[Zope-dev] protocol accesibility

[Chris Withers]

Toby Dickenson wrote:
> 
> > That's not been my experience, but maybe that How-To would help :-)
> > Care to write it? ;-)
> 
> It is on my todo list

cool :-)

> > Protocol independence is not necessarily a good thing in this case.
> > Different protocols have different capabilities.
> 
> The zope way of modelling different capabilities is through roles. The right
> way to achieve this is to allocate different roles based on protocol.

how do you do that? (refs to how-to's, docs, etc all good, just that I
never knew you could do that :-)

> You could do this today using LoginManager, which allows for roles to be
> *computed* during authentication. Give your users different roles depending
> on whether they use http or https. (

or ftp?

> Indeed, I would be keen to see this
> feature in the standard user folder)

Maybe that's what I should haev said in my proposal ;-)

> Note that protocol is not a key factor here: you might also trust them more
> if the socket connection comes from localhost.

very true

> > http://www.zope.org/standard_html_header
> 
> Can you explain *why* this is a problem? While I agree it's untidy, its only
> an untidyness seen by people who go looking for it.

Some people (or am I the only one ;-) don't really find that acceptable.
The paranoid part of me also wants to know that it isn't possible to
find this, as it should only be used by other stuff inside zope, why
should stuff outside of zope get to play with it?

> > http://www.cbsnewyork.com/objectIds are left hanging out.
> 
> I propose securing the 'access contents information' permission, and you
> havent explained why this is flawed.

Securing the permission? perhaps you could explain that a bit more :-S

> > http://www.cbsnewyork.com/rubbish ain't none too nice either, likewise
> 
> That document has since been removed. 

Nope, that's the point, it give a yucking Zope Error which lowers user
confidence, rather than saying 'that page wasn't found, perhaps you'd
like to look here or here', but, to be fair, that's because whoever
built that site didn't bother to make standard_error_message useful
(don't get me started on tacking tracebacks on the end of html generated
by that page ;-)

> > http://www.cbsnewyork.com/manage...
> 
> I get an authentication dialog.... so?

Hit cancel. Again, a yucky Zope error rather than saying 'sorry, your
username or password were wrong', or, in reference to this thread, not
actually being _visible_ to this protocol at all. eg: should raise a
404, as standard_html_header should ;-)

cheers,

Chris