Re: [Zope-dev] [announce] for the CVS junkies: multiple ZODB mounting product.

2000-06-01 Thread Anthony Baxter


 Shane Hathaway wrote
 You did better than you think, Anthony.  I was going to release the
 product I've been putting together, but your little product does
 virtually the same thing.  Good work!

Lucky guessing, and trawling CVS. :)

 There is, however, a major security problem with making it so easy to
 mount a FileStorage.  In my product, per Jim's suggestion I set it up
 so that the user is required to create an External Method in order to
 mount a database.  That actually makes things a little more flexible in
 that it provides you the ability to mount things other than
 FileStorages.

I'm curious - could you elaborate on the security issues of this? The 
convenience of not having to write an External Method each time you 
want to mount or unmount a ZODB is high. :)

 There are still some issues with mounted databases.  The primary issue
 is that they interact strangely with ZClasses.  However, if you have
 the same ZClass defined in both the primary database and the mounted
 database, ZClasses seem to work fine.  (I wouldn't bet my company on
 it, though.)

Yah, I've been thinking a bit about that, and it's not at all obvious
how it should work. In my case, I want to be able to mount something like
/partners/partnerA
  partnerB
  partnerC
with each partner object a different ZODB. Unfortunately, the current
implementation uses ZClasses in each one. So if I upgrade any one, I
have to upgrade all of them. (and then we're back to the old 'how do
you upgrade ZClasses' issue, which, unless I'm mistaken, has never 
really been resolved).

 The other issues are that you can't easily undo nor manage mounted
 databases.  That is more of a UI problem which could be solved by
 product authors, however.  I envision a product that would create a
 "mounted database manager" object.  Inside the database manager you
 could add as many mount points as you want.  The database manager
 object is where you would go to pack any of the mounted databases.

Yeah - the mount points are entirely invisible. One thing I'd considered
doing was to make the Product provide a registry of mount points and their
underlying FileStorages. 

 ... And please report any problems which you may think are being caused
 by the mount.  http://www.zope.org/Wikis is a mounted database and it's
 running fine, but YMMV.

It is? Okay, that makes me feel better.

A couple of issues I'd like clarification on: 

Any mounted filestorage is searched for an object called 'Application'. 
I'm assuming it will also want things like Control_Panel c as well. What's
the bare minimum a new mounted FS needs? Right now, I'm copying Data.fs.in
and blowing away the stuff in it, but nuking it's standard_html_blah is
a bit more problematic. Would it be worth making a 'create new empty
ZODB FS' function?

If you try to mount /Control_Panel/Products from a mounted ZODB, you get
an 'Attribute Error: _owner'. I'm assuming the Control Panel is special
cased by the ownership code when it's the main ZODB.

How does this work with the Owner mods in recent CVS? If I remember 
correctly, objects keep a reference to their Owner - won't this break
across ZODBs?

thanks,
Anthony


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] [announce] for the CVS junkies: multiple ZODB mounting product.

2000-06-01 Thread Shane Hathaway

Anthony Baxter wrote:
 I'm curious - could you elaborate on the security issues of this? The
 convenience of not having to write an External Method each time you
 want to mount or unmount a ZODB is high. :)

Okay, I looked a little more and I see you're not allowing slashes in
the filename.  That's a decent solution.  Don't forget backslashes (for
MS Windows).  You may want to create mounted databases in a directory
other than /var, since there may be other sensitive files there.

If you're using more than one acl_users folder, remember that the
Manager role, regardless of user context, will give users the right to
use your product in their own directory.

One small change you should make: call the MountPoint._test() method
right after creating the new mount point.  It will ensure any mount
exceptions are propagated up correctly.

  There are still some issues with mounted databases.  The primary issue
  is that they interact strangely with ZClasses.  However, if you have
  the same ZClass defined in both the primary database and the mounted
  database, ZClasses seem to work fine.  (I wouldn't bet my company on
  it, though.)
 
 Yah, I've been thinking a bit about that, and it's not at all obvious
 how it should work. In my case, I want to be able to mount something like
 /partners/partnerA
   partnerB
   partnerC
 with each partner object a different ZODB. Unfortunately, the current
 implementation uses ZClasses in each one. So if I upgrade any one, I
 have to upgrade all of them. (and then we're back to the old 'how do
 you upgrade ZClasses' issue, which, unless I'm mistaken, has never
 really been resolved).

AFAIK you can just delete or rename a product and install the new
version of a set of ZClasses.

  The other issues are that you can't easily undo nor manage mounted
  databases.  That is more of a UI problem which could be solved by
  product authors, however.  I envision a product that would create a
  "mounted database manager" object.  Inside the database manager you
  could add as many mount points as you want.  The database manager
  object is where you would go to pack any of the mounted databases.
 
 Yeah - the mount points are entirely invisible. One thing I'd considered
 doing was to make the Product provide a registry of mount points and their
 underlying FileStorages.

ZODB/Mount.py already provides such a registry, so you may want to use
that, although it applies to *all* mount points rather than some kind
of subset.

 A couple of issues I'd like clarification on:
 
 Any mounted filestorage is searched for an object called 'Application'.
 I'm assuming it will also want things like Control_Panel c as well. What's
 the bare minimum a new mounted FS needs? Right now, I'm copying Data.fs.in
 and blowing away the stuff in it, but nuking it's standard_html_blah is
 a bit more problematic. Would it be worth making a 'create new empty
 ZODB FS' function?

Actually FileStorage provides a nifty trick: you can just name a
database file and if it doesn't exist it will be created.  That could
be a security problem.  Or it might just be a good feature.  It will be
created with the "true" bare minimum, which doesn't even have an
Application object

The id of the MountPoint and the last item of the mounted path must
match for a subtle reason.  When ObjectManager looks up the object, it
uses the ID of the mount point.  The object it finds is assumed to have
the correct ID.  If there is no assurance of that, mounted databases
could cause some confusion for OFS.

One possibility you may consider is allowing the user to create a
FileStorage on the fly.  You can do one of two things: override
_getMountRoot(), which is a hook I provided for the very purpose of
accessing databases that have no Application object, or manually create
an Application object in the new database.  Either way, you must ensure
that the ID of the mounted object is the same as the ID of the mount
point.

 If you try to mount /Control_Panel/Products from a mounted ZODB, you get
 an 'Attribute Error: _owner'. I'm assuming the Control Panel is special
 cased by the ownership code when it's the main ZODB.

 How does this work with the Owner mods in recent CVS? If I remember
 correctly, objects keep a reference to their Owner - won't this break
 across ZODBs?

Hmm... I don't see why you would want to mount the Control_Panel,
except to fiddle with ZClasses.  I would suggest finding a way to get
ZClasses to operate more naturally might be a better approach.

Shane

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] [announce] for the CVS junkies: multiple ZODB mounting product.

2000-06-01 Thread Anthony Baxter


 Shane Hathaway wrote
 Okay, I looked a little more and I see you're not allowing slashes in
 the filename.  That's a decent solution.  Don't forget backslashes (for
 MS Windows).

Bah. Silly backwards operating system. Ok dokey.  

 You may want to create mounted databases in a directory
 other than /var, since there may be other sensitive files there.

I thought about that, then thought 'that can wait for another day'. 
This is muchmuch simpler to implement.

 If you're using more than one acl_users folder, remember that the
 Manager role, regardless of user context, will give users the right to
 use your product in their own directory.

Hm - it's not possible for a Manager in a higher level to remove
privileges from a manager defined in a subfolder, I think. A pity.
Will document it.

 One small change you should make: call the MountPoint._test() method
 right after creating the new mount point.  It will ensure any mount
 exceptions are propagated up correctly.

Ok dokey. I've just made a change to my code for both of these, 


  with each partner object a different ZODB. Unfortunately, the current
  implementation uses ZClasses in each one. So if I upgrade any one, I
  have to upgrade all of them. (and then we're back to the old 'how do
  you upgrade ZClasses' issue, which, unless I'm mistaken, has never
  really been resolved).
 
 AFAIK you can just delete or rename a product and install the new
 version of a set of ZClasses.

So long as the classid stays the same. There's also a scaling issue - if
I have dozens of objects, this will be bad. I've got a solution for this
case - the stuff that goes into the sub-ZODB will be redone to only use
python-created objects.


 ZODB/Mount.py already provides such a registry, so you may want to use
 that, although it applies to *all* mount points rather than some kind
 of subset.

Yeah, I was going to try and hook a mounted databases tab into the Control
Panel. Zope gets an /etc/mtab :)

 Actually FileStorage provides a nifty trick: you can just name a
 database file and if it doesn't exist it will be created.  That could
 be a security problem.  Or it might just be a good feature.  It will be
 created with the "true" bare minimum, which doesn't even have an
 Application object

Yep, I discovered that. Since it breaks without an Application, 
and it might be a security problem, I just disabled it - the file 
must exist first. 


 The id of the MountPoint and the last item of the mounted path must
 match for a subtle reason.  When ObjectManager looks up the object, it
 uses the ID of the mount point.  The object it finds is assumed to have
 the correct ID.  If there is no assurance of that, mounted databases
 could cause some confusion for OFS.

I also hit this. Much confusion on the part of poor little Zope. The code
now will only let you specify an 'id' if you're mounting the root of a ZODB
(since the default ZODB doesn't have an id on it's root object.) This may 
not be the right thing to do, but I couldn't figure out an appropriate way
to do it otherwise.

Hm, maybe a small script in utilities that will create a real bare minimum
ZODB with an Application and a Control_Panel c. might be the go here.

 One possibility you may consider is allowing the user to create a
 FileStorage on the fly.  You can do one of two things: override
 _getMountRoot(), which is a hook I provided for the very purpose of
 accessing databases that have no Application object, or manually create
 an Application object in the new database.  Either way, you must ensure
 that the ID of the mounted object is the same as the ID of the mount
 point.

I think I'm going to need to revisit the code tomorrow morning and write
the little 'ZODB maker'.
 
 Hmm... I don't see why you would want to mount the Control_Panel,
 except to fiddle with ZClasses.  I would suggest finding a way to get
 ZClasses to operate more naturally might be a better approach.

Yep, you figured out what I was doing - it was more a matter of 'should
it work this way?'
-- 
Anthony Baxter [EMAIL PROTECTED]   
It's never too late to have a happy childhood.


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Zope 2.1.6: Test.py problem with patch

2000-06-01 Thread Dieter Maurer

Problem:
Description:
  If a DTML method is accessed with "ZPublisher/Test.py",
  an "Unauthorized" exception is raised in "verify_watermark".
 
Environment:
  Zope 2.1.6, Linux 2, Intel

Analysis:
  The module "BaseRequest" is imported twice: once as "BaseRequest"
  and once as "ZPublisher.BaseRequest".
  The AUTHENTICATED_USER (and its watermark) is constructed by
  the first module instance; the check is made against
  the watermark of the second module instance and therefore
  fails.

Patch:
  URL:http://www.handshake.de/~dieter/pyprojects/zope/test.pat


Dieter

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] BerkeleyStorage with ZODB problem

2000-06-01 Thread nw_moriarty

I'm developing a large program and think that ZODB with BerkeleyStorage is the best 
option.  I had a python test program working using FileStorage that worked.  I 
substituted BerkeleyStorage and it fails thus:

Traceback (innermost last):
  File "btest.py", line 118, in ?
mydb = Database()
  File "btest.py", line 22, in __init__
self.db = DB(SleepyStorage(file))
  File "/usr/local/dc/zope/lib/python/ZODB/BerkeleyStorage.py", line 107, in __init__
self._index.open(name, db.DB_BTREE, db.DB_CREATE | dothread)
  File "/usr/lib/python3rd/TCS/bsddb/db.py", line 639, in open
val = apply(dbc.DB_open,(self.this,arg0,)+args)
db.error: (22, 'Invalid argument')

Has any got a working example of BerkeleyStorage that works!

Nigel


--== Sent via Deja.com http://www.deja.com/ ==--
Before you buy.

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




[Zope-dev] Zope 2.1.6: ZCatalog's Reindex unintuitive?

2000-06-01 Thread Dieter Maurer

ZCatalog's "manage_catalogReindex" rebuilds the indexes for currently
cataloged objects. Object which do no longer exist are removed.
However, new objects in the catalog's "search space" are not added.

This has the advantages, that 
 1. the catalog can be filled with several finds
 2. cataloged objects can be manually managed (removed).

However, it does not support well a common use: provide search
facilities for part of a WebSite. For this use, new pages, too,
would have to be found and indexed.

I know, of cause, that a DMTL method could do this job.
However, a general method "manage_catalogRefind" might be
generally useful. It would remember the parameters for
the last find operation and reapply the find.

What do you think?


Dieter


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] What causes the failure

2000-06-01 Thread Timothy Grant

Robin Becker wrote:

 Zope Error
 
 Zope has encountered an error while publishing this resource.
 
 Error Type: SuperCannotOwn
 Error Value: Objects cannot be owned by the superuser

I just installed the 2.2a release and I get the same error when trying
to import my exported site.

Have you discovered a resolution?

Thanks.

-- 
Stand Fast,
tjg.

Timothy Grant [EMAIL PROTECTED]
Chief Technology Officer  www.exceptionalminds.com
Red Hat Certified Engineer  (503) 246-3630
Avalon Technology Group, Inc.  fax  (503) 246-3124
Linux...Because rebooting isn't normal

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )




Re: [Zope-dev] Zope 2.1.6: ZCatalog's Reindex unintuitive?

2000-06-01 Thread Kevin Dangoor

- Original Message -
From: "Dieter Maurer" [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, June 01, 2000 5:31 AM
Subject: [Zope-dev] Zope 2.1.6: ZCatalog's Reindex unintuitive?


 I know, of cause, that a DMTL method could do this job.
 However, a general method "manage_catalogRefind" might be
 generally useful. It would remember the parameters for
 the last find operation and reapply the find.

I like the other solutions that exist/are coming into existence/are
proposed. They are:

1) CatalogAwareness for ZClasses. I like this one least, but it exists
today. Your custom ZClasses can just subclass CatalogAware and they will
automatically add themselves to the catalog when they are created and remove
themselves when they are deleted. Drawbacks: it's a pain to catalog them to
anything but something called "Catalog", and it only works for your custom
objects.

2) ZPatterns 0.4 (http://www.zope.org/Members/pje/Wikis/ZPatterns/HomePage):
This allows you to create objects that use DataSkins to determine how they
are stored. Additionally, you can set up methods that get called for adds
and deletes, so you can automatically catalog things however you would
like... plus, you can set that up on a folder by folder basis. Drawbacks:
not available yet, only works for your custom objects.

3) ObserverAndNotification Interface
(http://www.zope.org/Members/michel/Projects/Interfaces/ObserverAndNotificat
ion): Objects can be notified of events. This is a very generic interface
and should allow for all sorts of stuff. Drawbacks: I don't know if any work
has been done on implementation (work is still going on on the interfaces, I
think), and I don't know if you'll be able to create an observer that
automatically catalogs objects like DTML Methods even though the DTML Method
has no knowledge of the observer. I kind of get the feeling that you'll be
able to do such things...

I like all of these solutions, because they are automatic. Having a
catalogRefind implies that someone needs to actively do something to make
the catalog get updated...

Kevin



___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )