[Zope-dev] Object references from dtml

2000-10-20 Thread Ross Boylan

I have a log composed of sublogs, and so on.  I would like for people to be 
able to see some kind of summary (e.g., short versions of the logs down n 
levels) on the screen and then click on one of interest and see a fuller 
display of it.

Is there a good way to do this using dtml?

I've thought of two approaches.  The "standard" zope way seems to be to 
make each log folderish, and give each entry an id.  Then I can embed the 
address in the html.  The problem with this is that I would have to make up 
the id's and add extra machinery that the logs don't really need.

I'm leaning toward a second approach, of getting an object id and putting 
it in the html.  This also raises some issue.
   * Will the id be stable in the face of the db potentially 
dematerializing objects underneath?
   * If I use a persistent id (_p_oid, I think), will that be stable?
   * (Also, I'll need to be sure everything has persisted, but I think I 
can do that by forcing a transaction end before getting the _p_oid).
   * Can I map from object id back to object?  (_p_jar.something or other)
   * Will this be robust across database changes (minimally, from ZODB to 
ZEO)?
   * Will the object id consist of characters which can be embedded easily 
in html?


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Inheritable Propertysheets!???!!?!?!?!!

2000-10-20 Thread Alexander Schonfeld
Thanks, that does seem to do the trick.  :)
Much appreciation!!

I added a propertysheets like this:
  ParentClass.Propertysheet.defaultProps.someprop
  ChildClass1.Propertyshoot.props.someprop
  ChildClass2.Propertyshoot.props.someprop (to override the parent's
default when needed)

It sees the ChildClass' "someprop" first so it doesn't go look for
the parent's prop.

This is useful for making lots of classes with only a few changed
properties, but the bulk of which can be inherited.

Alex.


On Wed, 18 Oct 2000 10:50:44 +0100
"Seb Bacon" [EMAIL PROTECTED] wrote:

 AFAIK (but I'm no expert), a ZClass inherits its parents' propertysheets and
 you can access them in the normal way.  The problem is that the all the
 propertysheets have to have different names.  Example:
 
 If your parent class and the child class both have a property sheet called
 "Basic", but the child class is hoping to inherit someproperty from the
 parent class:
 
   ParentClass.Propertysheets.Basic.someproperty
 
 is ok, but
 
   ChildClass.Propertysheets.Basic.someproperty
 
 won't work, because "someproperty" is not in ChildClass's "Basic"
 propertysheet.
 
 If your parent class and child class do not share propertysheets with the
 same name, you *can* access parent properties:
 
   ChildClass.Propertysheets.ChildSheet.anotherproperty
   ChildClass.Propertysheets.Basic.someproperty
 
 will both work.
 
 If I'm correct, this is all wrong and a bad thing, surely?
 
 However that was the worst-explained thing I've ever been responsible for
 and it's probably wrong.  That particular configuration of punctuation in
 the subject header just struck a chord with me...
 
 seb.
 
 
 
  -Original Message-
  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On
  Behalf Of Alexander Schonfeld
  Sent: 18 October 2000 10:25
  To: [EMAIL PROTECTED]
  Subject: Re: [Zope-dev] Inheritable Propertysheets!???!!?!?!?!!
 
 
  I guess I can just use dtml methods that return lists and stuff, but is
  that as cool?
 
  On Wed, 18 Oct 2000 18:21:33 +0900
  Alexander Schonfeld [EMAIL PROTECTED] wrote:
 
   I'm doing an experiment... If I add more '!' and '?' marks will I get a
   response.  Soon with enough experimentation I can find the optimal
   number and frequency of variation.
  
   I want to inherit the properties of one zclass in another zclass, but
   it seems to cause some namespace clashing... shouldn't this be possible?
   Working with the instance of the class is fine, but inter-zclass
   inheritance (acquisition?) would be nice...
  
   Cool feature?
  
   Am I missing something?
   Thanks,
  
   Alex.
  
   1010011010101001101010100110101010011010
   0  Digital Garage$B!!%G%8%?%k

Re: [Zope-dev] Object references from dtml

2000-10-20 Thread Ender

Ross Boylan wrote:
 
 I have a log composed of sublogs, and so on.  I would like for people to be
 able to see some kind of summary (e.g., short versions of the logs down n
 levels) on the screen and then click on one of interest and see a fuller
 display of it.
 
 Is there a good way to do this using dtml?
 
 I've thought of two approaches.  The "standard" zope

having recently debugged company's zope server, i can safely say that
there is no 'standard'.

 way seems to be to
 make each log folderish, and give each entry an id.  Then I can embed the
 address in the html.  The problem with this is that I would have to make up
 the id's and add extra machinery that the logs don't really need.

 I'm leaning toward a second approach, of getting an object id and putting
 it in the html.  This also raises some issue.

you lost me. your problem with the first method is having ids for your
log entries and your second method starts with getting ids for your
objects. 


looking ahead, YIKES, you just went from can i do this in dtml to
messing with python code in the guts of the ZODB. that was a SERIOUS
leap. IMO i'd highly recommend against messing with the zodb stuff, _p_
attrs are supposed to be reserved. i understand you want to treat them
as read only, but i wouldn't even go near it if it could be implemented
easily otherwise or i had developed a strong masochistic tendency and
already knew the zodb well (well enough to know the answers to the below
questions).

 This also raises some issue.
* Will the id be stable in the face of the db potentially
 dematerializing objects underneath?

what id?

* If I use a persistent id (_p_oid, I think), will that be stable?

see above commentX2.

* (Also, I'll need to be sure everything has persisted, but I think I
 can do that by forcing a transaction end before getting the _p_oid).

transactions are important, but also telling it before hand that the
object is dirty and needs to be saved. you might want to read jim's
paper on the zodb. it and alot of other good material are linked from

http://www.zope.org/Members/itamar/LearningZope/LearningZope.html

* Can I map from object id back to object?  (_p_jar.something or other)

this is getting worse(scarier?) as i go on... i have no idea. consider
also that a url is also a unique persistent object id that maps into the
zodb, why your first method works. 

* Will this be robust across database changes (minimally, from ZODB to
 ZEO)?
* Will the object id consist of characters which can be embedded easily
 in html?
 

...

there are alot of other ways to do this... of the top of my head

you could always store log entries in a sql db. 

since you seem not adverse to doing it in python, despite your original
question...

so why not just write a python class for the log folder thats
persistent, add some methods for managing/storing log entries in a some
attr (maybe list of dicts) of the logfolder. write some dtml accessible
accessor methods to the attrs. write a dtml page for summary and one for
details. 

kapil

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Method binding

2000-10-20 Thread Chris Withers

Maybe the Zope-Dev guys have comments on this

 From: Jim Fulton [EMAIL PROTECTED]
 
 Michel,
 
 You have advocated that methods should always be bound to the objects they
 are accessed in. You argue that there should be no choice in the matter.
 
 I have to disagree strongly. I'll try to explain why.
 
 In Python, methods are bound to instances.  Methods are part
 of an instance's core behavior. They are specific to the kind
 of thing the instance is. In my words, methods are part of
 the genetic makeup of an object.
 
 In Zope, we allow some methods to be bound to their context.
 This is done in a number of ways and is sometimes very useful.
 We have methods, like standard_html_header, which are designed
 to be used in different contexts.
 
 We have other methods, like manage_edit that are designed to
 work on specific instances. It would be an egregious error
 if this method was acquired and applied to it's context.
 
 We have some methods that are designed to bound to an instance
 (container, in your terminology) but that, because they are written in
 DTML, can be bound to other objects. This can cause significant problems.
 For example, methods defined in ZClasses almost always want to be
 bound to ZClass instances, not to other arbitrary objects.
 
 asideThere's a bonus problem with DTML Methods. When
 a DTML Method is invoked from another DTML Method, it
 is bound to neither the object it was accessed in or
 to the object it came from. It is bound to the calling
 namespace. It turns out that this is a useful behavior
 if the DTML Method is designed to be used as a "subtemplate".
 /aside
 
 There is no one "right" way to bind a method. There are good
 reasons to sometimes bind a method to it's context and
 sometimes bind a method to it's container (ie instance).
 There are even sometimes reasons to bind a method to a
 calling namespace.
 
 The principle of least surprise doesn't help here, because
 methods defined in Python classes don't behave the way
 methods defined through the web do currently.
 
 We *need* control over binding, as well as reasonable defaults.
 
 If we can agree that we need binding control, the question
 arises as to some details and default names.
 
 Should it be possible to do more than one binding at a time,
 using multiple names?  If not, then I'd agree that the name
 'self' should be used for either the context or container binding.
 If both bindings are allowed at the same time, then 'self' should
 refer to container binding to be consistent with standard Python
 usage and some name like 'context' should be used (by default)
 for contextual binding.
 
 Jim

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Michel's Reply

2000-10-20 Thread Chris Withers


From: Michel Pelletier [EMAIL PROTECTED]

Jim Fulton wrote:

  Michel,

  You have advocated that methods should always be bound to the objects they
  are accessed in. You argue that there should be no choice in the matter.

I advocate more points than that, like being able to document python
with python, no XML mixed in with a language, Py Meths working like
other methods do, but yes that is one of them. 

My argument should be more flexible in regard to choice, a willing
compromize is to switch the default binding of context and container,
making 'self' the default for context and something else the default for
container.

  I have to disagree strongly. I'll try to explain why.

  In Python, methods are bound to instances.  Methods are part
  of an instance's core behavior. They are specific to the kind
  of thing the instance is. In my words, methods are part of
  the genetic makeup of an object.

Python methods are meant for through the web usability and programming
ala the existing Zope model.  90% of your audience just scratched their
heads.

  In Zope, we allow some methods to be bound to their context.
  This is done in a number of ways and is sometimes very useful.
  We have methods, like standard_html_header, which are designed
  to be used in different contexts.

this is how I feel python methods should be designed to be used.

  We have other methods, like manage_edit that are designed to
  work on specific instances. It would be an egregious error
  if this method was acquired and applied to it's context.

I think this is a weak argument, none of the built in Zope methods mean
anything to the average user, they can't find them, click on them, edit
them, or copy them to their own method to change and experiment with. 

  We have some methods that are designed to bound to an instance
  (container, in your terminology)

Python Method terminology

  but that, because they are written in
  DTML, can be bound to other objects. This can cause significant problems.
  For example, methods defined in ZClasses almost always want to be
  bound to ZClass instances, not to other arbitrary objects.

  asideThere's a bonus problem with DTML Methods. When
  a DTML Method is invoked from another DTML Method, it
  is bound to neither the object it was accessed in or
  to the object it came from. It is bound to the calling
  namespace. It turns out that this is a useful behavior
  if the DTML Method is designed to be used as a "subtemplate".
   /aside

This is because DTML binding is implicit, not because it's backward.
This problem doesn't effect python methods because you allways bind a
method in python when you call it.  The question is how the initial
method gets bound.

  There is no one "right" way to bind a method. There are good
  reasons to sometimes bind a method to it's context and
  sometimes bind a method to it's container (ie instance).
  There are even sometimes reasons to bind a method to a
  calling namespace.

  The principle of least surprise doesn't help here, because
  methods defined in Python classes don't behave the way
  methods defined through the web do currently.

  We *need* control over binding, as well as reasonable defaults.

  If we can agree that we need binding control, the question
  arises as to some details and default names.

I agree there must be control over binding, although your arguments
above have not convinced me that Python Methods are doing it the right
way, actually, it's convinced more than my argument, compromisingly of
course, is more right.

  Should it be possible to do more than one binding at a time,
   using multiple names?  If not, then I'd agree that the name
  'self' should be used for either the context or container binding.

I'm with you so far with that.

  If both bindings are allowed at the same time, then 'self' should
  refer to container binding to be consistent with standard Python
  usage and some name like 'context' should be used (by default)
  for contextual binding.

That's what I disagree with.  I don't think you've given a strong
corollary to standard python usage.  The only strong argument you've
given so far is the ZClass one, but 10 gives you 1 that's not the
primary use case (it may be the one in Fburg).  People are going to be
defining these methods in Zope to make their lives easier, probably bad
design and mad hacks and no structure, but that's how 90% of the world
gets their work done and easing that burden is the usability task.  You
have not convinced me that:

1. Something called a Python Method should not resemble a method
definition in python.

2. Something called a Method in Zope should not behave like the other
Methods (meaning through the web objects) in Zope

3. Common, *documented* well understood URL manipulations (context) are
less important than (the less common) containment oriented design and
ZClasses.

Consider the following passage in the documentation:

   For example suppose you want to call a method 

[Zope-dev] Python and Perl scripts

2000-10-20 Thread Chris Withers

This one is probably the most useful of the lot ;-)

From: Michel Pelletier [EMAIL PROTECTED]

Greetings,

Well, Jim, Evan, Brian and I pow-wowed yesterday and came up with an
interesting change.  The world 'Method' is too overlaoded, as it means
too much to too many people.  Also, Python Methods don't work like
methods in python, which was my argument, but they are very useful and
there are sound reasons for them working like they do (which J, E and B
convinced me of yesterdat).  We have decided to change the name of
Python Methods to something else, the current candidate being 'Python
Script'.

'Script' objects make a lot of sense, they don't overload the concept of
methods, they describe an action that people commonly want to do (script
the web) and they clear up a lot of potential confusion for newbie and
old-hat alike.

The bonus for all of this is that the only thing that needs to change is
the name.  Which name is still an issue though, and we want your input.
what do you think of the idea of Perl Script objects?

The other issue, for the sake of documentation, is variable binding
(which was the root of our disagreement yest. Python Methods do not bind
variables and argument like methods in python do).  From what I can see,
Perl Methods seem to get 'self' pass in as a first argument.  Is this
all there is too it or are there more details?  Python Methods have five
special variables (defined on the bindings tab) that get created in the
namespace of the method.  Should perl methods work the same way and not
have special variables passed in as arguments?  This would probably be
more consistent with the Python model, and since 'self' will probably
not be the name of the variable bound to either the container or the
context it should be more explicit for perl methods also.

What do you think?

-Michel

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] My $0.02

2000-10-20 Thread Chris Withers

 From: Michel Pelletier [EMAIL PROTECTED]
 
 Well, Jim, Evan, Brian and I pow-wowed yesterday and came up with an
 interesting change.  The world 'Method' is too overlaoded, as it means
 too much to too many people.  Also, Python Methods don't work like
 methods in python, which was my argument, but they are very useful and
 there are sound reasons for them working like they do (which J, E and B
 convinced me of yesterdat).  We have decided to change the name of
 Python Methods to something else, the current candidate being 'Python
 Script'.

Well, I think script ain't right. How about 'Function', since, to me,
the things you've described sound exactly like normal Python Functions.
A function is callable but has no logic about a magic 'self' argument or
anything else, for that matter.

 methods, they describe an action that people commonly want to do (script
 the web) and they clear up a lot of potential confusion for newbie and
 old-hat alike.

'script' implies a sequential execution of a lump of code that doesn't
'return' anything. That doesn't sound like the old Python Methods.
They get arguments (from the namespace, some of which is introduced by
the bindings tab) and return something, probably text, that results from
their execution and, I guess, their return statement. Just to overstate
the point (;-), that sounds like a function to me...

 Python Methods have five
 special variables (defined on the bindings tab) that get created in the
 namespace of the method.  Should perl methods work the same way and not
 have special variables passed in as arguments?  

Sounds like they should have a binding tab and no 'special' self
argument. Maybe they should both subclass a generic 'Function' object
which provides the interface for this? Then other languages might get
implemented later down the line ;-)

cheers,

Chris

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Hippo Feed and Acquisition

2000-10-20 Thread Chris Withers

Toby Dickenson wrote:
 Thats fine until:
 
snip hilarious hippo metaphor

I liked that :-))

very accurately sums up some of the problems...

Although I'm not sure they're problems with the method binding this
thread was about.

The problems you describe seem to be with Acquistion in general. Other
than that, I don't have the answers :-(

Any ideas, anyone?

cheers,

Chris

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Python and Perl scripts

2000-10-20 Thread jpenny

On Fri, Oct 20, 2000 at 01:01:59PM +0100, Chris Withers wrote:
 This one is probably the most useful of the lot ;-)
 
 From: Michel Pelletier [EMAIL PROTECTED]
 
 Greetings,
 
 Well, Jim, Evan, Brian and I pow-wowed yesterday and came up with an
 interesting change.  The world 'Method' is too overlaoded, as it means
 too much to too many people.  Also, Python Methods don't work like
 methods in python, which was my argument, but they are very useful and
 there are sound reasons for them working like they do (which J, E and B
 convinced me of yesterdat).  We have decided to change the name of
 Python Methods to something else, the current candidate being 'Python
 Script'.
 
 'Script' objects make a lot of sense, they don't overload the concept of
 methods, they describe an action that people commonly want to do (script
 the web) and they clear up a lot of potential confusion for newbie and
 old-hat alike.
 

Oh, yuck!  Now we have to explain why PythonScript is safe, and JavaScript
sucks rocks (from a security standpoint).  And from common web convention,
it would appear that PythonScript would run on the client side, rather
than the server side.  Since the -let suffix appears to have taken on
a server side connotation, perhaps that can be used.

Python Function is not quite right, as it is fairly common (for me, at
least) to define some helper functions in a Python Method.  But it is
better than Python Script.

So, I guess my preferences would be:

PythonSafeScriptlet
PythonScriptlet
PythonSafeScript
PythonSafeFunction
PythonFunction
PythonBundle
PythonMethod
PythonScript

in descending order of preference.


 
 -Michel
 
 ___
 Zope-Dev maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope-dev
 **  No cross posts or HTML encoding!  **
 (Related lists - 
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope )
 

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] FYI: away for a few days

2000-10-20 Thread Phillip J. Eby

I'm going to be out of town for a few days, and won't be as quick to
respond to e-mails, if I respond at all during that time.  Ty will still be
around, though, to answer all your ZPatterns and LoginManager questions.
Right, Ty?  ;)


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Re: Michel's Reply

2000-10-20 Thread Michel Pelletier

Chris Withers wrote:
 
 From: Michel Pelletier [EMAIL PROTECTED]
 

Hmm.  I thought this was a internal series of emails, I just now noticed
that zope-perl got cc:ed on them somewhere in the middle.  Oh well, it
is some good discussion; I allways like to stir the shit!

-Michel

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Python and Perl scripts

2000-10-20 Thread Michel Pelletier

[EMAIL PROTECTED] wrote:
 
  
  'Script' objects make a lot of sense, they don't overload the concept of
  methods, they describe an action that people commonly want to do (script
  the web) and they clear up a lot of potential confusion for newbie and
  old-hat alike.
  
 
 Oh, yuck!  Now we have to explain why PythonScript is safe, and JavaScript
 sucks rocks (from a security standpoint).  

The proposal is not for PythonScript but a "Python Script".  We are not
inventing a new language, this is python, we are just coming up with the
name for an object.  Don't capitalize it and you'll see what I mean.  Go
write a python script.  I'm gonna write a python script that handles
this HTML form.  If we do this with a python script instead of a DTML
method, it will be much clearer.  Wow, this perl script has lots of
slashes in it.

 And from common web convention,
 it would appear that PythonScript would run on the client side, rather
 than the server side.  Since the -let suffix appears to have taken on
 a server side connotation, perhaps that can be used.

Hmm.  Yes I agree the -let suffix may have a sttronger server side
flavor, but I disagree that the word script has any strong connection to
the client only.

 Python Function is not quite right, as it is fairly common (for me, at
 least) to define some helper functions in a Python Method.  But it is
 better than Python Script.

Function is just as technical as method.  These are OO techncial
programming terms (function less than method).  The idea is to lower the
bar for people using Zope.  People who only know HTML will be much more
likely to grok what a script is than a method.  We want to avoid
elitism.  Method is total OO elitism, function less so because it's very
language neutral, and script is like plain vanilla ice cream, everyone
gets it.

Like chocolate and coconut-shaving covered almonds, technical details
mixed in with your ice-cream will appeal only to a smaller crowd.  It
will not help define what 'ice cream' is.  It will turn away a group of
users who may have never know they could mix in sardines and sweet
tarts.  Technical details before the key idea is explained is
*dangerous* belive me, and it is the pitfall of all existing Zope
documentation to date.

The new DC documentation motto is "Explain key ideas in simple terms." 
Method is not a simple term.

 So, I guess my preferences would be:
 
 PythonSafeScriptlet
 PythonScriptlet
 PythonSafeScript
 PythonSafeFunction
 PythonFunction
 PythonBundle
 PythonMethod
 PythonScript
 
 in descending order of preference.

I'll add these to the list of candidates.  Thanks!

-Michel

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Python and Perl scripts

2000-10-20 Thread jpenny

On Fri, Oct 20, 2000 at 02:18:47PM -0700, Michel Pelletier wrote:
 [EMAIL PROTECTED] wrote:
  
 The proposal is not for PythonScript but a "Python Script".  We are not
 inventing a new language, this is python, we are just coming up with the
 name for an object.  Don't capitalize it and you'll see what I mean.  Go
 write a python script.  I'm gonna write a python script that handles
 this HTML form.  If we do this with a python script instead of a DTML
 method, it will be much clearer.  Wow, this perl script has lots of
 slashes in it.

I understand, but if naming is under consideration, I worry about
inadvertant connotations.  I feel that in the web space, _-script
has come to mean that the language is a client side actor, witness
javascript, ecmascript, vbscript.  

(On the other hand, PythonScript, PerlScript, and ReXXScript appear
be server side stuff in ASP.) 

And I see a difference between PythonScript and Python Script, but
I don't hear it!

 Function is just as technical as method.  These are OO techncial
 programming terms (function less than method).  The idea is to lower the
 bar for people using Zope.  People who only know HTML will be much more
 likely to grok what a script is than a method.  We want to avoid
 elitism.  Method is total OO elitism, function less so because it's very
 language neutral, and script is like plain vanilla ice cream, everyone
 gets it.
 
 Like chocolate and coconut-shaving covered almonds, technical details
 mixed in with your ice-cream will appeal only to a smaller crowd.  It
 will not help define what 'ice cream' is.  It will turn away a group of
 users who may have never know they could mix in sardines and sweet
 tarts.  Technical details before the key idea is explained is
 *dangerous* belive me, and it is the pitfall of all existing Zope
 documentation to date.

Actually, I am not sure that script is much less technical than
function.  I think script, as in bash script, or scripting language
is very crabbed and technical indeed.  The only pre-computer usages
I know of script(n.) are indicative of a cursive style of writing,
apeper money,  or a thing that playwrights produce.  I don't think 
that playwrights are going to suddenly start wanting to use python!  
I think that script, as in "scripting language" is simply something 
that most people indeed do not get!

 
 The new DC documentation motto is "Explain key ideas in simple terms." 
 Method is not a simple term.
 

I don't disagree with your goal.  I do disagree with this particular
choice of words.  

I can see four potential properties that one could want to emphasize
about a python method.

1) It is safer (to the Zope server) than a python external method.
2) It safer to the end user than a JavaScript (it never touches the client).
3) It uses python, and not something else as its implementation technique.
4) In OO terms, it is not really a Method.

Hence the preference for Safe in the name.  Even a newbie ought not to
be able to cut himself too badly on a python method.

There is talk of perl methods.  So we need python in the description.

Now we just need a generic term, which will not cause other confusions
later on down the road for the concept.  I really don't like script,
especially next to a language name (in the web domain).  You don't like
function (which was not my suggestion).  Thingie seems a bit too non-
descriptive.  Widget has technical meaning.  Perhaps task or job are
suitable, as in
Safe Python Task
Safe Python Job
Safe Python Subtask
Safe Python Function
Safe Python Script

Then external methods, which are often also not methods, can become
Flexible Python Task
Flexible Python Job
Flexible Python Subtask
Flexible Python Function
Flexible Python Script

But if you really want to use
Tame Snake Thingy, and
Wild Snake Thingy,
go ahead, but please do not credit me in the documentation!

As another obesrvation, substituting script for method is not really all
that helpful for the other (misnamed) method, DTML Method.
DTML Script is just not all that much clearer!

 Zope-Dev maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope-dev
 **  No cross posts or HTML encoding!  **
 (Related lists - 
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope )
 

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Python and Perl scripts

2000-10-20 Thread Michel Pelletier

[EMAIL PROTECTED] wrote:
 

snip good discussion

 Now we just need a generic term, which will not cause other confusions
 later on down the road for the concept.  I really don't like script,
 especially next to a language name (in the web domain).  You don't like
 function (which was not my suggestion).  Thingie seems a bit too non-
 descriptive.  Widget has technical meaning.  Perhaps task or job are
 suitable, as in
 Safe Python Task
 Safe Python Job
 Safe Python Subtask
 Safe Python Function
 Safe Python Script
 
 Then external methods, which are often also not methods, can become
 Flexible Python Task
 Flexible Python Job
 Flexible Python Subtask
 Flexible Python Function
 Flexible Python Script
 
 But if you really want to use
 Tame Snake Thingy, and
 Wild Snake Thingy,
 go ahead, but please do not credit me in the documentation!

Well they'll all go on the list of candidates!  Thanks for your input, I
kinda like task...
 
 As another obesrvation, substituting script for method is not really all
 that helpful for the other (misnamed) method, DTML Method.
 DTML Script is just not all that much clearer!

Rumor has it DTML Methods are going to be renamed to "DTML Template" or
something like that.

Keep in mind also that we are moving towards a new architecture with
"Documents" and "Templates" (ala HyperDOM).  I think Scripts fits right
in there:

Documents, Templates and Scripts

or

Documents, Templates and Methods

?

-Michel

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Python and Perl scripts

2000-10-20 Thread Steve Waterbury

Michel Pelletier wrote:

 snip good discussion

and move on to something REALLY silly!  :^

 [EMAIL PROTECTED] wrote:
  descriptive.  Widget has technical meaning.  Perhaps task or job are
  suitable, as in
  Safe Python Task
  Safe Python Job
  Safe Python Subtask
  Safe Python Function
  Safe Python Script
 
  Then external methods, which are often also not methods, can become
  Flexible Python Task
  Flexible Python Job
  Flexible Python Subtask
  Flexible Python Function
  Flexible Python Script
 
  But if you really want to use
  Tame Snake Thingy, and
  Wild Snake Thingy,
  go ahead, but please do not credit me in the documentation!

 Documents, Templates and Scripts
 or
 Documents, Templates and Methods

I REALLY like Thingy!  And a very Pythonesque choice it would 
be ... :^)  Python Thingies and Perl Thingies.  How nice to be 
so connotationless!  ... but maybe not so connotationless ... 
recalling the usage of "thingy" in the Python, Monty oeuvre 
("YOU know ... THINGY!!") ... you might want to consider

Tame Snake Sex, and 
Wild Snake Sex, 

so then you have 
Documents, Templates, and Sex

Python Sex vs. Perl Sex? ... wow, just think of it!  
Of course, alibis about working late would have to be 
carefully worded ...

Sorry ... it's late on a Friday ... but I DO like Thingy!  :^)

Cheers,
-- Steve.

   oo _\o
\/\ \
  /
 oo _
"Sometime you're the windshield; sometime you're the bug."
- Knopfler

Stephen C. Waterbury   Component Technologies
Code 562, NASA/GSFC  and Radiation Effects Branch
Greenbelt, MD 20771   Engineering Web/Database Specialist
Tel: 301-286-7557  FAX:  301-286-1695
WWW:  http://misspiggy.gsfc.nasa.gov/people/waterbug.html
_

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Python and Perl scripts

2000-10-20 Thread Michael Bernstein

Michel Pelletier wrote:
 
 Keep in mind also that we are moving towards a new architecture with
 "Documents" and "Templates" (ala HyperDOM).  I think Scripts fits right
 in there:
 
 Documents, Templates and Scripts
 
 or
 
 Documents, Templates and Methods

I tend to think of things as:

Objects, Views (or Templates) and Blocks.

The diference (for me) between a View and a Block is whether
they are intended to be accessed directly by a client
(browser). Blocks also tend to be reuseable in many views (I
typically have a Block (DTML Method) called main_navigation,
for example), and can be composed of other Blocks. Views
like index_html may be reused, but usually through
acquisition, not recomposition.

The lines are fuzzy though, since I'm usually using the same
types of objects (DTML Methods) for both Views and Blocks.
Perhaps we need an object type that is not directly
accessible from a client (but may only be called or rendered
from other objects) in order to clarify the distinction.

Michael Bernstein.

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Re: [Zope] IIS and PCGI

2000-10-20 Thread Andy McKay

Well I fixed this using a ISAPI filter which I will release soon (once I
have some time) that takes a url /a/b/c/x.pcgi/f/g/h, and passes
/a/b/c/x.pcgi to IIS so the file will run and /f/g/h to Zope.

My next question is has anyone succeeded in getting this to work to another
box over a mapped or shared win32 drive?

I mapped g:\ to my zope host, and then specified
PCGI_PUBLISHER=g:\pcgi\pcgi_publisher.py in my pcgi file. The problem seems
to pcgi-wrapper.exe which does not like a mapped drive. (line 485 of
parseinfo.c keeps spitting out missing publisher)...

Thanks in advance and apologies for the cross post to zope-dev but it is
more of a zope-dev question.

- Original Message -
From: "Andy McKay" [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, October 17, 2000 1:33 PM
Subject: [Zope] IIS and PCGI


 Im fiddling with IIS and PCGI, I've looked at
 (http://www.zope.org/Members/brianh/iis_howto) the docs and got the server
 to work correctly in that http://127.0.0.1/zope.pcgi is the same as
 http://127.0.0.1:8080/

 However it doesnt seem to be carrying through the trailing path info (or /
 's) for example
 http://127.0.0.1/zope.pcgi/manage brings up 404. Using IIS 5.0, Win2k,
Zope
 2.2.1.

 Anyone encountered this and know the solution?

 Thanks.
 --
   Andy McKay, Developer.
   ActiveState.


 ___
 Zope maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope
 **   No cross posts or HTML encoding!  **
 (Related lists -
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope-dev )



___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope] dtml-sqlvar quote

2000-10-20 Thread Tony McDonald


Hi all

How can i pass a string to a sql method that won't be quoted.

i.e so i can do somthing like this

.
group by foo,blah
order by dtml-sqlvar spam


thanks mark
 

don't quote it?

...
order by dtml-var spam


I use this all the time for things like

select * from data where dtml-var search_field like '%dtml-var search_term%'

tone


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Newsletter in Zope

2000-10-20 Thread Stephan Goeldi

I am looking for a way to enable a Newsletter in Zope. I want the visitors 
to subscribe to the newsletter. Then they receive a mail to verify the 
subscription. Later I can write and send a Newsletter to all subscripted 
visitors.

Is there already a solution in Zope for that?


_
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

Share information about yourself, create your own public profile at 
http://profiles.msn.com.


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] IIS and Zope share same problem :-S

2000-10-20 Thread Chris Withers

 MICROSOFT WEBSERVERS LAID OPEN FOR ALL TO SEE
 by Dave Murphy, [EMAIL PROTECTED]
 
 Microsoft is scrambling to repair damage caused by a
 security hole in its IIS 4  5 webserver that runs on
 Windows NT/2000. Microsoft claims over four million
 IIS websites, and each one of them is at risk of
 releasing sensitive data through the security hole.
 Called the "Web Server Folder Traversal" error, the
 flaw allows users to execute files on an IIS website by
 requesting a specific web address. 

http://www.zope.org/standard_html_header for example ;-)
http://www.zope.org/objectIds as another...

 The bug allows access to any file on the webserver via
 a specified URL. Like all webservers, IIS is supposed
 to prevent access to files that aren't intended to be
 part of the website.

Maybe Zope should too

 This article is posted to http://itrain.org/itinfo/2000/it001017.html
 
 Live well, do good,
 
 --Dave Murphy

cheers,

Chris

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] IIS and Zope share same problem :-S

2000-10-20 Thread Andrew Kenneth Milton

+---[ Chris Withers ]--
|  MICROSOFT WEBSERVERS LAID OPEN FOR ALL TO SEE
|  by Dave Murphy, [EMAIL PROTECTED]
|  
|  Microsoft is scrambling to repair damage caused by a
|  security hole in its IIS 4  5 webserver that runs on
|  Windows NT/2000. Microsoft claims over four million
|  IIS websites, and each one of them is at risk of
|  releasing sensitive data through the security hole.
|  Called the "Web Server Folder Traversal" error, the
|  flaw allows users to execute files on an IIS website by
|  requesting a specific web address. 
| 
| http://www.zope.org/standard_html_header for example ;-)

Not that old chestnut again...

| http://www.zope.org/objectIds as another...

To be fair this is not the same as the bug described below.

| 
|  The bug allows access to any file on the webserver via
|  a specified URL. Like all webservers, IIS is supposed
|  to prevent access to files that aren't intended to be
|  part of the website.

Knowing the file is there is not the same as accessing it.

-- 
Totally Holistic Enterprises Internet|  P:+61 7 3870 0066   | Andrew Milton
The Internet (Aust) Pty Ltd  |  F:+61 7 3870 4477   | 
ACN: 082 081 472 ABN: 83 082 081 472 |  M:+61 416 022 411   | Carpe Daemon
PO Box 837 Indooroopilly QLD 4068|[EMAIL PROTECTED]| 

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] ZDiscussions for Zope 2.2.2

2000-10-20 Thread Chris Withers

Cary O'Brien wrote:
 2) add __allow_access_to_unprotected_subobjects__  in
a few places.

That's not good :-S

But hey, I had to do it to get Squishdot to work with Zope 2.2 as well
:-(

cheers,

Chris

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] IIS and Zope share same problem :-S

2000-10-20 Thread Pierre-Julien Grizel


Hum... A possible way to solve this problem is to practice the "you
can't do ANYTHING but..." policy... And, thus, according proxy roles to
the methods that must access it, such as index_html.
I know it's constraining but with a little work we can end up with
something quite secure  secret.




P.-J.



Chris Withers wrote:
 
  MICROSOFT WEBSERVERS LAID OPEN FOR ALL TO SEE
  by Dave Murphy, [EMAIL PROTECTED]
 
  Microsoft is scrambling to repair damage caused by a
  security hole in its IIS 4  5 webserver that runs on
  Windows NT/2000. Microsoft claims over four million
  IIS websites, and each one of them is at risk of
  releasing sensitive data through the security hole.
  Called the "Web Server Folder Traversal" error, the
  flaw allows users to execute files on an IIS website by
  requesting a specific web address.
 
 http://www.zope.org/standard_html_header for example ;-)
 http://www.zope.org/objectIds as another...
 
  The bug allows access to any file on the webserver via
  a specified URL. Like all webservers, IIS is supposed
  to prevent access to files that aren't intended to be
  part of the website.
 
 Maybe Zope should too
 
  This article is posted to http://itrain.org/itinfo/2000/it001017.html
 
  Live well, do good,
 
  --Dave Murphy
 
 cheers,
 
 Chris
 
 ___
 Zope maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope
 **   No cross posts or HTML encoding!  **
 (Related lists -
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope-dev )

-- 
If the only tool you have is a hammer, 
you tend to see every problem as a nail.
Si le seul outil dont vous disposez est un marteau, 
vous avez tendance à voir chaque problème comme un clou. 
   --Abraham Maslow

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] ZMySQL and MySQLdb Versions

2000-10-20 Thread Ragnar Beer

Howdy!

When I go to the download section on zope.org looking for a way to 
connect Zope and MySQL I can find the following:

- Zope MySQL Database Adapter, 2000/07/20 by mordred (ZMySQLDA-1.2.0.tar.gz)
- ZMySQLDA, 2000/07/20 by MikeP (ZMySQLDA-1.1.3-nonbin.tar.gz)
- An Interface for MySQL, 2000/07/20 by adustman (MySQLdb-0.1.2.tar.gz)

Now how should anybody new to Zope know what to use? Especially when 
ZMySQLDA goes up to at least version 2.0.0 (I tried to look it up but 
couldn't connect to starship.python.net) and MySQLdb at least to 
version 0.2.1. I'm still using ZMySQLDA 1.1.3 with MySQLdb 0.1.3 
which can't be found in the download section.

Confusing, isn't it? What could we possibly do about it?

Ragnar

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Re: [Zope-dev] Problems with offline MS IE 5

2000-10-20 Thread Jens Grewen

I was fighting with the same problem and I thought it depends on my proxy
setting. But now I thing it depends on the Browser version because I
installed IE5.5 and the problem was gone. (ocularly same settings).


- Original Message -
From: "Ross Boylan" [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, October 20, 2000 8:09 AM
Subject: [Zope-dev] Problems with offline MS IE 5


 I recently tried doing some Zope development on a laptop and ran into a
 problem: when I updated a product the updates did not "take."  In
 particular, when I edited the text in a .dtml file and restarted Zope, I
 still saw the old text  when I got to the appropriate point (the file was
 wrapped in an HTMLFile() and used for creating a new instance of one of
the
 products in the package).

 I think I checked all of the following:
 * the file was getting updated
 * all instances of explorer were shut down
 * MSIE options set to "Check for newer version of stored page on every
 visit to the page"

 A notable peculiarity was that whenever I tried to access my local zope, I
 would get a "you are offline, do you wish to go online" message (I even
 used localhost as the machine name!).  I would say yes, it would say it
 couldn't connect and ask if I wanted to try again.  I said yes, but then I
 ran into the problems described above.

 Zope 2.2.2 on MS W2K with MS IE 5.0.

 Does this ring any bells with anyone?  Is it an IE problem?  a Zope
 problem?  an interaction?


 ___
 Zope-Dev maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope-dev
 **  No cross posts or HTML encoding!  **
 (Related lists -
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope )



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] IIS and Zope share same problem :-S

2000-10-20 Thread Ragnar Beer

As I already suggested ages ;) ago (and still didn't put into 
practice) it would here again be best to deny everything that isn't 
explicitly allowed (e.g. allow whatever ends with _html or .html and 
deny everything else) but then I would have to go over the whole 
website and make bazillions of changes ...

I fixed the problem temporarily by adding some 
"FilesMatch/LocationMatch + deny from all" in my httpd.conf. But what 
else do I have to deny apart from objectIds?

Ragnar

Andrew Kenneth Milton wrote:

  |
  | http://www.zope.org/standard_html_header for example ;-)

  Not that old chestnut again...

Yes, that old chestnut again. If it's considered a serious security flaw
by Microsoft, maybe the Zope community should finally do something to
solve it.

...and yes, there are discussions about this on Zope-dev right now,
which will hopefully produce a solution :-)

cheers,

Chris

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists -
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope-dev )


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Problems with mysql and sql methode

2000-10-20 Thread Jens Grewen



Hi,

I have a problem with an SQL Methode with the this 
sql statement


select PAYMENT.PYNAME, PAYMENT.PYPRICEfrom 
MERCHANTPAYMENT, PAYMENTwhere MERCHANTPAYMENT.MEID = 418 and 
MERCHANTPAYMENT.PYID = PAYMENT.PYID

on the following tables:


MERCHANTPAYMENT
-
MPID int(30)
MEID int(30)
PYID int(30)
-

PAYMENT
-
PYID int(30)
PYNAME varchar(50)
PYPRICE varchar(50)
-

the statement runs under MS ACCESS (link over 
myODBC) and I get the correct resut but under zope sql methode I get no result. 
(There was no data 
matching)

Any ideas

Jens Grewen



RE: [Zope] dtml-sqlvar quote

2000-10-20 Thread Farrell, Troy

It is not safe if you have malicious users.  You will need to pass your
dtml-var name="search_field" through a filter.  This will help.  A better
example is a user taking advantage of an insert method:

insert into data values (dtml-var name="value_1", dtml-var
name="value_2", dtml-var name="value_3")

where the user has found the Zsqlmethod by looking at
http://yourzopehost/objectIds and calls it like this:
http://yourzopehost/sqlADDUSER?value_3=randomvalue);SELECT%20*%20FROM%20secr
etpasswordtable/
Fortunately, Zope responds with a "testing the sql method" form if you are
authorized.

Troy

-Original Message-
From: Mark Twiddy [mailto:[EMAIL PROTECTED]]
Sent: Friday, October 20, 2000 3:22 AM
To: [EMAIL PROTECTED]
Subject: Re: [Zope] dtml-sqlvar quote



Hi all thanks for the help.

Just on that. Is it safe to do 

select * from data where dtml-var
search_field like '%dtml-var search_term

as search_term could contain  '; drop table blah; ' or what ever.
I thought by using dtml-sqlvar  you could use untrusted values.

Thanks again

Mark

On Fri, 20 Oct 2000, Tony McDonald wrote:

 
 Hi all
 
 How can i pass a string to a sql method that won't be quoted.
 
 i.e so i can do somthing like this
 
 .
 group by foo,blah
 order by dtml-sqlvar spam
 
 
 thanks mark
  
 
 don't quote it?
 
 ...
 order by dtml-var spam
 
 
 I use this all the time for things like
 
 select * from data where dtml-var search_field like '%dtml-var
search_term%'
 
 tone
 
 
 ___
 Zope maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope
 **   No cross posts or HTML encoding!  **
 (Related lists - 
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope-dev )
 


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Recursively creating folders in python

2000-10-20 Thread Robert Joseph Roos

This is something I need to have done yesterday...

dtml-in iterates over a list, and dtml-with adds namespaces,
 but how do I recursively enter
INTO a folder, creating objects within that folder from *it's*
point of view?  Is this even possible in dtml, or do i need to use
raw python?

If so, do you have any hints about doing it in python?




=Rob==
J=
=Roos=


And more and more, as I see all these prisons going up,
and everybody being sent off to prison, with three strikes
and so on, they are preparing, really, for a showdown with
the American people. They're already talking about using 
for minor drug offenders the old Army camps that are being 
shut down. To pen them in. More animal farming. The animals
are going to turn one day and bite. And even now, perhaps, 
as we are chatting, there is some young boy or girl who will
grow up and overthrow this government. Because it has 
overthrown our old republic; it seems to be doing its
best to overthrow our Bill of Rights and the Constitution ...

-Gore Vidal, novelist, essayist, and cousin of Al Gore
 1996 interview on "We the People" with Jerry Brown
 www.wtp.org/radio/transcripts/tr960708.html


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] How to type check OR better list selector ways

2000-10-20 Thread Robert Joseph Roos

dtml-expr="_.type(some_variable_of_unknown_type)" 

causes a name error, while other python builtins
like _.string(some_int) work fine.  What gives?
Is there some other "zopist" way to type-check?

More generally, is there a better way to deal with the annoying
fact that multiple selectors return a list UNLESS there are
=1 items selected, in which case they return a single item or None?

(rather than a list with only one member, in the case of 1 object
selected, or an empty list, in the case of none,
which would SEEM to be the consistant way to do things,
since dtml-in wouldn't choke.)

=Rob==
J=
=Roos=


And more and more, as I see all these prisons going up,
and everybody being sent off to prison, with three strikes
and so on, they are preparing, really, for a showdown with
the American people. They're already talking about using 
for minor drug offenders the old Army camps that are being 
shut down. To pen them in. More animal farming. The animals
are going to turn one day and bite. And even now, perhaps, 
as we are chatting, there is some young boy or girl who will
grow up and overthrow this government. Because it has 
overthrown our old republic; it seems to be doing its
best to overthrow our Bill of Rights and the Constitution ...

-Gore Vidal, novelist, essayist, and cousin of Al Gore
 1996 interview on "We the People" with Jerry Brown
 www.wtp.org/radio/transcripts/tr960708.html


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] unauthorized error

2000-10-20 Thread Kevin Worth

Upon upgrading from 2.1.3 to 2.2.2, I have run into a strange problem.

I have a couple of custom products (developed here, but not by me, so 
I'm not sure of the specifics, but i can find them out.

I can edit current instances of the product, but I cannot add new 
ones because give me an unauthorized error.  No matter what 
username/password I provide, it fails.  I import these from my 
previous installation (the 2.1.3 version)  I assume this has to do 
with the change in the way security is handled in zope 2.2.x, but I 
haven't figured out how to fix it.

A traceback looks like this:

Traceback (innermost last):
   File H:\MSEWEB~1\lib\python\ZPublisher\Publish.py, line 222, in 
publish_module
   File H:\MSEWEB~1\lib\python\ZPublisher\Publish.py, line 187, in publish
   File H:\MSEWEB~1\lib\python\ZPublisher\Publish.py, line 171, in publish
   File H:\MSEWEB~1\lib\python\ZPublisher\mapply.py, line 160, in mapply
 (Object: index_html)
   File H:\MSEWEB~1\lib\python\ZPublisher\Publish.py, line 112, in call_object
 (Object: index_html)
   File H:\MSEWEB~1\lib\python\App\Factory.py, line 178, in index_html
 (Object: RoleManager)
   File H:\MSEWEB~1\lib\python\OFS\DTMLMethod.py, line 172, in __call__
 (Object: Procedure_addForm)
   File H:\MSEWEB~1\lib\python\DocumentTemplate\DT_String.py, line 
528, in __call__
 (Object: Procedure_addForm)
   File H:\MSEWEB~1\lib\python\OFS\DTMLMethod.py, line 168, in __call__
 (Object: standard_html_header)
   File H:\MSEWEB~1\lib\python\DocumentTemplate\DT_String.py, line 
528, in __call__
 (Object: standard_html_header)
   File H:\MSEWEB~1\lib\python\OFS\DTMLMethod.py, line 168, in __call__
 (Object: breadcrumbs)
   File H:\MSEWEB~1\lib\python\DocumentTemplate\DT_String.py, line 
528, in __call__
 (Object: breadcrumbs)
   File H:\MSEWEB~1\lib\python\DocumentTemplate\DT_In.py, line 691, in renderwob
 (Object: rev)
   File H:\MSEWEB~1\lib\python\DocumentTemplate\DT_With.py, line 146, in render
 (Object: sequence-item)
   File H:\MSEWEB~1\lib\python\OFS\DTMLMethod.py, line 194, in validate
 (Object: Procedure_addForm)
   File H:\MSEWEB~1\lib\python\AccessControl\SecurityManager.py, line 
139, in validate
   File H:\MSEWEB~1\lib\python\AccessControl\ZopeSecurityPolicy.py, 
line 159, in validate
Unauthorized: id

Any help would be appreciated.
-- 
---
Kevin Worth [EMAIL PROTECTED]
Computer Systems Specialist II and Adjunct Lecturer
Department of Materials Science and Engineering
University of Michigan 

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] dtml document bug

2000-10-20 Thread Dmitry Slusarchuk

I'm new to Zope development but I have already encountered such a problem:
dtml-var myimage from dtml document generates the following:
Zope Error
Zope has encountered an error while publishing this resource. 

Error Type: AttributeError
Error Value: __call__

this problem disappears when I do smth like dtml-var myimage
from dtml method. what should I do?

In addition 
I run Zope ver. 2.2.2 and Python 1.5.2 under Win98.

Thanks to ev'body for a HELP!

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Server Access Control

2000-10-20 Thread Haonan Tan


How to enforce access control on client IP or host name in the 
same way that Apache .htaccess does it. Or are there better ways
doing it in Zope? Many thanx.

Haonan Tan

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




RE: [Zope] dtml-in loop to capture records

2000-10-20 Thread Richard Folwell

 Okay, this works fine, in MOST of my forms, but I have other forms where
 this doesnt work at all and I get errors saying that the ITEM is a bad
 request. I dont get it, what am I missing here that this works some
 places and in other places with almost identical syntax, it falls over.

I came across this error today.  (The problem may not be the same.)  In our
case it occurred because the SQL, whilst well-formed and valid, violated a
database constraint - was trying to put zero length strings into fields of a
table where this was not allowed.

The problem was tracked down by firstly displaying the request data using:

dtml-var REQUEST

then trying to input the same data manually.

HTH,

Richard


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




RE: [Zope] Problems with mysql and sql methode

2000-10-20 Thread Farrell, Troy

You may try:

SELECT pyname, pyprice
FROM payment
WHERE merchantpayment.meid = 418 AND merchantpayment.pyid = payment.pyid

I have a feeling mysql is not liking you for not selecting results from
table MERCHANTPAYMENT becuase you said you would.

Troy

-Original Message-
From: Jens Grewen [mailto:[EMAIL PROTECTED]]
Sent: Friday, October 20, 2000 11:04 AM
To: Zope Maillist
Subject: [Zope] Problems with mysql and sql methode


Hi,
 
I have a problem with an SQL Methode with the this sql statement
 
select PAYMENT.PYNAME, PAYMENT.PYPRICE
from MERCHANTPAYMENT, PAYMENT
where MERCHANTPAYMENT.MEID = 418 and MERCHANTPAYMENT.PYID = PAYMENT.PYID
 
on the following tables:
 
 
MERCHANTPAYMENT
-
MPID int(30)
MEID int(30)
PYID int(30)
-
 
PAYMENT
-
PYID int(30)
PYNAME varchar(50)
PYPRICE varchar(50)
-
 
the statement runs under MS ACCESS (link over myODBC) and I get the correct
resut but under zope sql methode I get no result. (There was no data
matching)
 
Any ideas
 
Jens Grewen
 

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] How to type check OR better list selector ways

2000-10-20 Thread Jim Washington

Hi, Robert

BTW, this is a FAQ, but:

use the :list extension in your html.

e.g.,

select multiple name="dtml-var form_save_name:list"
dtml-in thelistitems
  option value="dtml-var sequence-item"dtml-var
sequence-item/option
/dtml-in
/select

Works for checkboxes, too!

-- Jim Washington

Robert Joseph Roos wrote:
 
 dtml-expr="_.type(some_variable_of_unknown_type)"
 
 causes a name error, while other python builtins
 like _.string(some_int) work fine.  What gives?
 Is there some other "zopist" way to type-check?
 
 More generally, is there a better way to deal with the annoying
 fact that multiple selectors return a list UNLESS there are
 =1 items selected, in which case they return a single item or None?
 
 (rather than a list with only one member, in the case of 1 object
 selected, or an empty list, in the case of none,
 which would SEEM to be the consistant way to do things,
 since dtml-in wouldn't choke.)

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] O'Reilly Book Tecnical Reviewers

2000-10-20 Thread Michel Pelletier

Greetings,

O'Reilly is looking for 4 or 5 technical reviewers for the book.

http://www.zope.org/Members/michel/ZB/

Technical reviewers get paid either a small honorarium or get free
copies of the book (I am unaware of the exact details).

I'm sure this message will elicit a *flood* of candidates, and I'm
afraid we can't accept them all (of course, that doesn't mean you can't
do it for free ;).  Further, this will be a time consuming task,
requiring you to scrutinize all details, try examples, etc.  You will
probably give more effort than you are monitarily compensated with, but
you will also get unending glory and mucho zen master points from your
zopista peers.

So please consider this opertunity to work directly with us to make a
great book.  If you are interested in the sweat and the glory, please
send an email to [EMAIL PROTECTED] with the subject "I Wanna Be A
Technical Reviewer", and maybe a brief bio about you, your Zope
experience and (bonus points) if you've every technically reviewed a
book before.

Thanks!

-Michel

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] Problems with mysql and sql methode

2000-10-20 Thread Jens Grewen

Ok know I get this problem
Error, _mysql.OperationalError: (1109, "Unknown table 'MERCHANTPAYMENT' in
where clause")


SQL used:

select PYNAME, PYPRICE
from PAYMENT
where MERCHANTPAYMENT.MEID = '418' and MERCHANTPAYMENT.PYID = PYID

other ideas?

Thanks

Jens Grewen

- Original Message -
From: "Farrell, Troy" [EMAIL PROTECTED]
To: "'Jens Grewen'" [EMAIL PROTECTED]; "Zope Maillist" [EMAIL PROTECTED]
Sent: Friday, October 20, 2000 10:04 PM
Subject: RE: [Zope] Problems with mysql and sql methode


 You may try:

 SELECT pyname, pyprice
 FROM payment
 WHERE merchantpayment.meid = 418 AND merchantpayment.pyid = payment.pyid

 I have a feeling mysql is not liking you for not selecting results from
 table MERCHANTPAYMENT becuase you said you would.

 Troy

 -Original Message-
 From: Jens Grewen [mailto:[EMAIL PROTECTED]]
 Sent: Friday, October 20, 2000 11:04 AM
 To: Zope Maillist
 Subject: [Zope] Problems with mysql and sql methode


 Hi,

 I have a problem with an SQL Methode with the this sql statement

 select PAYMENT.PYNAME, PAYMENT.PYPRICE
 from MERCHANTPAYMENT, PAYMENT
 where MERCHANTPAYMENT.MEID = 418 and MERCHANTPAYMENT.PYID = PAYMENT.PYID

 on the following tables:


 MERCHANTPAYMENT
 -
 MPID int(30)
 MEID int(30)
 PYID int(30)
 -

 PAYMENT
 -
 PYID int(30)
 PYNAME varchar(50)
 PYPRICE varchar(50)
 -

 the statement runs under MS ACCESS (link over myODBC) and I get the
correct
 resut but under zope sql methode I get no result. (There was no data
 matching)

 Any ideas

 Jens Grewen


 ___
 Zope maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope
 **   No cross posts or HTML encoding!  **
 (Related lists -
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope-dev )



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Acquisitive

2000-10-20 Thread Spicklemire, Jerry

Hi Zope Fans,

I ran into an odd quirk today, and I'm hoping someone has
an insight to share. There is a simple text string stored 
as a DTML Method, with ID = "set_table_0", e.g.:

'border="0" cellpadding="0" cellspacing="0"'

When set_table_0 is in the Zope root folder, it isn't 
discovered through normal acquisition, but no error occurs.

table dtml-set_table_0;

creates a table with defaults, e.g. border is visible.

However, when set_table_0 is moved to a subfolder of the Zope 
root folder, with the name "table_settings", and the reference 
is made like so:

table %dtml-table_settings[set_table_0];

the DTML Method is found successfully, and the table border 
isn't displayed.

The question is, why is the folder "table_settings" found in 
the Zope Root Folder, but not the method? 

Does Acquisition give higher preference to folders (container), 
objects than a DTML Method?

Thanks,
Jerry S.



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] Acquisitiver and Acquisitiver

2000-10-20 Thread Spicklemire, Jerry

OK, now I'm really confused. I stumbled on a way to make 
the DTML Method work, that is, the one that wasn't being 
found before, via Acquisition. All I have to do is forget 
to add the terminating ';' in :

table dtml-set_table_0;

so that it looks like so:

table dtml-set_table_0

Any guesses?

Thanks again,
Jerry S.


___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




[Zope] GUF error: Unauthorized...

2000-10-20 Thread Cesar A. K. Grossmann

Hi!

I have created a GUFTest folder. It runs perfectly with the user
'jorge', provided with the GUF. After I have changed the acl to use a
SQL connection, I'm getting the error bellow (in the log of the system):

GUF[7909]:
http://localhost.localdomain:8080/GUFTest/acl_users/userAuthenticate
raised an exception (('Unauthorized', 'crypt', traceback object at
85f10e8))

The source of the HTML page contains (I don't know if it's correct,
because I suspect that Netscape reloads the page when you ask it to show
the source of the page):

!--
Traceback (innermost last):
  File /usr/lib/python1.5/site-packages/ZPublisher/Publish.py, line 222,
in publish_module
  File /usr/lib/python1.5/site-packages/ZPublisher/Publish.py, line 187,
in publish
  File /usr/share/zope/lib/python/Zope/__init__.py, line 221, in
zpublisher_exception_hook
(Object: Traversable)
  File /usr/lib/python1.5/site-packages/ZPublisher/Publish.py, line 162,
in publish
  File /usr/lib/python1.5/site-packages/ZPublisher/BaseRequest.py, line
456, in traverse
  File
/usr/share/zope/lib/python/Products/GenericUserFolder/GenericUserFolder.py,
line 442, in guf_unauthorized
(Object: Traversable)
LoginRequired: (see above)

--

What is wrong?

I have created a local role called 'Usuario'. This role have the rights
to:

/GUFTest:
Access contents information
Can Login an Logout
Use database methods
View

/GUFTest/acl_users:
Access contents information
Can Login an Logout
Use database methods
View

The Anonymous role have the rights:
/GUFTest:
_no_roles_

/GUFTest/acl_users:
Access contents information
Can Login and Logout

The userAuthenticate, userDomains, userList, adn userRoles DTML Methods
are configurated to proxy the Manager role.

I'm using Zope 2.2.1, on a Conectiva Linux 5.0 (Linux i386 2.2.14,
python 1.5.2, glibc 2.1.3).

TIA
-- 
 +-+-+
 | César A. K. Grossmann   | Capacitação Solidária   |
 | [EMAIL PROTECTED]| http://www.uol.com.br/umminuto/ |
 | http://members.xoom.com/ckant/  | Clique e doe - é de graça   |
 +-+-+
   http://www.halcyon.com/sciclub/cgi-pvt/instr/instr.html
The ideas of economists and political philosophers, both when they
are right and when they are wrong, are more powerful than is generally
understood.  Indeed, the world is ruled by little else.
-- John Maynard Keyes

___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )




Re: [Zope] IIS and PCGI

2000-10-20 Thread Andy McKay

Well I fixed this using a ISAPI filter which I will release soon (once I
have some time) that takes a url /a/b/c/x.pcgi/f/g/h, and passes
/a/b/c/x.pcgi to IIS so the file will run and /f/g/h to Zope.

My next question is has anyone succeeded in getting this to work to another
box over a mapped or shared win32 drive?

I mapped g:\ to my zope host, and then specified
PCGI_PUBLISHER=g:\pcgi\pcgi_publisher.py in my pcgi file. The problem seems
to pcgi-wrapper.exe which does not like a mapped drive. (line 485 of
parseinfo.c keeps spitting out missing publisher)...

Thanks in advance and apologies for the cross post to zope-dev but it is
more of a zope-dev question.

- Original Message -
From: "Andy McKay" [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, October 17, 2000 1:33 PM
Subject: [Zope] IIS and PCGI


 Im fiddling with IIS and PCGI, I've looked at
 (http://www.zope.org/Members/brianh/iis_howto) the docs and got the server
 to work correctly in that http://127.0.0.1/zope.pcgi is the same as
 http://127.0.0.1:8080/

 However it doesnt seem to be carrying through the trailing path info (or /
 's) for example
 http://127.0.0.1/zope.pcgi/manage brings up 404. Using IIS 5.0, Win2k,
Zope
 2.2.1.

 Anyone encountered this and know the solution?

 Thanks.
 --
   Andy McKay, Developer.
   ActiveState.


 ___
 Zope maillist  -  [EMAIL PROTECTED]
 http://lists.zope.org/mailman/listinfo/zope
 **   No cross posts or HTML encoding!  **
 (Related lists -
  http://lists.zope.org/mailman/listinfo/zope-announce
  http://lists.zope.org/mailman/listinfo/zope-dev )



___
Zope maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope-dev )