEST.item])"> God, I feel soiled just typing that :-( > Why are literals working but not variables with string values? Because _.getitem is not restrictedTraverse, it just behaves like a simple python mapping. And even if it was restrictedTraverse, you have .'s where you need /'s. > This repeatedly asks for user ID and password Hit cancel. Check out the error message. Maybe try VerboseSecurity. > value set to Manager). This is the equivalent of the "spinning Zope" in my > initial message. Zope is NOT spinning here! > That said, I find that calls to SquishDot management functions and Zope > manage_editProperties work on my testbed but not when they are moved onto > the firewalled system. Eh? Right, here's a solution in ZPT. Put a ZPT in your ORDLibrary.BC folder called index_html: <html> <body> <form action="manage_delObjects"> <table> <tr tal:repeat="id here/objectIds"> <td> <input type="checkbox" name="ids:list" tal:attributes="value id"> </td> <td tal:contents="id"/> </tr> </table> <input type="submit"> </body> </html> Any problems? I suggest you really read the online Zope book :-S Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

2 1

Re: [Zope] Thread in Zope 2.6.2
by Chris Withers 26 Mar '04

26 Mar '04

(please keep replies on the list) Florian Reiser wrote: > Yeah, I read it, > > but I don't want to set up ZEO, because it would be overkill. ZEO should be standard, it's certainly not overkill ;-) > I already have a working thread solution. But when I try > to write some status information in the session object, > then the error appears. Doesn't sound like it's working to me... Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

request of help
by Horacio Brizuela 26 Mar '04

26 Mar '04

Dear Webmaster i need help to install Zope and then OpenFlow on an XP platform I followed the insstruction but it does not work. Please could you kindly provide me with some suggestions? Thanks in advance, H Brizuela

2 1

Make DTML output XML (* with element named <title>)
by John Toews 26 Mar '04

26 Mar '04

Hi, Apologies for not RTFM enough... How can I make a DTML output XML with a <title> tag (attempting to output RSS)? It seems to break the document? Thanks!

2 1

StructuredDocument editing via web form
by John Schinnerer 26 Mar '04

26 Mar '04

Hello, I am hoping to use Maik Jablonski's StructuredDocument product to allow a client to edit structured text content portions of pages of their web site. I want my client to be able to use a simple web form to edit their content, and keep them out of the ZMI. I call a simple zpt web form on the StructuredDocument I want to edit. Current content of the StructuredDocument is displayed in an editable textarea and I can make whatever changes I want. What I am stuck on is getting the submission of the form to update the content of the StructuredDocument it is called on. I have just tried to do this with a Python script, the key line being: context.content = request.stx_content ...where stx_content is the name of the editable textarea in the form. I get this error: "attribute-less object (assign or del)" >From what I can find in list archives on this error, it sounds like maybe it's not possible to do what I want in a python script (due to script security restrictions I assume). Or, I'm referencing the content of the StructuredDocument object incorrectly. Or both... :-p If I'm referencing wrong, what is correct? If python scripts aren't allowed to do this type of assignment, how can I go about it as simply as possible? thanks, John S. __________________________________ Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time. http://taxes.yahoo.com/filing.html

2 3

cookie Crumbler problem
by Joshua Newman 25 Mar '04

25 Mar '04

I have a daily schedule on my site that uses properties to store the events. A form passes the variables to a python script which changes the properties of the page. Things work perfectly when I'm already logged in as a manager. I can set and reset property items. But when I enter my site as anonymous and try to do a manager function I get redirected to the cookie crumbler's authentication page. (good so far) When I get past authentication I get to the python script with an error that says: Error Type: KeyError Error Value: 'prop' But with a url like: http://mysite.com/dailySchedule/editCalendarProperty?prop=2004%2F03%2F25&pr… When I don't try to change the properties from the python script I can see and print the variables (prop and propval) perfectly. But it is as if the manageAddProperties('prop', prop) wrecks access to the variables. I've tried looping through the has_items() but the managing lines in the script still can't see the variables. I've tried passing all the variables in the header to the login page as hidden variables, but that fails too. Please help. Joshua

2 2

A(z) BSD listára küldött leveled szerkesztői engedélyére vár
by bsd-bounces＠hu.freebsd.org 25 Mar '04

25 Mar '04

A(z) 'BSD' listára küldött alábbi tárgyú leveled Re: Proof of concept a szerkesztő jóváhagyásáig nem kerül megjelenésre. Az ok amiért jóvá kell hagyni: SpamAssassin identified this message as possible spam (score 6.5) A levél vagy megjelenik a listán, vagy a szerkesztő elutasító döntéséről külön levélben értesítést kapsz. Ha mégsem szeretnéd, hogy a levél megjelenjen, akkor látogass el a következő címre: http://www.hu.freebsd.org/hu/mailman/confirm/bsd/75d2cdd905d5ae4ba428e19bf3…

1 0