Re: [Zope-dev] Xron and security

2000-08-22 Thread Loren Stafford
Thanks, Steve. I have few questions below 8-) (I'm always better with questions than answers.) -- Loren From: "Steve Alexander" <[EMAIL PROTECTED]> > Hi Loren, > > > I'd be glad to listen to well considered proposals for how Xron should > > handle security. > > Consider this a "straw man".

[Zope-dev] Xron and security

2000-08-22 Thread Steve Alexander
Hi Loren, > I'd be glad to listen to well considered proposals for how Xron should > handle security. Consider this a "straw man". On installation, Xron creates a user in the root user folder called "XronUser". Xron is resonsible for setting this user's password. Therefore, it is known to bot

[Zope-dev] Racks and export/import.....

2000-08-22 Thread Steve Spicklemire
Hi Folks, Is there any reason why a Rack shouldn't be 'exportable'? I have a Rack of objects, but when I export/import (as a .zexp) and then call "getItem" I'm getting: Zope Error Zope has encountered an error while publishing this resource. Error Type: AttributeError Er

[Zope-dev] Bug in careful_getattr()?

2000-08-22 Thread Jeff Hoffman
Hello, I have been fighting a problem with PythonMethods/ZClasses. I have a ZClass, MyTestClass, which has four methods: method1 (DTML Method) method2 (DTML Method) showMethods (DTML Method) showMethods2 (PythonMethod) showMethods is defined as: method1 = method2 = nullme

[Zope-dev] Porting EMarket to ZPatterns....

2000-08-22 Thread Steve Spicklemire
Well.. I've started down the long winding road of porting EMarket to ZPatterns. I'm sure I'll learn a lot. ;-) Every time I start something I discover that my understanding is shakey.. but getting less so as time goes on.. Here is a concrete problem. (I always work better with concrete problems.

[Zope-dev] Extended expression syntax for 'sort' attribute of dtml-in tag (sort-python="...").

2000-08-22 Thread Adam Karpierz
Very please for discussion and acceptance: http://classic.zope.org:8080/Collector/1542/view Regards -- Adam Karpierz [EMAIL PROTECTED] ___ Zope-Dev maillist - [EMAIL PROTECTED] http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or

[Zope-dev] Patch for extended expression syntax of dtml-tag attributes.

2000-08-22 Thread Adam Karpierz
Very please for discussion and acceptance: http://classic.zope.org:8080/Collector/1541/view Regards -- Adam Karpierz [EMAIL PROTECTED] ___ Zope-Dev maillist - [EMAIL PROTECTED] http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or

[Zope-dev] Re: Yup, the problem's still there...

2000-08-22 Thread odysseus
Ah That would explain it! How about this, instead of an attribute, I created a method: def icon(self): return 'misc_/Squishdot/squishfile_img' This seemed to work. Attached is the patch. Comments? -Lance On Tue, 22 Aug 2000, Chris Withers wrote: > Lance wrote: > > I think you

Re: [Zope-dev] LoginManager.

2000-08-22 Thread Terje Malmedal
[Bill Anderson] > Terje Malmedal wrote: >> >> Can anybody please provide a simple example of a working usersource >> written in python? > Look at the UserSource source for LoginManager and Membership. I did that. I feel I am missing something obvious. What I do is: * create a folder name

[Zope-dev] Yup, the problem's still there...

2000-08-22 Thread Chris Withers
Lance wrote: > I think you have to not only > inherit RoleManager, but OFS.SimpleItem.Item as well. At least, that's what > the Security HOWTO seems to imply. No, it shouldn't :( SimpleItem.Item has __allow_access_to_unprotected_subobjects__=1 in it, so it just masks the problem rather than solv

[Zope-dev] Security Stuff :P (part 3) : the tracebacks

2000-08-22 Thread Chris Withers
Well, what do you know? I leave it for a couple fo hours to set up a laptop, come back and try again. It's not hanging anymore, but I'm still getting the errors when I click cancel: Chris Withers wrote: > Posting's objects have a text attribute called 'subject' > > Unless you have __allow_access

Re: [Zope-dev] Bugs in new Security Stuff :P (part1)

2000-08-22 Thread R. David Murray
On Tue, 22 Aug 2000, Chris Withers wrote: > Why are they totally immune to the security stuff? It gets really > confusing when something works fine in a management screen and yet > breaks everywhere else, especially when it's not throwing a security > error (more in part II ;-) > > So, why is it

Re: [Zope-dev] aq_inContextOf/can anyone explain this zmonitor log?

2000-08-22 Thread Bob Pepin
On Mon, Aug 21, 2000 at 04:21:33PM +0100, Toby Dickenson wrote: > On Mon, 21 Aug 2000 16:03:38 +0200, Bob Pepin <[EMAIL PROTECTED]> wrote: > > Yeah, this is a good one. Theres some debate in the Collector about > whether this is actually a bug or not. > > In short, aq_inContextOf checks for nest

[Zope-dev] Bugs in new Security Stuff :P (part 3)

2000-08-22 Thread Chris Withers
Finally... I'm not convinced the new security stuff deals properly with attributes other than simple methods. here's the evidence, again from Squishdot (guess what I've been doing ;-) You remember the Posting class? Well, Posting's objects have a text attribute called 'subject' Unless you have

[Zope-dev] Bugs in new Security Stuff :P (part 2)

2000-08-22 Thread Chris Withers
Okay, next up, if it's a security error, it should throw a security error! :( Squishdot Posting's can have file attachments. class Posting(Persistent, Implicit,RoleManager): ... # protected by 'View' permission def attachment(self): file=self.file return

[Zope-dev] Forgot traceback ;-)

2000-08-22 Thread Chris Withers
Here it is: Error Type: KeyError Error Value: file_name Traceback (innermost last): File E:\Zope\227194~1.0\lib\python\ZPublisher\Publish.py, line 222, in publish_module File E:\Zope\227194~1.0\lib\python\ZPublisher\Publish.py, line 187, in publish File E:\Zope\227194~1.0\lib\python\Zope\_

[Zope-dev] Bugs in new Security Stuff :P (part1)

2000-08-22 Thread Chris Withers
Right, firstup this thing about HTMLFile's which form part of the management interface. Why are they totally immune to the security stuff? It gets really confusing when something works fine in a management screen and yet breaks everywhere else, especially when it's not throwing a security error