Re: [Zope] Python Classes and Zope.
Paul Winkler wrote: 1) create a derived or wrapper class that inherits from Acquisition.Implicit or Acquisition.Explicit. This can either inherit from your existing class, or wrap it, as you prefer. You don't actually have to do this. 2) in the wrapper class, use ClassSecurityInfo() to declare the methods you need public or permission-protected, or use allowAny(). You can apply these, and module security declarations, from any piece of trusted code, to any other piece of FS-based code. You know, some days I wonder why it is that Zope is the only framework around that needs to distinguish between trusted and untrusted code. Nobody else seems to be looking at us with envy in this regard. Well, while I'd like to agree with you, I like having semi-trusted code, but I think Zope 3 does a much better job of this... cheers, Chris -- Simplistix - Content Management, Zope Python Consulting - http://www.simplistix.co.uk ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Chris McDonough wrote: Not really, and that's why Zope 3 has avoided through the web code so far. I hope this avoidance continues at least in the core, whatever that is, but I see rumblings every so often about why this is a can't-live-without thing (with which I strongly disagree). Well, TTW coding via WebDAV, for example, is something that I don't think I could live without :-S Chris -- Simplistix - Content Management, Zope Python Consulting - http://www.simplistix.co.uk ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Dario Lopez-Kästen wrote: Most, if not all examples, out there assume that the external packages/modules/classes can freely be converted to Zope-classes. No so, all you have to do is provide security assertions for them. I usually do this is a dummy product's __init__.py. See the examples in PythonScripts standard.py... cheers, Chris -- Simplistix - Content Management, Zope Python Consulting - http://www.simplistix.co.uk ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Fernando Lujan wrote: For instance, if I create the class: class MyClass: A simple example class i = 12345 def f(self): return 'hello world' Can I invoke the following code inside a Python Script? x = MyClass() x.f() Yes, but you shouldn't want to ;-) I'm using zope 2.7.x series. Why? 2.8 is much much better... cheers, Chris -- Simplistix - Content Management, Zope Python Consulting - http://www.simplistix.co.uk ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Willi Langenberger wrote:
You could add
__allow_access_to_unprotected_subobjects__ = 1
You _could_, but that's a very old, deprecated interface. And, with the
work Jim's talking about doing, it might actually stop working.
nowadays you should do:
security = ClassSecurityInfo()
security.setDefaultAccess('allow')
cheers,
Chris
--
Simplistix - Content Management, Zope Python Consulting
- http://www.simplistix.co.uk
___
Zope maillist - Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
** No cross posts or HTML encoding! **
(Related lists -
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
On Fri, Dec 02, 2005 at 09:38:56AM +, Chris Withers wrote:
Dario Lopez-K?sten wrote:
Most, if not all examples, out there assume that the external
packages/modules/classes can freely be converted to Zope-classes.
No so, all you have to do is provide security assertions for them. I
usually do this is a dummy product's __init__.py.
See the examples in PythonScripts standard.py...
Those are mostly to do with declaring callables (i.e. functions)
importable, by using ModuleSecurityInfo().declarePublic('foo').
Very useful, but it doesn't show how to allow scripts to
use already instantiated objects passed to a Script from
some product code.
One way is to do the following in a method of
your trusted (product) code:
1) create a derived or wrapper class that inherits from
Acquisition.Implicit or Acquisition.Explicit.
This can either inherit from your existing class,
or wrap it, as you prefer.
2) in the wrapper class, use ClassSecurityInfo() to
declare the methods you need public or permission-protected,
or use allowAny().
3) initializeClass(myWrapper)
4) instantiate one of these and give it a security context,
e.g. myWrapperInstance = myWrapper(existing_object).__of__(self)
5) return the wrapper
You know, some days I wonder why it is that Zope is the
only framework around that needs to distinguish between
trusted and untrusted code. Nobody else seems to be
looking at us with envy in this regard.
Historically I know it was because there was the idea that
not-fully-trustworthy people might be able to join your site
and then add DTML to it, and you don't want such people
allowed to execute arbitrary code ... like the old zope.org
site. But does anybody anywhere actually run a site like that
nowadays? It's kind of a bizarre idea.
--
Paul Winkler
http://www.slinkp.com
___
Zope maillist - Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
** No cross posts or HTML encoding! **
(Related lists -
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
On Thu, Dec 01, 2005 at 09:04:11PM +0100, Jean-Marc Orliaguet wrote: You need to call InitializeClass on your object, and that's it. cf http://www.upfrontsystems.co.za/courses/zope/ch04.html under Zopifying our Python classes initializeClass() only helps if the class you feed it inherits from Acquisition.Implicit or Acquisition.Explicit, and has some security declarations in it. -- Paul Winkler http://www.slinkp.com ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
On Dec 2, 2005, at 9:49 AM, Paul Winkler wrote: You know, some days I wonder why it is that Zope is the only framework around that needs to distinguish between trusted and untrusted code. Nobody else seems to be looking at us with envy in this regard. Historically I know it was because there was the idea that not-fully-trustworthy people might be able to join your site and then add DTML to it, and you don't want such people allowed to execute arbitrary code ... like the old zope.org site. But does anybody anywhere actually run a site like that nowadays? It's kind of a bizarre idea. Not really, and that's why Zope 3 has avoided through the web code so far. I hope this avoidance continues at least in the core, whatever that is, but I see rumblings every so often about why this is a can't-live-without thing (with which I strongly disagree). - C ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Paul Winkler wrote: On Thu, Dec 01, 2005 at 09:04:11PM +0100, Jean-Marc Orliaguet wrote: You need to call InitializeClass on your object, and that's it. cf http://www.upfrontsystems.co.za/courses/zope/ch04.html under Zopifying our Python classes initializeClass() only helps if the class you feed it inherits from Acquisition.Implicit or Acquisition.Explicit, and has some security declarations in it. for protected methods, but what if your methods are public? http://www.zope.org/Wikis/DevSite/Projects/DeclarativeSecurity/ZopeSecurityForDevelopers/wikipage_view - It is important to note what can and cannot be protected using the |SecurityInfo| interface. First, the security policy relies on /Acquisition/ to aggregate access control information, so any class that needs to work in the security policy must have either |Acquisition.Implicit| or |Acquisition.Explicit| in its base class hierarchy. - if the object has a security assertion that it is /public/ then access will be granted does zope2 do an access control based on acquisition for public methods, that would be a waste of resources since the answer is always yes, granted ? /JM ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
On Fri, Dec 02, 2005 at 04:12:01PM +0100, Jean-Marc Orliaguet wrote: does zope2 do an access control based on acquisition for public methods, that would be a waste of resources since the answer is always yes, granted ? Well, the thing is, the declaration that makes the method public *has no effect* unless your class participates in acquisition. Oh, and the instance needs to be given an acquisition context, too. e.g. foo = foo.__of__.some_parent -- Paul Winkler http://www.slinkp.com ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
On Fri, Dec 02, 2005 at 09:49:25AM -0500, Paul Winkler wrote:
2) in the wrapper class, use ClassSecurityInfo() to
declare the methods you need public or permission-protected,
or use allowAny().
Brain fart, sorry. There is no allowAny in ClassSecurityInfo
or elsewhere.
The quick-and-easy thing to do, if you don't want to create
wrapper or derived class, somewhere in some Product code,
do stuff like the following:
from AccessControl import allow_class, allow_module, ModuleSecurityInfo
# Allow scripts to *instantiate* a class.
# Skip this if your scripts don't need to instantiate the objects.
# Note that you can't call methods on it yet, keep reading...
ModuleSecurityInfo('Products.MyProduct').declarePublic('myclass')
# Allow unrestricted access to all *existing* instances
# of a class. Now you can call its methods.
# Note this *doesn't* automatically allow you to use
# other objects returned by any of its methods, so
# you may need to explicitly allow a bunch of other classes too...
allow_class(myclass)
# Allow scripts to import and use a function defined in
# some product. This works just like allowing to instantiate classes.
ModuleSecurityInfo('Products.MyProduct').declarePublic('myfunc')
# Works for standard library or other modules on $PYTHONPATH too.
ModuleSecurityInfo('urllib').declarePublic('urlopen')
# Allow unrestricted imports and usage of an *entire* module:
allow_module('mypackage.mymodule')
# ... well, mostly. Sometimes that doesn't work and you need
# to sprinkle in a few more declarations, e.g. for types
# defined in C.
# See for example
# lib/python/Products/PythonScripts/module_access_examples.py
# showing complications for e.g. the re module.
--
Paul Winkler
http://www.slinkp.com
___
Zope maillist - Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
** No cross posts or HTML encoding! **
(Related lists -
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
On 12/1/05, Fernando Lujan [EMAIL PROTECTED] wrote: There's a way to use a Python class inside zope? For instance, if I create the class: class MyClass: A simple example class i = 12345 def f(self): return 'hello world' Can I invoke the following code inside a Python Script? x = MyClass() x.f() Any Python code can be used from a Python Script, as long as it has been marked safe for importing into a restricted code. So, yes, you can define your Python class in a Product, but you must mark it safe for use in scripts. You can then import your code into the script and use it there. In lib/python/Products/PythonScripts/module_access_examples.py you'll find a series of examples that explain how to mark code safe for use in restricted code. Martijn Pieters ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
--On 1. Dezember 2005 13:46:55 -0200 Fernando Lujan [EMAIL PROTECTED] wrote: There's a way to use a Python class inside zope? For instance, if I create the class: class MyClass: A simple example class i = 12345 def f(self): return 'hello world' Can I invoke the following code inside a Python Script? x = MyClass() x.f() PythonScripts are for *scripting* not for implementing complex logic and for programming tasks that require classes. PythonScripts don't provide full Python functionality that why were are talking of *Restriced Python*. Consider writing your functionality as Python product. -aj pgpoQ5PUjvcGD.pgp Description: PGP signature ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
PythonScripts are for *scripting* not for implementing complex logic and for programming tasks that require classes. PythonScripts don't provide full Python functionality that why were are talking of *Restriced Python*. Consider writing your functionality as Python product. And sometimes a supporting class or function makes such code all the simpler. Knowing how to enable Python code to be imported into scripts is an essential tool. -- Martijn Pieters ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Sure you can. It's usually called a python product and there are tutorials and examples you can download from zope.org The core principle is to inherit from one of the zope classes that you can find in zope/lib/python/OFS such as Folder, SimpleItem or UniqueItem. When you do that you can save instances persistently in the ZODB. Good luck. On 12/1/05, Fernando Lujan [EMAIL PROTECTED] wrote: There's a way to use a Python class inside zope? For instance, if I create the class: class MyClass: A simple example class i = 12345 def f(self): return 'hello world' Can I invoke the following code inside a Python Script? x = MyClass() x.f() I'm using zope 2.7.x series. Thanks in advance. Fernando Lujan ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev ) -- Peter Bengtsson, work www.fry-it.com home www.peterbe.com hobby www.issuetrackerproduct.com ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
--On 1. Dezember 2005 17:00:09 +0100 Martijn Pieters [EMAIL PROTECTED] wrote: PythonScripts are for *scripting* not for implementing complex logic and for programming tasks that require classes. PythonScripts don't provide full Python functionality that why were are talking of *Restriced Python*. Consider writing your functionality as Python product. And sometimes a supporting class or function makes such code all the simpler. Knowing how to enable Python code to be imported into scripts is an essential tool. Sure you can but you shouldn't..you start with one class and at the end you have an application with tons of such codeyou can program that way but you shouldn't :-) -aj pgpzjVZZc45hF.pgp Description: PGP signature ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Andreas Jung wrote: Sure you can but you shouldn't..you start with one class and at the end you have an application with tons of such codeyou can program that way but you shouldn't :-) I will print and read the Developer Book... ;) Thanks for all replies. Fernando Lujan ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Andreas Jung wrote: --On 1. Dezember 2005 13:46:55 -0200 Fernando Lujan [EMAIL PROTECTED] wrote: There's a way to use a Python class inside zope? For instance, if I create the class: class MyClass: A simple example class i = 12345 def f(self): return 'hello world' Can I invoke the following code inside a Python Script? x = MyClass() x.f() PythonScripts are for *scripting* not for implementing complex logic and for programming tasks that require classes. PythonScripts don't provide full Python functionality that why were are talking of *Restriced Python*. Consider writing your functionality as Python product. all moral lessons aside, there are several use cases where access to *objects*, passed to zope2 from external packages and modules, is desirable. Most, if not all examples, out there assume that the external packages/modules/classes can freely be converted to Zope-classes. Now, assuming that I have not missed something fundamental, the problem the way I see it, is that when my Product recieves an object from the non-zope code, the object does not know anything about Zope, it is just a happy Python-object. But in order to even display it in a zpt I must transmogrify it into a special zope-object, and *that* is not so easy as I have discovered. In my case I am not so interested in importing the moduels or classes into a Script(Python) - I have allready passed the objects in question thtough my product, but still I get some Zope Does Not Allow That error. So far I have not had any success with anything else than writing special methods in my Classes that converts the objects to dictionaries before passing them to the zpt or Script(Python) in question. But that feels like a very awkward way of doing things, and it makeas it *very* difficult for Zope to be a nice player with non-zope objects. My 2 €-cents worth. /dario -- -- --- Dario Lopez-Kästen, IT Systems Services Chalmers University of Tech. Lyrics applied to programming application design: emancipate yourself from mental slavery - redemption song, b. marley ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
Dario Lopez-Kästen wrote: Andreas Jung wrote: --On 1. Dezember 2005 13:46:55 -0200 Fernando Lujan [EMAIL PROTECTED] wrote: There's a way to use a Python class inside zope? For instance, if I create the class: class MyClass: A simple example class i = 12345 def f(self): return 'hello world' Can I invoke the following code inside a Python Script? x = MyClass() x.f() PythonScripts are for *scripting* not for implementing complex logic and for programming tasks that require classes. PythonScripts don't provide full Python functionality that why were are talking of *Restriced Python*. Consider writing your functionality as Python product. all moral lessons aside, there are several use cases where access to *objects*, passed to zope2 from external packages and modules, is desirable. Most, if not all examples, out there assume that the external packages/modules/classes can freely be converted to Zope-classes. Now, assuming that I have not missed something fundamental, the problem the way I see it, is that when my Product recieves an object from the non-zope code, the object does not know anything about Zope, it is just a happy Python-object. But in order to even display it in a zpt I must transmogrify it into a special zope-object, and *that* is not so easy as I have discovered. In my case I am not so interested in importing the moduels or classes into a Script(Python) - I have allready passed the objects in question thtough my product, but still I get some Zope Does Not Allow That error. So far I have not had any success with anything else than writing special methods in my Classes that converts the objects to dictionaries before passing them to the zpt or Script(Python) in question. But that feels like a very awkward way of doing things, and it makeas it *very* difficult for Zope to be a nice player with non-zope objects. My 2 €-cents worth. /dario You need to call InitializeClass on your object, and that's it. cf http://www.upfrontsystems.co.za/courses/zope/ch04.html under Zopifying our Python classes /JM ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
So far I have not had any success with anything else than writing special methods in my Classes that converts the objects to dictionaries before passing them to the zpt or Script(Python) in question. But that feels like a very awkward way of doing things, and it makeas it *very* difficult for Zope to be a nice player with non- zope objects. FWIW, what you've created in Zope 3 terms is a view. You might feel more comfortable using Five and Zope 3 views if you're not comfortable with your current strategy because it provides a pattern for doing just this. - C ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Re: [Zope] Python Classes and Zope.
According to Dario Lopez-Kästen:
But in order to even display it in a zpt I must transmogrify it into a
special zope-object, and *that* is not so easy as I have discovered.
In my case I am not so interested in importing the moduels or classes
into a Script(Python) - I have allready passed the objects in question
thtough my product, but still I get some Zope Does Not Allow That error.
You could add
__allow_access_to_unprotected_subobjects__ = 1
to your class. Then all attributes and methods of its instances should
be accessible from Zope. However, this can be a security problem, so
be careful...
\wlang{}
--
[EMAIL PROTECTED]Fax: +43/1/31336/9207
Zentrum fuer Informatikdienste, Wirtschaftsuniversitaet Wien, Austria
___
Zope maillist - Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
** No cross posts or HTML encoding! **
(Related lists -
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope-dev )
