Re: [Zope] is it possible to import from Excel

2000-12-28 Thread Cary O'Brien


For whatever it is worth, I do imports from an excel
spreadsheet to a PostgreSQL table using Applixware.
I do it by hand (cut from spreadsheet, paste into
data query), but it could probably be automated.

So if you then had Zope and one of the two PostgreSQL
DA's you could get the data.

Drop me a line if you want the gory details.

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] ZDiscussions for Zope 2.2.2

2000-10-19 Thread Cary O'Brien


Sorry about being such a winer yesterday.  

I needed a confera bulletin board for work (internal) with
attachments, so I hacked ZDiscussions to work with Zope2.2.2.

I needed to:

1) Get FileObject.py from Confera
2) add __allow_access_to_unprotected_subobjects__  in
   a few places.
3) Fix a check for "Cancel"
4) fix the size of __ac_permissions__

I uploaded it to www.zope.org (never done that before, it is
pretty nice!).  I left the RCS files in place in case anyone
wants to critique my um-er work.

http://www.zope.org/Members/cobrien/ZDiscussions_zope22

You may be happier with ZUBB or Squishdot.

-- cary









___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] How about removing broken things like Confera and ZDiscussions?

2000-10-18 Thread Cary O'Brien

> There is a ZDiscussions that works. It is called ZUBB.
> 

But it doesn't do attachments.  I really need attachments.
I'm trying to fix Attachments in ZDConfera, but the FileObject
class doesn't seem to exist any more.

Arrg.

-- cary


> http://www.zope.org/Members/BwanaZulia/ZUBB
> 
> But, I agree, old product that have been left behind (the old version of
> ZDiscussions/Confera) should be marked and or archived.
> 
> J
> 
> > From: "Cary O'Brien" <[EMAIL PROTECTED]>
> > Date: Wed, 18 Oct 2000 09:36:13 -0400 (EDT)
> > To: [EMAIL PROTECTED]
> > Subject: [Zope] How about removing broken things like Confera and
> > ZDiscussions?
> > 
> > 
> > Why are things like ZDiscussions and Confera even on the
> > zope download pages?  They don't work!  It would be better
> > if they were moved to a section called "Things that worked
> > once but aren't being maintained so they don't work
> > any more".  Otherwise people starting out might see all
> > these seemingly useful things and get frustrated when
> > they dont work.
> > 
> > Arrrggg.   I just want a bulletin board that works!
> > 
> > I know what you are going to say, so I'll start digging
> > through the python code before you yell at me...
> > 
> > -- cary
> > 
> > 
> > ___
> > Zope maillist  -  [EMAIL PROTECTED]
> > http://lists.zope.org/mailman/listinfo/zope
> > **   No cross posts or HTML encoding!  **
> > (Related lists - 
> > http://lists.zope.org/mailman/listinfo/zope-announce
> > http://lists.zope.org/mailman/listinfo/zope-dev )
> > 
> > 
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] How about removing broken things like Confera and ZDiscussions?

2000-10-18 Thread Cary O'Brien

> 
> 
>There is a ZDiscussions that works. It is called ZUBB.
> 
>http://www.zope.org/Members/BwanaZulia/ZUBB
> 
>But, I agree, old product that have been left behind (the old version of
>ZDiscussions/Confera) should be marked and or archived.
> 
>J
> 
>  
> 
> Might be better to have a more formal declaration of the dependencies
> on versions of products relied upon at the download pages -- for some
> products this has become a tricky and madning process to make sure all
> the versions are correct for a product to run. This is natural in the
> progress of Zope and Zope products and will become even more and issue
> as Zope matures even further. This can be formalized. I do like the
> way SGI does some of this.
> 

Bangs head.  Doh!

Why the heck don't products have explicit requirements the "package require n.m" 
in TCL. Heck, python ought to.

Import Fred(1.2) from Bedrock

Or something like that.

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] How about removing broken things like Confera and ZDiscussions?

2000-10-18 Thread Cary O'Brien


Why are things like ZDiscussions and Confera even on the
zope download pages?  They don't work!  It would be better
if they were moved to a section called "Things that worked
once but aren't being maintained so they don't work
any more".  Otherwise people starting out might see all
these seemingly useful things and get frustrated when
they dont work.

Arrrggg.   I just want a bulletin board that works!

I know what you are going to say, so I'll start digging
through the python code before you yell at me...

-- cary


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Generic Workflow Products?

2000-08-23 Thread Cary O'Brien


After applying Zope to a couple of in-house projects
(which turned out pretty well, thank you),  I've started
to come to the realization that many applications boil
down to workflow management.  A job comes in, attributes
get set, things get attached to it, and it gets passed
from person to person (to machine, in some cases)
as it flows through the system.

I guess to start out it would need the following:

-- user classes
-- job creation
-- job attributes, with protection from view and modification
   depending on user classes
-- multiple job queues, with access control, and some sort
   of priority.  Queues may end up being implemented simply
   by having a job state, sequence number, and priority, and
   moving from one queue to another would just be changing
   the state.
-- job timeouts for escalation, 
-- e-mail "ticklers" and notification
-- job routing based on attributes and actions.
-- some sort of api other then HTTP/HTML for external
   programs to access jobs, perform actions, and update
   jobs.
-- Extra Credit:  Graphical workflow editor.
-- (what else am I missing)

Sounds like a job for Zope, doesn't it.  Basically I've
implemented a couple of systems like this, either
classic database-driven or z-class driven.  But I'm tired
of re-inventing the wheel.  It would be nicer if systems
like this could be implemented at the "workflow logic" 
level rather than the Zclass level.  IE a set of ZClasses
or Product classes that implemented workflow systems.

Is there such a thing? Has anyone worked on such a thing?  
Any ideas how to implement such a thing?

I've got a couple of modifications to an existing system
coming up, which sounds like just the excuse I need
for a total rewrite :)

-- cary









___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Hardware minimum for development

2000-08-08 Thread Cary O'Brien

> Hallo,
> what's the minimum of hardware to develop Zope-sites(only for
> development).
> I'd like to know because I want to buy a laptop and don't want to spend
> much money !
> Thanks.
> 

I use an old toshiba 325 cds (cd broken) (460 bogomips) w/ 48Mb of ram
running Linux as both my desktop and portable machine for all sorts of
development (Including Zope).  Works fine as a desktop machine.  Kind
of a pain to plug/unplug the cables all the time.  I can run a couple
of zopes, pgsql, heck I even had Oracle on it for a while.  You might
need a bit more oomph for java development.

The problem with the laptop is probably not the CPU/ram (well, get
64MB ram if you can) but the screen resolution and the pointer.  Zope
at 600x800 is tight.  The little eraser-head pointer is a pain, and
Zope development tends to need a lot of mouse action.  I usually carry
along a mouse.  Even on the desktop (i.e with a monitor and keyboard
plugged in) I am limited to 1024x768 8-bit color with a bad refresh
rate.


-- cary


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] ZClass property that is a map

2000-08-07 Thread Cary O'Brien


I would like to add a property to an object that is a map, so I could
use map[s] to look things up symbolicaly.  Is there an easy way to do
this with property sheets?  If so, what is it?  If not, what is the
hard way.

Thanks,

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Starting Zope

2000-07-31 Thread Cary O'Brien

> I've done it this way:
> 
> http://www.zope.org/Members/otto/portfw
> 
> It's also relatively easy to convince a hosting provider to add this, as
> long as you have a dedicated IP address.
> 
> Perhaps I should have done a news item when I created this... seems a
> lot of people have hacked around the issue is all sorts of odd ways. :)
> 
>   -Otto.
> 

How can this work?  Won't Zope put a "base href=http://server:8080" tag 
into the head of the document and mess things up?  Won't you need
site-access to work around this?

-- cary 

> 
> Costagliola Giovanni wrote:
> > 
> > Hello All,
> > How can I to start Zope whit a different user than root and 
> > cath the default HTTP port?
> > 
> > If I try for example:
> > su - -c './start -w 80 -u zope'
> > 
> > I receive an error becouse root hasn't granted the need 
> > privileges on /Zope/var/ directory.
> > 
> > Thanx
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Starting Zope

2000-07-31 Thread Cary O'Brien

> 
> Interesting argument. However, consider this: if you completely trust your
> 'firewalled' box, then why not run the web server as root? One response,

Protection of the system from simple mistakes by trusted users?  Also
root can do a lot more, such as putting interfaces into promiscious
mode.  So the idea is to just lift the bind-to-low-ports check.

> in your case is the fact that you mention your trust on users(humans are
> the most easy to compromise, however that argument is a bit OT). However,
> do you trust all of your webserver code? Do you trust your cgi-bin
> scripts and applications? And by trust I not only mean harmful intent by
> the authors of software, but unintentional bugs which can be exploited,
> and will be given the privilege to bind to <1024 ports even when they run
> as a user with least privileges.
> 

My revised thinking is that the patch should only lift the restriction
for just the necessary ports.  

Another idea is to do it with groups, say let group n be a "net-privileged" group.


-- cary

> Just my opinion.
> 
> nitesh.
> 
> 
> On Sun, 30 Jul 2000, Cary O'Brien wrote:
> 
> > > Cary O'Brien wrote:
> > > 
> > > > Well...
> > > > 
> > > > If you are running on Linux you could simply edit the kernel code to
> > > > elimitate the check on being root to bind to low ports.  That's what
> > > > we did.
> > > 
> > > Which is an even worse idea.
> > > 
> > 
> > Why?  On a sufficiently firewalled off box, where the few logins are
> > completly trusted, what's the diff?  If you were worried about people
> > cracking a user account and getting underneath telnet, than limit the
> > lifting of the restriction to port 80.  If you are concerned that
> > non-root users could launch attacks from low ports at other machines,
> > assuming that only good guys can come from low ports is pretty naive.
> > 
> > The whole business about not letting anyone but root bind to low ports
> > makes sense for a public access machine where all the first year
> > engineering students have an account, but for a dedicated application
> > server it is kind of misdirected.  You ought to be running next to
> > nothing but the application, and you had better trust everyone that
> > you give a login to, and you out to have the thing locked
> > down/firewalled well.  So the tiny bit of possible protection may not
> > be worth the hassle/risks of writing your own suid-wrapper, or the
> > complexity of having a redirect and messing with site-access so that
> > the port numbers in the zope -- what it is that parameter -- base or
> > whatever, comes out write.
> > 
> > Just for fun - does NT have the same restriction?
> > 
> > -- cary
> > 
> > ___
> > Zope maillist  -  [EMAIL PROTECTED]
> > http://lists.zope.org/mailman/listinfo/zope
> > **   No cross posts or HTML encoding!  **
> > (Related lists - 
> >  http://lists.zope.org/mailman/listinfo/zope-announce
> >  http://lists.zope.org/mailman/listinfo/zope-dev )
> > 
> > 
> 
> 
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Starting Zope

2000-07-31 Thread Cary O'Brien

Bill wrote...

> 
> Of course, it is entirely possible the user meant something other than s/he wrote. 
>;) But
> that last one doesn't seem to indicate that.
> 
> To put it succinctly:
> If you want Zope to bind to port 80 on *nix
> you have few options:
> 
>  o Change Zope to run SID ** Bad Idea
>  o Modify the kernel so _anyone_
>can bind to ports under 1024 ** even worse
>  o START Zope as root, run it as a 
>non-priviledged user, preferably one without 
>a login.
> 

You could also run zope behind Apache. The Apache bits that handle
root permissions seem pretty well accepted.  This doesn't really run
Zope listening to port 80, but if you go to port 80 on the machine
running Apache, you get to zope.

One advantage is that you can bounce Zope all day long without even
touching root.  Plus depending on your setup you can have Apache
running on a separate machine.  This can be better depending on the
situation (i.e.  development machines behind a firewall with private
addresses.

The downside is that you need to become aquainted with the wonderful
worlds of mod-rewrite and site-access[1].  Plus you may take a
performance hit.

-- cary

[1] Can someone explain (or point me to the reason) why the  tag
is necessary?  It sure can make life difficult!


> File permissions are irrelevenat when binding to ports under 1024 on Unix.
> 
> 
> 
> 
> --
> Do not meddle in the affairs of sysadmins, for they are easy to annoy,
> and have the root password.
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Starting Zope

2000-07-30 Thread Cary O'Brien

> Cary O'Brien wrote:
> 
> > Well...
> > 
> > If you are running on Linux you could simply edit the kernel code to
> > elimitate the check on being root to bind to low ports.  That's what
> > we did.
> 
> Which is an even worse idea.
> 

Why?  On a sufficiently firewalled off box, where the few logins are
completly trusted, what's the diff?  If you were worried about people
cracking a user account and getting underneath telnet, than limit the
lifting of the restriction to port 80.  If you are concerned that
non-root users could launch attacks from low ports at other machines,
assuming that only good guys can come from low ports is pretty naive.

The whole business about not letting anyone but root bind to low ports
makes sense for a public access machine where all the first year
engineering students have an account, but for a dedicated application
server it is kind of misdirected.  You ought to be running next to
nothing but the application, and you had better trust everyone that
you give a login to, and you out to have the thing locked
down/firewalled well.  So the tiny bit of possible protection may not
be worth the hassle/risks of writing your own suid-wrapper, or the
complexity of having a redirect and messing with site-access so that
the port numbers in the zope -- what it is that parameter -- base or
whatever, comes out write.

Just for fun - does NT have the same restriction?

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Zope for secure transactions?

2000-07-29 Thread Cary O'Brien

> > 1. Can Zope support SSL or https?
> 
> AFAIK without support of some other tool not.
> 

If you have money ($12,000 us), but not programmers/time you can buy
a box to do this from Intel.  Plus it is very fast.

http://www.intel.com/netstructure/products/accel_7110.htm

(Not an Intel employee, but they did serve me a very nice
Breakfast while telling me about their products).

Or you could put Zope behind Apache-stronghold.

-- cary

> > 2. Is there some way in Zope through which i can use secure transactions.
> 
> I suspect that yes, although I have not done it. You should be able to
> use Apache-SSL as frontend to Zope (employing ProxyPass). There is also
> another method, which can work and even be simpler: stunnel (generic SSL
> encryption wrapper). I have not run it with zope but I saw it running
> perfectly as frontend to POP3/IMAP mail server.
> 
> 
> --
> Marcin.Kasperski | A reusable framework that is developed by itself will
>   @softax.com.pl | probably not be very reusable. (Martin)  
> Marcin.Kasperski |  
> @bigfoot.com |
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Starting Zope

2000-07-29 Thread Cary O'Brien

> Costagliola Giovanni wrote:
> > 
> > Il gio, 27 lug 2000, Oleg Broytmann ha scritto:
> > > On Thu, 27 Jul 2000, Costagliola Giovanni wrote:
> > > > How can I to start Zope whit a different user than root and cath the
> > > > default HTTP port?
> > >
> > >Use different way - start Zope as root, catch port 80 and drop uid.
> > >
> > > > I receive an error becouse root hasn't granted the need privileges on
> > > > /Zope/var/ directory.
> > >
> > >This is a different error, not a problem with port 80, ah?
> > >
> > I see Oleg, more exactly I would start ZServer with an user like 'zope', for
> > example, but at the same time I want it links the port 80!
> > 
> > I could use the root user simply but I'll lose my sleep :^)
> > 
> > Can you give me some input?
> 
> If you want to bind to ports <1024 you _must_ be root. ZXope can run as another user 
>(the
> -u  option), but it must be _started_ as root, if you want to bind to port 80.
> Period.
> 
> Sorry, there is no other way, short of making Sope SUID, which is a very, very, very,
> very, very, very bad idea.
> 

Well...

If you are running on Linux you could simply edit the kernel code to
elimitate the check on being root to bind to low ports.  That's what
we did. 

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Zope and Tuxedo? (fwd)

2000-07-27 Thread Cary O'Brien

- Forwarded message from Marcin Kasperski -

>From digest Thu Mar  9 07:50:32 EST 2000
Date: Thu, 27 Jul 2000 17:28:34 +0200
From: Marcin Kasperski <[EMAIL PROTECTED]>
To: Zope List Submission <[EMAIL PROTECTED]>
Subject: Re: [Zope] Zope and Tuxedo?

Marcin wrote...

> Cary O'Brien wrote:
> > 
> > Has anyone used Zope to act as a Tuxedo client?
> > 
> > Is anyone interested in doing this?
> > 
> > Mostly it means creating a python extension that acts as a Tuxedo
> > client, and then integrating that into Zope as a ZClass or Product or
> > something.
> > 
> 
> Writing python extension should not be hard, but Tuxedo used to have

I got partway through using SWIG for client wrappers, but I haven't
had time to actually run them yet.  Soon I hope.  The more interesting
part is to have a Tuxedo server that registers services and fires off
python code to execute the services.  You have to start a Python
interpreter and call it from C.  It seems fully documented, and not
too much more complicated than doing the same thing from TCL.

> problems in multithreaded environment. Check whether Tuxedo client works

You are right.  It did cause problems in a multi-threaded environment.
I'll refrain from recounting my HP/UX horror story here...

> in multithreaded program before further attempts (I do not know how does
> it look now, I used Tuxedo ~ 2 years ago).
> 

The current documentation says that the current version (7.1) is thread
safe.  I have yet to test this out.  Soon, I hope.

You can download a copy for Linux from www.bea.com if anyone is interested.

-- cary

> --
> Marcin.Kasperski | Most of the bad things that can happen to a project  
>   @softax.com.pl | are the result of miscommunication.  
> Marcin.Kasperski | (Booch,Martin,Newkirk)   
> @bigfoot.com |
> 
> --__--__--

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Zope and Tuxedo?

2000-07-27 Thread Cary O'Brien


Has anyone used Zope to act as a Tuxedo client?  

Is anyone interested in doing this?  

Mostly it means creating a python extension that acts as a Tuxedo
client, and then integrating that into Zope as a ZClass or Product or
something.

-- cary

Tuxedo is pretty slick.  You can download a trial
version if you want.

http://www.bea.com/products/tuxedo/index.html




___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Python/Tkinter & Zope

2000-07-26 Thread Cary O'Brien

> charset="US-ASCII"
> 
> Would it make any sense ? Such an application could only run on the server.
> Not exactly the idea of a web-enabled application ?! To use it on a client
> at least Python and TKinter should be installed on the client. This would
> only be feasable in a corporate environment, but then, why still use Zope ?
> I think I do not know what you want with the combination of GUI and Zope.
> 

Hmm.  There is jpython, which is a python interpreter written in java, which
I guess can access AWT/Swing classes.  So you could do the GUI that way.  I
don't think there is a tk in java. See www.jpython.org for more. 

There is or was? also a TCL/TK plug-in.  It seems dead now.  I don't know
what the heck is going on with Scriptics.  Ajuba?  Huh?

Or (on a roll now) you could use the X version of Python/TKinter and
remote the display using VNC, or one of the Java X servers.

-- cary

> Gijs
> 
> > -Oorspronkelijk bericht-
> > Van: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]Namens Tim Cook
> > Verzonden: woensdag 26 juli 2000 5:03
> > Aan: Zope List
> > Onderwerp: [Zope] Python/Tkinter & Zope
> >
> >
> > Has anyone used this combination for GUI inside a Zope app?
> >
> > -- Tim Cook --
> > FreePM Project Coordinator - http://www.freepm.org
> > OS Healthcare Alliance Supporter - http://www.oshca.org
> >
> > ___
> > Zope maillist  -  [EMAIL PROTECTED]
> > http://lists.zope.org/mailman/listinfo/zope
> > **   No cross posts or HTML encoding!  **
> > (Related lists -
> >  http://lists.zope.org/mailman/listinfo/zope-announce
> >  http://lists.zope.org/mailman/listinfo/zope-dev )
> >
> >
> 
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] cr/lf causing spaces

2000-07-10 Thread Cary O'Brien

> On Sun, 9 Jul 2000, Ben Leslie wrote:
> 
> > > One of my "favorite" issues with win/DOS has always been its use of CR+LF
> > > combinations. Why? Because all browsers interpret the thing as a SPACE.
> > 
> > AFAIK this is an HTML thing, not a win/DOS thing. The HTML spec treats any
> > whitespace as a space.
> 
> Well unix uses only cr by default, and browsers do not interpret that as a
> whitespace.
> 

I'm sure you meant to type 'uses only lf by default'.  The standard unix text separator
is the newline, 0x0A, often shown as \n.  Not cr, 0x0D, often shown as \r.

-- cary 

> > > Or is there already a way to avoid this?
> > I ran into the same problem (using Linux), and there isn't really anyway to
> > get around it, apart from having un-nicely formatted DTML source.
> 
> Maybe a problem with the way the textarea editor netscape etc work.
> 
> 
> 
> Nils
> 
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] passing keyword arguments to external methods

2000-07-07 Thread Cary O'Brien



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Which PostGreSQL DA should I use?

2000-07-07 Thread Cary O'Brien

> On Fri, 07 Jul 2000, Eric L. Walstad wrote:
> > OK, I am thinking about going from MySQL to PostgreSQL for its transactions
> > and subqueries.  I am curious which DA I should use and why.  I see that I
> > can choose from:
> > 
> > 1. SQLRelay
> > 2. ZPoPyDA
> > 3. ZPyGreSQLDA
> > 
> > Which are you using and why did you choose it over the others?
> > 
> i have been asking the same Q too.  i am current;y using ZPygreSQLDa, and have
> been from the start.  i think there's no more development done on this  DA (
> imight be wrong though).
> 

I wish there was.  For ZPyGreSQL, I would really like to see:

1) Thread-safe operation.  I.e., if desired, one database
   connection per thread.  Or better yet a pool of connections,
   allowing m threads, but n (n i wanted to try PoPy, but the last time i checked, i can't get the PoPy tar
> ball.  this is actively maintained, i think
> 
> SQLRelay, i have compiled and installed, but i can't figure out how to use it. 
> i cant start the listener without an error.( can't bind something).  and i'm
> not too sure how how the connect string looks like if i have a user with no
> password.  but i think this may be the best solution, since we can specify the
> connection pool, and have a cache for results too.
> 

Interesting.  Gotta look into this.

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Database Adaptors and security and query()

2000-07-05 Thread Cary O'Brien


Couple of things came up trying to use the current PostgreSQL da
and zope 2.2b3.  I am working on a ZClass that lets you define
and create tables in a database, so I needed to execute some
generated sql [1].  

1) I couldn't access the query() method of the connection unless
   I added our friend

   __allow_access_to_unprotected_subobjects__=1
 
  to the DB class defined in ZPyGreSQLDA/db.py

   Is this ok?

2) Re calling query().  The query method only returns a tuple used
   to create a Results object (which dtml-in would like).  So I
   added a method to return a real live Results object 

   def query_result(self,query_string, max_rows=999):
return Results(self.query(query_string, max_rows))

   Which does what I want.  Is this ok?  Is this a good idea?

3) I went down several wrong paths until I realized that it seems
   as if dtml-methods can't return anything but strings.  Is this
   right?


4) Grumble.  I had a lot of trouble with the interaction between
   Results returning data as tuples, and dtml-in handling tuples
   of 2 differently than everything else.  Create a table with
   3 columns, everything works.  Create a table with two columns,
   things dont work.  Is there access to list() anywhere?

-- cary


[1] I know, I can hear you saying "Use ZSQLMethods" but 1) You can't subclass
them, and b) You can't put one inside a ZClass without a dummy
connection.

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Arrg! dtml-in can't handle lists of pairs!

2000-07-05 Thread Cary O'Brien

> "Cary O'Brien" <[EMAIL PROTECTED]> writes:
>  > It seems as if dtml-in handles lists of pairs specially. 
> It does, and it is documented.

Where?  I even looked through the code in DT_In.py and couldn't
figure out where it handled this special case.  This seems
to me like a pretty big gotcha.

I did find out that a list of two items was not handled
the same way as a tuple of two items.  Unfortunately
I couldn't figure out how to invoke list().

> 
> For pairs, the first component becomes "sequence-key" and
> the second "sequence-item".
> 
>  > Not a good thing.  Can I supress this behavior?
> Not that I know.

Well, the only solution I came up with was to iterate
with an index over the size of the thing.

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Arrg! dtml-in can't handle lists of pairs!

2000-07-01 Thread Cary O'Brien


Ok.  I get a list of rows from a database query.  I want
to iterate over the rows.  If there are 3 or more
columns in the table, everythin is fine.  If there are 2 
columns, it doesn't work.

It seems as if dtml-in handles lists of pairs specially. 
Not a good thing.  Can I supress this behavior?

Here is an example of this:

---

Iterate over 3.tuples

   
  
  
 > 
  
   

Iterate Over 2-tuples

   
  
  
  
 > 
  
  
Why can't I do this!
 
   

Iterate Over 1-tuples

   
  
  
 > 
  
   


---

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Why can't I subclass a ZSQLMethod?

2000-06-30 Thread Cary O'Brien


I tried that.  You can't add a ZSQLMethod unless there is a connection
for it to connect to.  There isn't a connection in the products area.

Actually

If I put a dummy gadfly connection in the Product folder, I can
indeed add a zsql method to my ZClass.  However I can't get a
view to it.  I can configure it as a view, but it doesn't show
up in the management tabs.

I guess it may be possible to leave it invisible and use
other methods to set the query, arguments, and database
connection.  More digging through the .py files!

-- cary

> 
> Why don't you create a ZClass and make the ZSQLMethod to be one of its
> methods? Then the ZClass can provide the user interface to the SQL
> query and the result set.
> 
> Regards,
> Ivan Raikov
> 
> "Cary O'Brien" <[EMAIL PROTECTED]> writes:
> 
> > I want to wrap a presentation layer around ZSQLQueries, so that
> > they will have methods to generate an input form [1] for the query,
> > and generate tabular results if so desired.
> > 
> > I tried to create a ZClass to do this, but I can't subclass from a
> > ZSQLMethod.
> > 
> > Any other ideas on how to do this (besides a class where you have
> > to tell it the ZSQLMethod to use)?
> > 
> > -- cary
> > 
> > [1] Using sql.arguments_str to find out the arguments.  Finding THAT was
> > a struggle!  
> > 
> > 
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Why can't I subclass a ZSQLMethod?

2000-06-30 Thread Cary O'Brien


I want to wrap a presentation layer around ZSQLQueries, so that
they will have methods to generate an input form [1] for the query,
and generate tabular results if so desired.

I tried to create a ZClass to do this, but I can't subclass from a
ZSQLMethod.

Any other ideas on how to do this (besides a class where you have
to tell it the ZSQLMethod to use)?

-- cary

[1] Using sql.arguments_str to find out the arguments.  Finding THAT was
a struggle!  


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Zope 2.2.0b3: can't call db_connection.query()

2000-06-30 Thread Cary O'Brien


With Zope 2.2.0b3, I can't seem to call the query() method
of a database connection any more.

For example, with a PostgreSQL connection called dbconn, calling





Works fine with 2.1.6, but with 2.2.0b3, I get...


Zope Error

Zope has encountered an error while publishing this resource. 

Unauthorized
...

 File /usr2/local/zope/Zope-2.2.0b3-src/lib/python/DocumentTemplate/DT_With.py, line 
146, in render
  (Object: dbconn)
 File /usr2/local/zope/Zope-2.2.0b3-src/lib/python/DocumentTemplate/DT_Util.py, line 
327, in eval
 (Object: query('select count(*) from pg_class'))
 (Info: query)
 File /usr2/local/zope/Zope-2.2.0b3-src/lib/python/OFS/DTMLMethod.py, line 189, in 
validate
 (Object: test1)
 File /usr2/local/zope/Zope-2.2.0b3-src/lib/python/AccessControl/SecurityManager.py, 
line 139, in validate
 File 
/usr2/local/zope/Zope-2.2.0b3-src/lib/python/AccessControl/ZopeSecurityPolicy.py, line 
158, in validate
  Unauthorized: query

Any ideas?

There doesn't seem to be any permission to set.

What I would like to do is add some functions to the PostgreSQL DA
so I can view table names and column names.

-- cary


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] dhtml-try broken in 2.2.0b3?

2000-06-29 Thread Cary O'Brien


I was porting some stuff that had a dtml-try to
the newest Zope (2.2.0b3) and I had problems
with a dtml-try block.

I tried a fresh install and had the same problem.

To reproduce, create a DHTML method with


  

  It blew up


Accessing the document errors out with...

  Zope Error

  Zope has encountered an error while publishing this resource. 

  Error Type: TypeError
  Error Value: unexpected keyword argument: error_type

[Snip]

  File /usr2/zope2/Zope-2.2.0b3-src/lib/python/DocumentTemplate/DT_Try.py, line 212, 
in render
  File /usr2/zope2/Zope-2.2.0b3-src/lib/python/DocumentTemplate/DT_Try.py, line 244, 
in render_try_except
  File /usr2/zope2/Zope-2.2.0b3-src/lib/python/DocumentTemplate/DT_Util.py, line 262, 
in namespace
TypeError: (see above)

So I'm back to 2.1.6.  Arrg.

Any ideas?

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] newbie changingover to zope from html/cgi??

2000-06-18 Thread Cary O'Brien

> can i replace javascript with python/DTML. I have used drop down menus in
> the pages using javascript. Is these available in Zope or is there some
> way of using these.

I'd keep the drop-down menus in javascript.  You can do similar things
in zope (i.e. the tree tag or the tab bar at the top of the management
interface), but then every change is a fetch back to the web server.
If you keep the javascript then it all happens at the client.

If you want you can generate the javascript with dhtml.  That way
the contents of the menus can follow your site.  You'd have to set the
comtent type so that the browser thinks it is javascript. (hmm, how
is javascript cached??)


-- cary

[snip]

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] ZODB or not ZODB?

2000-06-18 Thread Cary O'Brien

> charset="iso-8859-1"
> 
> I am implementing a document Library using Zope. It has an exhaustive index
> with several thousand topics in an outline residing on a PostgreSQL
> database. This works well and I like it.
> 
> My question is where is the best place to store the documents themselves?
> They will be static HTML documents ranging from 1-50Kb in size roughly.
> There will probably be at least 10,000-15,000 of these documents in the
> library once all is said and done.
> 
> In my mind I have three options:
> 
> 1. Store them on the filesystem.
> 2. Store them in a PgSQL table as blobs.
> 3. Store them as DTML Docs in the ZODB.
> 

The filesystem, imho.  This lets you spread things out over
multiple disks and even (perhaps) multiple systems.  Worst case
you've got 50k x 15k = 750M.  Big for a ZODB (?), but no sweat
for a file system.  PgSQL blobs are not yet ready for prime time.
For one thing, I think they are all created in the same directory.
And I'm a big PgSQL fan, so this pains me to say, but it is true.
They are working on it.  See the TOAST project in the postgresql
mailing lists.

You want to spread the documents out over a couple of directories.
I've set up systems where everything had an ID and we'd split things
up via digits in the id.  I.e. document 252a8b7c is file 25/2a/7b/25218b7c.

You could even compress the files if you wanted to.

And you could use the "LocalFileSystem" (is that it?) product to
serve up the files through Zope.  You could tweak it to decompress
too.

> I would like to eventually have full text searching capabilities, so that
> makes #1 less attractive (I would likely need my own Python method to do
> it). #2 is somewhat of a pain to implement due to limitations in the PgSQL
> row size and text searching would be slow. With #3 I could in theory use a
> ZCatalog to implement the searching, so that is done for me.
> 

I'd put the full text search into PostgreSQL.  When the doc comes in,
strip out the keywords and index it.

> Is ZODB up to the task of storing this quantity of objects? What problems
> might I run into? Is it a wise idea, could a data.fs file of this size
> (~3-400MB) become too easily corrupted? Should I use a separate data.fs file
> just to store the documents (ie using mountedFileStorage)? Or is it better
> to use method #1 or #2? Information from anyone with experience in this
> regard is greatly appreciated.
> 

We implemented a system using #1.  Actually, we had lots of little documents
so we concatted and gziped them in batches of 200, keeping the filename, offset,
and length.  Turns out it was quick enought to unzip the file and pick out
the document of interest.  And batching them up kept the compression ratio
up.

System worked great, but was cancelled about a week before it was going
to go online.  ouch.

I'll let others speak to 3.  I've never had a problem with ZODB, but I've
never put 750MB in it.

-- cary



> -Casey Duncan
> [EMAIL PROTECTED]
> 
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Python class browser

2000-06-17 Thread Cary O'Brien


I'm tired of digging through .py files to find what methods
a class supports.

Has anyone put together a class browser ZClass w/ external
methods that allows you to look at modules, classes, methods,
and method arguments via the browser?  It *seems* as if 
python supplies all the pieces (i.e. start with sys.modules
and use the pyclbr stuff from there).

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Images not showing

2000-06-14 Thread Cary O'Brien

Dieter wrote...

> [EMAIL PROTECTED] writes:
>  > I've noticed that when i install images into the Zope database and call
>  > them sometimes they display as broken link images instead of the picture.
>  > after revisiting the image in the management screen but not making any
>  > changes just resaving it they work again.
>  > 
>  > Anyone have any ideas what I might bedoing wrong or if this is a bug?
>  > 
>  > I'm running Zope 2.16 on WinNT(unfortunately) 4.0

I see this too.

> Try to view the image alone.
> Netscape has a menu item "view image" in the context menu for
> images. Alternatively, you can directly open the image's URL.
> 
> Opening the image alone gives you more information about
> the problem: you prabably will get a standard Zope error page
> with problem description and traceback.
> 
> Maybe, you encountered some of the image problems that
> have been discussed in Zope or Zope-dev about 2 weeks ago.
> 

Do you have any more detail, or a reference, or a subject I could use to look it up?

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Costs of implementation

2000-06-13 Thread Cary O'Brien

> I am trying to motivate the use of Zope / Zcommerce, and to do this need
> some timing ideas - Does anyone have thoughts on how long (man hours per
> expertise) it took them to go from no Zope to (Zope + Steve Spickelmire and
> Co's EMarket) and to a successful transaction?
> 
> Hopefully this will be of general interest for anyone doing a business case
> or planning, so if you have any thoughts on "we expected x by experienced y"
> it should make interesting reading.
> 

Zope has a sigmoidal[0] (is that the word?) learning curve.  Out of the box it
installs *very* nicely on unixen, and you can clickety-clickety around and
create folders [1], upload files, and set up a static web site pretty
easily.

Then you want to connect up a database.  My experience is limited to
PostgreSQL, but the sigmoidal shape repeated itself.  The database
adapter dropped in without a hitch, and simple queries worked great.
I implemented a reasonable database-backed problem tracking system for
our company last summer in about 2 weeks of fiddling around and 2
solid weeks of implementation (my sql/web skills are ok, my python
knowledge is um, a work in process).  And it has been operating
flawlessly for over a year.

But then comes the steep part.  Anytime you mix several languages
inside themselves, things are hard.  Productive as hell if you get
it write, but hard.  With Zope you've got to wrangle HTML, DTML,
Python (at least for expressions) and SQL if you're connected to
a database.  A misplaced quote, comma, or bracket can throw you
off for a long time.  Ok, we've got the source, but debugging 
Zope stack dumps can be a pain.

But after a while it gets better.  I *think* I'm starting to at least
see the shallow part of the learning curve at the top, where you can
do things like implement a ZClass container that acts like a Dynamic
HTML layer in an afternoon.  Which I did, but only after 3 very bad
false starts.

The base Zope documentation needs some work.  The HOWTOS and TIPS
have saved the day many, many times. 

But back to the business case.  My feeling is that even with the
steep bits of the learning curve, Zope is a big win for implementing
services.  Zope wins because if you do a good job getting things
working, you have an incredibly flex able system for dealing with
the inevitable never ending stream of change requests.  And thats
where the payoff is.  At list I *hope* so :)

-- cary

[0] S-shaped.  like this ( _/-).  shallow/steep/shallow.








___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] ZDiscussions in classes?

2000-06-09 Thread Cary O'Brien

> charset="iso-8859-1"
> 
> Hi,
> 
> I have a problem with getting ZDiscussion working the way I want it to.
> First a little background, so it becomes easier for me to explain what I
> want to do:
> 
> On my site I have several users (called "artists") that I have built a
> ZClass for. This Artist-ZClass contains a propertysheet with the properties
> of the artist, it also subclasses ObjectManager, so the artists can add
> their own pictures in their own object.
> 
> This works excellent, and I am about to take the next step - adding a
> discussion forum on each artist, so people can discuss the artist's work
> directly on his pages.
> 
> I then tried to add a ZDiscussion Topic ("discuss") in the ZClass. (I also
> regenerated the methods before proceeding, to get the default interface.)
> 
> When I tried to access the discussion at:
> 
> http://my.host/artists/testartist/discuss
> 
> Zope asks me for a login, and not even the superuser can access it.
> 
> Either my thinking is screwed up (it often is ;), or it is impossible to
> accomplish this with ZDiscussions. Could anyone offer me some insight as to
> what I'm doing wrong here?
> 

Do you have anonymous access turned off? (I.E. do you need a password
to view anything?)  If you cancel the request, do you get a traceback
pointing to something in the TreeTag file? If so, you may need to
allow anonymous users to access content information for the
discussions.

I don't understand why this should be the case, and I couldn't
debug it because I couldn't figure out what validate did.

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Re: [ZCommerce] Secure storage of credit card info

2000-06-09 Thread Cary O'Brien

> -> > You have a ZCommerce site.  You accept credit cards, and securely
> -> > communicate with a CC processor to verify the transacton.  Now,
> 
>   Besides Bill's suggestion, keep all your servers behind a good
> firewall.  One option is to use Linux IP Masquerading, having your
> webserver *and* database server use 192.168.0.??? IP Addresses.  Then,
> turn on port forwarding on your Masq server, so that all incoming requests
> on port 80 go to (something like) port 8080 on your webserver, which then
> responds to the request.
> 
>   You could just use an encrypted filesystem on the database server,
> although that may be too slow (and possibly overkill?).  At that point
> --assuming your firewall is secured-- you'd more or less need physical
> access to your internal network to see those CC#s.  The only real danger
> left is a misconfiguration (or bad code) in your webserver software.
> (read: don't use IIS :)
> 

I would work from the assumption that, worst case, your web server
machines may get rooted, either from external attacks or from internal
"human engineering".  And that people can modify your software and
install sniffers. [1] Especially if you have a lot of people modifying
content on that machine.

That's why you get the best protection with a separate machine,
firewalled off, with limited access, plus Public key encryption.

If you get rooted and you don't know about, you've lost the game.  If
you get rooted and you find out, you've only lost those CC numbers
that were processed while you were compromised.

My 2 cents.

I'd be interested to hear alternate viewpoints.

-- cary (who worries alot)

[1] Which is why switches (rather than dumb hubs) are nice.

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Secure storage of credit card info

2000-06-09 Thread Cary O'Brien

> OK, any of you out there who have thought about ecommerce, cryptography,
> and zope, I've got a design question for you.  Actually, this question
> is independent of zope, but I need to solve it in a zope context.
> 
> You have a ZCommerce site.  You accept credit cards, and securely
> communicate with a CC processor to verify the transacton.  Now,
> you want to save the CC# and other info in case something needs
> to be done with it later, and probably store the CC# so this
> customer doesn't have to type it in again later.  Regardless
> of whether you are storing this info in a relational database
> or in the ZODB, how do you secure that information?  Ideally
> I'd like it to be encrypted on disk.  Now, storing it in a database
> probably makes it pretty hard to grep out even if a hacker
> manages to snarf the database file, but I'd like to encrypt it.
> But if I encrypt it, I have to have a decryption key somewhere.
> Where do I store the decryption key so that the cracker who
> snarfs the database file can't get it (just in memory somewhere?),
> and yet have the system be able to boot itself, including having
> the key, without human intervention?  It seems to me like
> this is a Hard Problem, but I'm not up on the current
> cyrptography practice.  So if there is a well known general
> solution, I'd love to hear about it.  Otherwise, does anyone
> know what current Best Practice is?
> 

Good question.  I was just talking to someone about this a few
days back.  What they did was to

a) create a public/private keypair.  Don't
   leave the private key ANYWHERE except on
   the CC verification machine (described below)

b) encrypt the data using the public key

c) store the encrypted data

d) ship the encrypted cc information through
   an internal firewall[1] with one hole to a 
   CC verification back end.  This back end
   is protected as much as possible, accessible
   by as few people as possible.  It uses the
   private key to decrypt and verify.  

You are still vulnerable if someone can get in and snarf
the CC information during b), but at least you don't have
thousands of CC numbers hanging around on your frontend
or database machines.  The idea is that the CC verification
machine is much less likely to be compromised.

Best practice?  I don't know.  But it sounded like a good
idea to me.

Hope I got this right. (Hi Ramon!)

-- cary

[1] Which also needs to have limited access.



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Problems uploading large attachments

2000-06-08 Thread Cary O'Brien


I am using confera to help coordinate some development work

I would like people to be able to upload large (100k) attachments
into the system so the documents can be shared by people at different
sites.  

I find that things work fine for small attachments, but for larger
attachments, Zope is very slow in reading from the socket, and the
browser often times out.

Any ideas?

Also, couldn't seem to run strace on the zope process.   I 
started under strace but the system went bezerk opening
sockets or something.  Is there any way to start a
single-process non-threaded zope server?

(Oh, Zope 2.1.6, Linux glibc/2.0.something kernel,ix86).

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Confera and strict permissions

2000-06-06 Thread Cary O'Brien

I'm trying to set up a small site with a Confera topic (using Zope
2.1.6).  It is going to be accessed by some off-site co-workers
through the internet, so I am concerned about security.  Access is
through Apache on the firewall with some mod_rewrite address filters,
but I'm kind of a belt-and-braces guy when it comes to security, so I
only want people who have user entries and passwords to access the
discussion.  No anonymous access at all.

But, if I remove the default "Anonymous" access privileges granted in
the root folder, even users with user entries who can access other
documents get access denied when trying to view the Confera topic.

This happens for both remote and local access.

The error traceback seems to point to a problem with the tree tag
rendering components.

Any ideas?

-- cary (Currently kind of frustrated with Zope.  Everything seems hard.)





___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Interbase / Cacheing - A thought

2000-06-01 Thread Cary O'Brien

> Ian Sparks wrote:
> > 
> > Had a thought that I wanted to share.
> > 
> > Interbase has a feature known as "event alerts". In a trigger you can post
> > "events" which are just fixed data strings e.g. "DataAdded" or
> > "Insert_tblUsers".
> 
> PostgreSQL has them too.
> 
> It's not (afaik) supported by DB-API, but could be used in a DA that talks 
> to some lower level API.
> 

They are supported by the TCL interface that comes with PostgreSQL 
(src/interfaces/libpgtcl in the PostgreSQL source tree) if you are
looking for examples of how they work.  (Search for listen and
notify in pgtclCmds.c

-- cary


> > A client database connection can register to listen to these events.
> > 
> > I don't know if any Zopeish Interbase access method supports this (ODBC
> > doesn't to my knowledge) but it would be incredibly useful for synching
> > cached database objects. Zope could hold a representation of the table data
> > in cached objects for quick access. Each object could have one or more
> > "event" methods which related to a database event. When the database adaptor
> > received an event message from Interbase it could inform all objects with a
> > matching event method (these methods would refresh their cached data with
> > current values from the database).
> > 
> > In this way database and Zope cache could be synced *without* having to poll
> > the database at an interval. In all, a very efficient mechanism.
> >
> > Just an idea I wanted to put out there.
> 
> Thanks for getting it out.
> 
> I have been contemplating the same for PostgreSQL but have been too lazy to do 
> it myself ;)
> 
> --
> Hannu
> 
> --__--__--
> 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Thread-safe PostgreSQL adaptor?

2000-05-31 Thread Cary O'Brien


Ok, pygresql is now DB-SIG compliant and thread safe.

http://druid.net/pygresql

What has to be done to create a one-database-connection-per-thread
PyGreSQL database adapter?  Given the recent influx of resources into
PostgreSQL this would seem like a nice thing.  Comments?

-- cary




___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Proposal for mail-in to Zope

2000-05-31 Thread Cary O'Brien

> Hi,
> 
> We (NIP - in the form of Chris Withers, Stephen Harrison, and Simon 
> Coles) have put some thought into the question of how to get emails 
> into Zope, and have come up with a design which we thought we'd pass 

Excellent idea. I was thinking about this just the other day.  We have
a mailing list for a project, and it would be nice to drop in an
email archive into the zope site we are using internally.

> by the list before we start doing something.
> 
> The problem we are trying to solve is basically being to email 
> "[EMAIL PROTECTED]" and that email ends up in the Zope ZODB 
> processed in whatever way is appropriate.
> 
> We aren't worried about sending email, that's done well at the 
> moment. We also wanted to keep things as simple and quick as possible 
> :-) This means trying to avoid getting involved with mail systems as 
> much as we can.
> 
> Most MTAs can be setup to pass an email to the stdin of a program. 
> Sendmail will do this, and Exim (http://www.exim.org/) will also pay 
> attention to what that program returns and queue the message for 
> re-try later if it fails. So using Exim, we don't have to get into 
> any messy stuff about queuing mails if the Zope server is down.
> 
> Some alternatives we considered and didn't go for:
>   - write something in Zope to listen for SMTP connections, effectively
> large portions of an MTA. This would be cool but painful.

I'd have to agree.

>   - pull mail from a POP or IMAP server. This had the downside that it
> introduced polling into the system (slow) and also required something
> to happen on a schedule, which doesn't happen in Zope yet.
> 

Here I'd have to disagree.  I would definately include polling of a
POP box as a way to get mail into the system.  Not everyone has a 24x7
internet connection with a fixed ip address and a dns entry, so for
them polling a POP box would be a great way to handle things.  Plus it
is great for those people picky about security that don't let anything
inward across the firewall.

Ok, so you could set up fetchmail to poll the pop box and redeliver
locally, but that is a lot of setup.

And isn't there a ZScheduler that will schedule operations in the
future?  And there is that nice python pop client interface.


> So:
>   - Within Exim, use the "pipe" transport to get email for a particular
> host sent to a program on the standard input. If the program called
> returns certain codes then Exim will queue the message and try again.
> 

I think you can do this with sendmail by putting "|command" in .forward.

>   - This program takes the email message and puts it into Zope, probably
> by calling a DTML Method or something. This would probably be
> configured by objects in the Zope ZODB which say effectively "When
> you get email for this address, then call this Method".
> 
>   - The DTML Method is responsible for doing the right things to get
> the email message into the ZODB in whatever form is appropriate.
> 

One thing I don't understand is how many processes can access a live ZODB.  How
does the locking work?  Otherwise you'd need to have your mail processor
command do an html get or post to get the information into Zope.

> We haven't yet figured out how to make sure the above mail handling 
> program can find all the relevant configuration documents. Is there 
> some way of efficiently finding all instances of a particular ZClass?
> 
> (Chris W. still isn't sure that's how the configuration will work but 
> that's the plan for the moment, so any thoughts would be appreciated)
> 
> What we'll do is a first version that hard codes everything in the 
> above script and prove the principle of the thing, and then move onto 
> the configuration.
> 
> 
> Does this sound like what people need? Any thoughts, comments, warnings?
> 
> 

The nice thing would be have a nice class for storing mail (either
in the ZODB or an RDBMS), and a couple of ways to feed it (.forward
with a pipe for sendmail, whatever for exim..).  That way people
can work with mail no matter how it was dumped into the system.

An advantage is that adding a POP client would allow you to create
a POP mail reader using zope also.  Just a thought.

-- cary
[EMAIL PROTECTED]

> I don't know yet what kind of schedule we'll be able to do this on 
> but drop me a mail and when there's something to play with we'll let 
> you know.
> 
> 
> 
> 
> Simon
> -- 
> - My opinions are my own, NIP's opinions are theirs --
> Simon J. Coles Email: [EMAIL PROTECTED]
> New Information Paradigms  Work Phone: +44 1344 753703
> http://www.nipltd.com/ Work Fax:   +44 1344 753742
> === Life is too precious to take seriously ===
> 



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cr

Re: [Zope] confera, zope 2.2, and attachments

2000-05-31 Thread Cary O'Brien



(Vitaly ([EMAIL PROTECTED]) helped me with this.  The problems was
that it wasn't possible to add an attachment to a ZDConfera message)

Note this is with Zope 2.1.6. 

Thanks for the information on fixing attachments in ZDConfera.  Note that
the latest version of ZDiscussios (0.2.0) does use FileObject() in
ZDConfera.py, but it doesn't import FileObject, and the icon is wrong.
The error is masked by the try block.

So the fix I used was...

0) Get ZDiscussions
1) Get Confera
2) Cope FileObject.py to lib/python/Products/ZDConfera
3) Edit ZDConfera.py
1. at the beginning add "from FileObject import FileObject"
2. change "icon='misc_/Confera/attachment.gif' to 
  "icon='misc_/ZDConfera/attachment.gif'
4) Restart

Thanks again,

-- cary



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] ZDiscussions and Zope 2.2

2000-05-31 Thread Cary O'Brien

> Hi Cary,
> 
> I'd be really happy if you could try out Squishdot 0.4.0 for what you're
> doing. It's kindof ZDiscussions on steroids and should work with 2.2,
> although I haven't had a chance to test it yet...
> 

It seems broken.

Using Zope-2.2.0a1 and Squishdot-0-4-0, this is what happens.

Install squishdot, restart - ok.
Create a squishdot topic from the management interface - ok.
Access the empty topic (i.e. directly, not through management interface) - ok.
Click "Post Article", get article entry form - ok.
Add dummy article, click Add, get "Your article has been posted" confirm. page - ok.
Click OK from confirm page, get Authorization Failed - Retry.
Give up, traceback below.

The new security stuff in 2.2 seems to have broken a lot of stuff.  Seems as if I
may have to rollback some internal sites back to 2.1.6.

-- cary

- traceback 
-

Traceback (innermost last):
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/ZPublisher/Publish.py, line 224, 
in publish_module
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/ZPublisher/Publish.py, line 189, 
in publish
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/ZPublisher/Publish.py, line 175, 
in publish
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/ZPublisher/mapply.py, line 160, 
in mapply
  (Object: index_html)
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/ZPublisher/Publish.py, line 112, 
in call_object
  (Object: index_html)
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/Products/Squishdot/Squishdot.py, 
line 1215, in index_html
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/OFS/DTMLMethod.py, line 160, in 
__call__
  (Object: posting_html)
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/DocumentTemplate/DT_String.py, 
line 500, in __call__
  (Object: posting_html)
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/DocumentTemplate/DT_Util.py, 
line 327, in eval
  (Object: meta_type == 'Comment')
  (Info: meta_type)
File /usr2/local/zope/Zope-2.2.0a1-src/lib/python/OFS/DTMLMethod.py, line 180, in 
validate
  (Object: posting_html)
File 
/usr2/local/zope/Zope-2.2.0a1-src/lib/python/AccessControl/SecurityManager.py, line 
139, in validate
File 
/usr2/local/zope/Zope-2.2.0a1-src/lib/python/AccessControl/ZopeSecurityPolicy.py, line 
160, in validate
  Unauthorized: meta_type




___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] ZDiscussions and Zope 2.2

2000-05-30 Thread Cary O'Brien


I can't seem to add a ZDiscussions topic any more.  I keep getting
authorization failures.  Managers are allowed to all zdiscussion
topics on the security page, though.

Is this related to the problem with ZSQL queries and the new
permissions scheme with 2.2?

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] confera, zope 2.2, and attachments

2000-05-30 Thread Cary O'Brien


With a confera discussion, I can't seem to add attachments.
I can enter a file name into the file upload box, and there
are no errors, but when I view the message there is no
attachment.

Am I doing something wrong?

-- cary

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Zope 2.2.0a1 permission problems

2000-05-18 Thread Cary O'Brien

Kyler wrote..

> <[EMAIL PROTECTED]>
> Date: Thu, 18 May 2000 08:03:58 EST
> From: "Kyler B. Laird" <[EMAIL PROTECTED]>
> 
> 
> >>I just installed release 2.2.0a1 on a glibc Linux box, but I keep
> >>getting a permission problem when accessing a database query.
> >
> >I have encountered the same problem using ZOracleDA
> >under SPARC Solaris.
> 
> >File /data/www/Zope/Zope-2.2.0a1-src/lib/python/DocumentTemplate/DT_In.py,
> > line 602, in renderwb
> >  (Object: jis_query)
> >  Unauthorized: 0
> 

I've had identical problems with PostgreSQL queries.  I posted
two fairly detailed posts describing the problem.  I guess I'll
try your brute force method.

[snip some frustration]

> After beating on this over the last day or so trying to
> understand what was happening at the Web interface level
> (thinking that I must have just screwed up a permissions
> setting somewhere), I finally looked at the code and
> simply commented out line 602 in
>   /data/www/Zope/Zope-2.2.0a1-src/lib/python/DocumentTemplate/DT_In.py
> 
>   # raise ValidationError, index
> 
> Ta da!  It works...for now.  This little patch will get
> me up and going.  I trust that someone will fix whatever
> problem necessitated this in a future release and I
> won't need this awful kludge, but it sure is nice to be
> able to use it now.
> 

Anyone know what the real fix is?

-- cary


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )