Subject: Re: [Zope-dev] Zope components and revision control with cvs
From: Mehran erfani <[email-masked]>
To: Dieter Maurer <[email-masked]>, Shane Hathaway <[email-masked]>
Date: Mon, 5 Aug 2002 19:48:07 -0700 (PDT)

Hi Guys,
I would appreciate it if any of you can give me
his/her opinion on the following.....
First I am a rookie! then --->
Here is the scenario :

   I am trying to have a login/logout page for my
site. What I did, is : I created a page that anyone
can access. then they enter their user name and
password. I verify that with my Database and then....
I set a variable in session to ok, just like a flag.
Here is the page that goes to backend DB:

 <dtml-if "CheckPassWithDB(password)>
   <dtml-call "REQUEST.SESSION.set('myflag', 'ok')">
   <dtml-call "RESPONSE.redirect('somepage')">

 <dtml-else>
   Incorrect password, accsess denied!!!
 </dtml-if>

Now each time this user wants to access any of my
pages I check that variable, if it is set to ok....I
give them access to that page, if not....I send them
to a page that says they are not allowed to access the
page. 
So every opage in my site has at the top :

<dtml-with "SESSION.getSessionData()">
 <dtml-let x="get('myflag')" >

 <dtml-if "x=='ok'">
   run the page.
 <dtml-else>
   Access denied!!!
 </dtml-if>

This way I tried to bypass the usual pop up box of
zope and authenticate users with my backend database.
Does this sound to you as a correct way of doing
things? Security wise....do you see any problem with
this.

I know this is very primitive, but this is only thing
I knew. What do you think, am I totaly off?

I thank you and appreciate your help.
I hope I can be of assistance someday.

Mehran

--- Dieter Maurer <[email-masked]> wrote:
> Shane Hathaway writes:
>  > It's really only a theoretical problem.  To store
> the extra data about
>  > folderish objects, you can save the data in a
> hidden file called, for
>  > example, ".properties".  The theoretical problem
> is that someone might
>  > give an object that name, since it's perfectly
> legal.  In practice, you
>  > can just prevent people from creating Zope
> objects with a name that starts
>  > with a dot.  99% of the users won't mind at all,
> and those that do can
>  > use two dots instead. :-)
> The real problem (in my view) are ObjectManagers
> that are contained
> in Non-Object-Managers. Furthermore,
> splitting/folding ObjectManagers
> in the sense that you start/stop managing the
> individual content.
> 
> 
> Dieter
> 
> _______________________________________________
> Zope-Dev maillist  -  [email-masked]
> http://lists.zope.org/mailman/listinfo/zope-dev
> **  No cross posts or HTML encoding!  **
> (Related lists - 
> 
> http://lists.zope.org/mailman/listinfo/zope-announce
>  http://lists.zope.org/mailman/listinfo/zope )

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com