[Zope-dev] 2.6.4.c1 still problem with security

2004-01-20 Thread robert rottermann
Hi there,
I am using zope from cvs Zope-2_6-branch. I still get the following 
assertion in a DCWorkflow which worked flawlessly in 2.6.2

Thanks for any pointers
Robert
Traceback (innermost last):
 Module ZPublisher.Publish, line 98, in publish
 Module ZPublisher.mapply, line 88, in mapply
 Module ZPublisher.Publish, line 39, in call_object
 Module Products.CMFCore.FSPythonScript, line 92, in __call__
 Module Shared.DC.Scripts.Bindings, line 261, in __call__
 Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
 Module Products.CMFCore.FSPythonScript, line 126, in _exec
  - __traceback_info__: ({'traverse_subpath': [], 'container': PloneSite instance at 8bbed10, 
'context': PloneFolder instance at 96fb608, 'script': FSPythonScript at 
/zehnder/zehnder/createObject used for /zehnder/zehnder/tasklist/Task.2004-01-19.3020/Attachments}, 
(None, 'File', None), {}, (None, None, None))
 Module None, line 12, in createObject
 Module Products.CMFCore.PortalFolder, line 362, in invokeFactory
 Module Products.CMFCore.TypesTool, line 824, in constructContent
 Module Products.CMFCore.TypesTool, line 516, in constructInstance
 Module Products.CMFCore.TypesTool, line 420, in _finishConstruction
 Module Products.CMFCore.CMFCatalogAware, line 101, in notifyWorkflowCreated
 Module Products.CMFPlone.WorkflowTool, line 26, in notifyCreated
 Module Products.CMFCore.WorkflowTool, line 362, in notifyCreated
 Module Products.DCWorkflow.DCWorkflow, line 367, in notifyCreated
 Module Products.DCWorkflow.DCWorkflow, line 440, in _changeStateOf
 Module Products.DCWorkflow.DCWorkflow, line 543, in _executeTransition
 Module Shared.DC.Scripts.Bindings, line 261, in __call__
 Module Shared.DC.Scripts.Bindings, line 290, in _bindAndExec
 Module Shared.DC.Scripts.Bindings, line 1, in ?
 Module Shared.DC.Scripts.Bindings, line 224, in _getContext
Unauthorized: You are not allowed to access  in this context


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


[Zope-dev] 2.7rc1 - Unauthorized: You are not allowed to access '' in this context

2004-01-20 Thread Stuart Bishop
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
In Shared.DC.Scripts.Bindings._getContext(self), there
seems to be a new security check:
getSecurityManager().validate(parent, container, '', self)
This is now giving me the following traceback:

Traceback (innermost last):
  Module ZPublisher.Publish, line 100, in publish
  Module ZPublisher.mapply, line 88, in mapply
  Module ZPublisher.Publish, line 40, in call_object
  Module Products.CGPublisher.storage.Storage, line 911, in editPane
  Module Shared.DC.Scripts.Bindings, line 261, in __call__
  Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
  Module Products.PageTemplates.PageTemplateFile, line 106, in _exec
  Module Products.PageTemplates.PageTemplate, line 90, in pt_render
   - PageTemplateFile at 
/CGPublisher/works/2/5/source/getaway/details/editPaneHelper
  Module Products.PageTemplates.PageTemplateFile, line 74, in 
pt_getContext
  Module Shared.DC.Scripts.Bindings, line 224, in _getContext
  Module AccessControl.ImplPython, line 398, in validate
  Module AccessControl.ImplPython, line 263, in validate
Unauthorized: You are not allowed to access '' in this context

editPaneHelper is just a PageTemplateFile. Storage.editPane
(Python - not Python Script) is calling it like:
return self.editPaneHelper(**options)
Can anyone give me a hint on tracking this down? I have so far been
unable to write a minimal example that fails (they all work), so I'm
unsure if this is a Zope problem or my problem.
- --  
Stuart Bishop [EMAIL PROTECTED]
http://www.stuartbishop.net/
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.3 (Darwin)

iD8DBQFADPECAfqZj7rGN0oRAgUYAJsG+0Bx51I2ZBufS476v7mbOIjT7QCgmBD/
NfboK3y2rSJiT/eR55/ECP8=
=ctqN
-END PGP SIGNATURE-
___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] 2.7rc1 - Unauthorized: You are not allowed to access '' in this context

2004-01-20 Thread robert rottermann
Stuart,
I do have the same problem. And it occurs using 2.7x and 2.6x.
I am using local roles heavilly so I wonder whether it is linked to that
Robert
Stuart Bishop wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
In Shared.DC.Scripts.Bindings._getContext(self), there
seems to be a new security check:
getSecurityManager().validate(parent, container, '', self)
This is now giving me the following traceback:

Traceback (innermost last):
  Module ZPublisher.Publish, line 100, in publish
  Module ZPublisher.mapply, line 88, in mapply
  Module ZPublisher.Publish, line 40, in call_object
  Module Products.CGPublisher.storage.Storage, line 911, in editPane
  Module Shared.DC.Scripts.Bindings, line 261, in __call__
  Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
  Module Products.PageTemplates.PageTemplateFile, line 106, in _exec
  Module Products.PageTemplates.PageTemplate, line 90, in pt_render
   - PageTemplateFile at /CGPublisher/w
Traceback (innermost last):
 Module ZPublisher.Publish, line 98, in publish
 Module ZPublisher.mapply, line 88, in mapply
 Module ZPublisher.Publish, line 39, in call_object
 Module Products.CMFCore.FSPythonScript, line 92, in __call__
 Module Shared.DC.Scripts.Bindings, line 261, in __call__
 Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
 Module Products.CMFCore.FSPythonScript, line 126, in _exec
  - __traceback_info__: ({'traverse_subpath': [], 'container': PloneSite instance at 8bbed10, 'context': PloneFolder instance at 96fb608, 'script': FSPythonScript at /zehnder/zehnder/createObject used for /zehnder/zehnder/tasklist/Task.2004-01-19.3020/Attachments}, (None, 'File', None), {}, (None, None, None))
 Module None, line 12, in createObject
 Module Products.CMFCore.PortalFolder, line 362, in invokeFactory
 Module Products.CMFCore.TypesTool, line 824, in constructContent
 Module Products.CMFCore.TypesTool, line 516, in constructInstance
 Module Products.CMFCore.TypesTool, line 420, in _finishConstruction
 Module Products.CMFCore.CMFCatalogAware, line 101, in notifyWorkflowCreated
 Module Products.CMFPlone.WorkflowTool, line 26, in notifyCreated
 Module Products.CMFCore.WorkflowTool, line 362, in notifyCreated
 Module Products.DCWorkflow.DCWorkflow, line 367, in notifyCreated
 Module Products.DCWorkflow.DCWorkflow, line 440, in _changeStateOf
 Module Products.DCWorkflow.DCWorkflow, line 543, in _executeTransition
 Module Shared.DC.Scripts.Bindings, line 261, in __call__
 Module Shared.DC.Scripts.Bindings, line 290, in _bindAndExec
 Module Shared.DC.Scripts.Bindings, line 1, in ?
 Module Shared.DC.Scripts.Bindings, line 224, in _getContext
Unauthorized: You are not allowed to access  in this context
 

orks/2/5/source/getaway/details/editPaneHelper
  Module Products.PageTemplates.PageTemplateFile, line 74, in 
pt_getContext
  Module Shared.DC.Scripts.Bindings, line 224, in _getContext
  Module AccessControl.ImplPython, line 398, in validate
  Module AccessControl.ImplPython, line 263, in validate
Unauthorized: You are not allowed to access '' in this context

editPaneHelper is just a PageTemplateFile. Storage.editPane
(Python - not Python Script) is calling it like:
return self.editPaneHelper(**options)
Can anyone give me a hint on tracking this down? I have so far been
unable to write a minimal example that fails (they all work), so I'm
unsure if this is a Zope problem or my problem.
- --  Stuart Bishop [EMAIL PROTECTED]
http://www.stuartbishop.net/
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.3 (Darwin)
iD8DBQFADPECAfqZj7rGN0oRAgUYAJsG+0Bx51I2ZBufS476v7mbOIjT7QCgmBD/
NfboK3y2rSJiT/eR55/ECP8=
=ctqN
-END PGP SIGNATURE-
___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )



___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] 2.6.4.c1 still problem with security

2004-01-20 Thread robert rottermann
Having read  Stuarts post with a similar context I was digging trough 
DCWorkflow with the debugger and found that

In Shared.DC.Scripts.Bindings._getContext(self), there
seems to be a new security check:
   getSecurityManager().validate(parent, container, '', self)
does only allow Manager to access the  container of the script that is 
called during the DCWorkflow transition.

Any ideas?

Robert

robert rottermann wrote:

Hi there,
I am using zope from cvs Zope-2_6-branch. I still get the following 
assertion in a DCWorkflow which worked flawlessly in 2.6.2

Thanks for any pointers
Robert
Traceback (innermost last):
 Module ZPublisher.Publish, line 98, in publish
 Module ZPublisher.mapply, line 88, in mapply
 Module ZPublisher.Publish, line 39, in call_object
 Module Products.CMFCore.FSPythonScript, line 92, in __call__
 Module Shared.DC.Scripts.Bindings, line 261, in __call__
 Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
 Module Products.CMFCore.FSPythonScript, line 126, in _exec
  - __traceback_info__: ({'traverse_subpath': [], 'container': 
PloneSite instance at 8bbed10, 'context': PloneFolder instance at 
96fb608, 'script': FSPythonScript at /zehnder/zehnder/createObject 
used for /zehnder/zehnder/tasklist/Task.2004-01-19.3020/Attachments}, 
(None, 'File', None), {}, (None, None, None))
 Module None, line 12, in createObject
 Module Products.CMFCore.PortalFolder, line 362, in invokeFactory
 Module Products.CMFCore.TypesTool, line 824, in constructContent
 Module Products.CMFCore.TypesTool, line 516, in constructInstance
 Module Products.CMFCore.TypesTool, line 420, in _finishConstruction
 Module Products.CMFCore.CMFCatalogAware, line 101, in 
notifyWorkflowCreated
 Module Products.CMFPlone.WorkflowTool, line 26, in notifyCreated
 Module Products.CMFCore.WorkflowTool, line 362, in notifyCreated
 Module Products.DCWorkflow.DCWorkflow, line 367, in notifyCreated
 Module Products.DCWorkflow.DCWorkflow, line 440, in _changeStateOf
 Module Products.DCWorkflow.DCWorkflow, line 543, in _executeTransition
 Module Shared.DC.Scripts.Bindings, line 261, in __call__
 Module Shared.DC.Scripts.Bindings, line 290, in _bindAndExec
 Module Shared.DC.Scripts.Bindings, line 1, in ?
 Module Shared.DC.Scripts.Bindings, line 224, in _getContext
Unauthorized: You are not allowed to access  in this context



___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )



___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


RE: [Zope-dev] post security update analysis

2004-01-20 Thread Brian Lloyd
Thanks - I've marked these resolved. FYI I have a number of 
other issues still to mark resolved - I'll be trying to work 
through those today.


Brian Lloyd[EMAIL PROTECTED]
V.P. Engineering   540.361.1716  
Zope Corporation   http://www.zope.com 


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
 Behalf Of Jamie Heilman
 Sent: Tuesday, January 20, 2004 12:16 AM
 To: [EMAIL PROTECTED]
 Subject: Re: [Zope-dev] post security update analysis
 
 
 Jamie Heilman wrote:
  Now that we've reached closure on some of the outstanding security
  issues in Zope there's a lot of stuff in the Collector that needs to
  be revisited...
  
  Brian Lloyd wrote:
 ...
 - Proxy rights on DTMLMethods transferred via acquisition
  
  I believe this means issue #743 and issue #977 can be resolved now.
  Actually, #977 already was rejected IIRC but its never been marked as
  public which is rather irritating.  
 
 I've verified that this is the case, #977 should be made public, and
 #743 can resolved.
  
 - Improper security assertions on DTMLDocument objects
  
  probably fixes issue #865, but because Zope-HEAD doesn't actually run
  right now, due to a myriad of other bugs, I actually haven't tested it
 
 I've tested this now, #865 can be resolved.
 
 -- 
 Jamie Heilman http://audible.transient.net/~jamie/
 ...thats the metaphorical equivalent of flopping your wedding tackle
  into a lion's mouth and flicking his lovespuds with a wet towel, pure
  insanity...   -Rimmer
 
 ___
 Zope-Dev maillist  -  [EMAIL PROTECTED]
 http://mail.zope.org/mailman/listinfo/zope-dev
 **  No cross posts or HTML encoding!  **
 (Related lists - 
  http://mail.zope.org/mailman/listinfo/zope-announce
  http://mail.zope.org/mailman/listinfo/zope )
 

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )


[Zope-dev] Re: 2.6.4.c1 still problem with security

2004-01-20 Thread Tres Seaver
robert rottermann wrote:
Having read  Stuarts post with a similar context I was digging trough 
DCWorkflow with the debugger and found that

In Shared.DC.Scripts.Bindings._getContext(self), there
seems to be a new security check:
   getSecurityManager().validate(parent, container, '', self)
Yep, this was a real hole in PythonScripts before;  the script shouldn't 
bind the name 'container' if the user doesn't have access to the container.

does only allow Manager to access the  container of the script that is 
called during the DCWorkflow transition.

Any ideas?
Two possibilities:

  - If your script doesn't need to access container, then go to its
Bindings tab and clear the entry for container.  The security
check added in 2.6.3 won't take effect until the name is bound
(there is even a unit test for that case).
  - If your script *does* need access to the container (which will be
the scripts container of the workflow, IIRC), then you need to
give the script a proxy role of 'Manager'.
Tres.
--
===
Tres Seaver[EMAIL PROTECTED]
Zope Corporation  Zope Dealers   http://www.zope.com
___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


[Zope-dev] Re: 2.7rc1 - Unauthorized: You are not allowed to access '' in this context

2004-01-20 Thread Tres Seaver
Stuart Bishop wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
In Shared.DC.Scripts.Bindings._getContext(self), there
seems to be a new security check:
getSecurityManager().validate(parent, container, '', self)
This is now giving me the following traceback:

Traceback (innermost last):
  Module ZPublisher.Publish, line 100, in publish
  Module ZPublisher.mapply, line 88, in mapply
  Module ZPublisher.Publish, line 40, in call_object
  Module Products.CGPublisher.storage.Storage, line 911, in editPane
  Module Shared.DC.Scripts.Bindings, line 261, in __call__
  Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
  Module Products.PageTemplates.PageTemplateFile, line 106, in _exec
  Module Products.PageTemplates.PageTemplate, line 90, in pt_render
   - PageTemplateFile at 
/CGPublisher/works/2/5/source/getaway/details/editPaneHelper
  Module Products.PageTemplates.PageTemplateFile, line 74, in pt_getContext
  Module Shared.DC.Scripts.Bindings, line 224, in _getContext
  Module AccessControl.ImplPython, line 398, in validate
  Module AccessControl.ImplPython, line 263, in validate
Unauthorized: You are not allowed to access '' in this context

editPaneHelper is just a PageTemplateFile. Storage.editPane
(Python - not Python Script) is calling it like:
return self.editPaneHelper(**options)
Can anyone give me a hint on tracking this down? I have so far been
unable to write a minimal example that fails (they all work), so I'm
unsure if this is a Zope problem or my problem.
Zope 2.6.3 added a new security check for untrusted code, to ensure that 
the bindings created (in particular, 'context' and 'container') 
weren't set up if the user didn't have access to the bound objects.

You can either:

  - On the template's Bindings tab, unbind the 'context' name
   (assuming that your template does not use either 'context' or 'here')
  - Give the template a proxy role of 'Manager'.

Tres.
--
===
Tres Seaver[EMAIL PROTECTED]
Zope Corporation  Zope Dealers   http://www.zope.com
___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


[Zope-dev] tcp port not 8080

2004-01-20 Thread ben strawbridge
Hello,

I just installed zope and plone. It works fine and I can access the
management console for it.  The problem is I am running tomcat on this
box as well and it is already using port 8080.  I seaerched around the
zope and plone sites but can't find anything about where to change this,
except for references that it can be done. I also googled some terms to
no avail.

Any help will be appreciated.
thanks!
Ben Strawbridge - Senior Interface Engineer
-
Cenozoa Corporation
1(646) 536-3066
3 East 28th St., 9th Floor
New York, NY 10014
http://www.cenozoa.com


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] tcp port not 8080

2004-01-20 Thread Fred L. Drake, Jr.

ben strawbridge writes:
  I just installed zope and plone. It works fine and I can access the
  management console for it.  The problem is I am running tomcat on this
  box as well and it is already using port 8080.  I seaerched around the
  zope and plone sites but can't find anything about where to change this,
  except for references that it can be done. I also googled some terms to
  no avail.

It can indeed be changed.  The recommended way to do so depends on the
version of Zope you're using.  Which version is it?


  -Fred

-- 
Fred L. Drake, Jr.  fred at zope.com
PythonLabs at Zope Corporation

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] tcp port not 8080

2004-01-20 Thread Andreas Jung
etc/zope.conf for Zope 2.7 or z2.py -h (pre-Zope 2.7) is your friend.

-aj

--On Dienstag, 20. Januar 2004 12:01 Uhr -0500 ben strawbridge 
[EMAIL PROTECTED] wrote:

Hello,

I just installed zope and plone. It works fine and I can access the
management console for it.  The problem is I am running tomcat on this
box as well and it is already using port 8080.  I seaerched around the
zope and plone sites but can't find anything about where to change this,
except for references that it can be done. I also googled some terms to
no avail.
Any help will be appreciated.
thanks!
Ben Strawbridge - Senior Interface Engineer
-
Cenozoa Corporation
1(646) 536-3066
3 East 28th St., 9th Floor
New York, NY 10014
http://www.cenozoa.com
___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists -
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )




___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] CVS Head: Error Value: iterable argument required when adding objects

2004-01-20 Thread Dieter Maurer
Jeremy Hylton wrote at 2004-1-19 09:31 -0500:
On Sun, 2004-01-18 at 16:02, Dieter Maurer wrote:
 ...
 That's not what the zdaemon documentation (as distributed with
 Zope 2.7b3) says:

Where is that documentation?  I'm not able to find it.

ZConfig configured packages often have documentation
in schema.xml and component.xml files.

The mentioned documentation is in zdaemon/component.xml.
It reads:

key name=daemon datatype=boolean
 required=no
 default=false
  description
Command-line option: -d or --daemon.

If this option is true, zdrun.py runs in the background as a
true daemon.  It forks an child process which becomes the
subprocess manager, while the parent exits (making the shell
that started it believe it is done).  The child process also
does the following:

- if the directory option is set, change into that directory

- redirect stdin, stdout and stderr to /dev/null

- call setsid() so it becomes a session leader

- call umask(022)
  /description
/key


-- 
Dieter

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )


[Zope-dev] Help with ZClasses

2004-01-20 Thread Fábio Bruno
Dear Sir or Madame I'm workign with zope ZClasses in zope 2.7.0b.I decided 
to do the example given to us at this site 
http://zope.org/Members/dedalu/precosHowto/#top1.I can not do the question 
3.1 and 3.2 for the same reason.They tell us to change PrecosFolder_add but 
when we do that it is displayed the follow error frase
Title Parameter List
Bound Names  context, container, script, traverse_subpath
Last Modified  2004-01-20 17:23
Errors invalid syntax (Script (Python), line 1)
html
headtitleAdicionar PrecosFolder/title/head
body bgcolor=#FF link=#99 vlink=#55

dtml-with PrecosFolder.createInObjectManager(REQUEST['id'], REQUEST)
  dtml-call 
propertysheets.PrecosFolder.manage_editProperties(REQUEST)
/dtml-with

dtml-if DestinationURL
   dtml-call RESPONSE.redirect(DestinationURL+'/manage_workspace')
dtml-else
   dtml-call RESPONSE.redirect(URL2+'/manage_workspace')
/dtml-if
/body
/html
I hope some one can help us.
Yours faithfully,
Fábio Bruno
_
MSN Messenger: converse com os seus amigos online. 
http://messenger.msn.com.br

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] Re: 2.7rc1 - Unauthorized: You are not allowed to access '' in this context

2004-01-20 Thread Stuart Bishop
On 21/01/2004, at 2:34 AM, Tres Seaver wrote:

Zope 2.6.3 added a new security check for untrusted code, to ensure 
that the bindings created (in particular, 'context' and 'container') 
weren't set up if the user didn't have access to the bound objects.

You can either:

  - On the template's Bindings tab, unbind the 'context' name
   (assuming that your template does not use either 'context' or 
'here')

  - Give the template a proxy role of 'Manager'.
Don't suppose you can be more specific on 'has access'. According to
my security tab, my container has both View and Access Contents 
Information
granted to Authenticated. Somewhere, I'm losing authorization where in 
2.7b3
I wasn't.

I think I've tracked down a minimal example, the trigger being my
use of __allow_access_to_unprotected_subobjects__ = None. I'm thinking
this recent change is incompatible if a parent object tightens security
in this way or uses security.setDefaultAccess('deny'). The
work around is to explicity grant access to the name '' as I've done
in the attached example.
Should policy.validate(name='') be changed to cope with this
situation, or shall I update CHANGES.txt and
ClassSecurityInfo.setDefaultAccess attempting to explain the situation 
and
the fix?



__init__.py
Description: Binary data


--  
Stuart Bishop [EMAIL PROTECTED]
http://www.stuartbishop.net/


PGP.sig
Description: This is a digitally signed message part
___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )


Re: [Zope-dev] Help with ZClasses

2004-01-20 Thread J. Cameron Cooper
Fábio Bruno wrote:

Dear Sir or Madame I'm workign with zope ZClasses in zope 2.7.0b.I 
decided to do the example given to us at this site 
http://zope.org/Members/dedalu/precosHowto/#top1.I can not do the 
question 3.1 and 3.2 for the same reason.They tell us to change 
PrecosFolder_add but when we do that it is displayed the follow error 
frase
Title Parameter List
Bound Names  context, container, script, traverse_subpath
Last Modified  2004-01-20 17:23
Errors invalid syntax (Script (Python), line 1)
html
I'm guessing you're using a Script (Python) rather than a DTML Method. 
Make sure you pay attention to the type of object you're supposed to use.

This list, btw, if for development of Zope, not with Zope. For that you 
want [EMAIL PROTECTED]

 --jcc

--
My point and period will be throughly wrought,
Or well or ill, as this day's battle's fought.


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )