*** regebro has left #zope3-dev | 00:02 | |
*** rcrafton has quit IRC | 00:04 | |
*** jodok has joined #zope3-dev | 00:06 | |
*** rmarianski has quit IRC | 00:07 | |
*** toutpt has quit IRC | 00:08 | |
*** fcorrea has quit IRC | 00:11 | |
*** greenman has joined #zope3-dev | 00:12 | |
*** jodok_ has quit IRC | 00:24 | |
*** RaFromBRC|lunch is now known as RaFromBRC | 00:28 | |
*** jodok has quit IRC | 00:30 | |
*** norro has quit IRC | 00:37 | |
*** philiKON has quit IRC | 00:41 | |
*** rmarianski has joined #zope3-dev | 00:46 | |
*** nathany has quit IRC | 00:51 | |
*** acsr has quit IRC | 00:54 | |
*** danielblackburn has quit IRC | 00:54 | |
*** benji has quit IRC | 01:00 | |
*** whit has quit IRC | 01:01 | |
*** wiggy has quit IRC | 01:05 | |
*** sm has joined #zope3-dev | 01:07 | |
*** natea_ is now known as natea | 01:17 | |
*** rmarianski has quit IRC | 01:17 | |
*** mgedmin has quit IRC | 01:18 | |
*** timte has quit IRC | 01:19 | |
*** supton has quit IRC | 01:23 | |
*** menesis has joined #zope3-dev | 01:30 | |
*** RaFromBRC is now known as RaFromBRC|away | 01:30 | |
*** lucielejard has quit IRC | 01:30 | |
*** acsr has joined #zope3-dev | 01:30 | |
*** projekt01 has joined #zope3-dev | 01:52 | |
*** harobed has quit IRC | 01:56 | |
*** danielblackburn has joined #zope3-dev | 02:03 | |
*** tarek has quit IRC | 02:06 | |
*** stub has joined #zope3-dev | 02:08 | |
*** J1m has quit IRC | 02:12 | |
*** mweichert has joined #zope3-dev | 02:15 | |
*** ignas has quit IRC | 02:40 | |
*** run|home has joined #zope3-dev | 02:54 | |
*** redir has joined #zope3-dev | 03:23 | |
*** danielblackburn has quit IRC | 03:23 | |
*** danielblackburn has joined #zope3-dev | 03:23 | |
*** menesis has quit IRC | 03:25 | |
*** niemeyer has quit IRC | 03:25 | |
*** whit has joined #zope3-dev | 03:40 | |
*** RaFromBRC|away is now known as RaFromBRC | 03:43 | |
*** rcrafton has joined #zope3-dev | 04:20 | |
*** greenman has quit IRC | 04:22 | |
*** danielblackburn has quit IRC | 04:23 | |
*** RaFromBRC has quit IRC | 04:55 | |
*** danielblackburn has joined #zope3-dev | 05:03 | |
*** lucielejard has joined #zope3-dev | 05:05 | |
*** jayaraj has joined #zope3-dev | 05:09 | |
*** jayaraj has quit IRC | 05:10 | |
*** stub has quit IRC | 05:16 | |
*** danielblackburn has quit IRC | 05:17 | |
*** lucielejard has quit IRC | 05:18 | |
*** strichter has joined #zope3-dev | 05:21 | |
*** srichter has quit IRC | 05:26 | |
*** strichter is now known as srichter | 05:27 | |
*** ChanServ sets mode: +o srichter | 05:27 | |
*** rcrafton has quit IRC | 05:29 | |
*** baijum has joined #zope3-dev | 05:42 | |
*** redir has quit IRC | 05:50 | |
*** afd_ has joined #zope3-dev | 06:02 | |
*** [1]Doc_Dan has joined #zope3-dev | 06:19 | |
*** baijum has quit IRC | 06:19 | |
*** afd__ has joined #zope3-dev | 06:31 | |
*** Doc_Dan has quit IRC | 06:36 | |
*** [1]Doc_Dan is now known as Doc_Dan | 06:36 | |
*** alecm has quit IRC | 06:40 | |
*** afd_ has quit IRC | 06:47 | |
*** jayaraj has joined #zope3-dev | 07:03 | |
*** philiKON has joined #zope3-dev | 07:16 | |
*** stub has joined #zope3-dev | 07:40 | |
*** pcardune has quit IRC | 08:03 | |
*** philiKON_ has joined #zope3-dev | 08:05 | |
*** philiKON has quit IRC | 08:23 | |
*** philiKON_ has quit IRC | 08:28 | |
*** baijum has joined #zope3-dev | 08:28 | |
*** __mac__ has quit IRC | 08:31 | |
*** BjornT has quit IRC | 08:31 | |
*** __mac__ has joined #zope3-dev | 08:32 | |
*** BjornT has joined #zope3-dev | 08:32 | |
*** run|home has quit IRC | 08:33 | |
*** jukart has joined #zope3-dev | 08:37 | |
*** whit has quit IRC | 08:40 | |
*** sorin has joined #zope3-dev | 08:53 | |
*** sorin is now known as sorindregan | 08:53 | |
*** zagy has joined #zope3-dev | 08:57 | |
*** stub has quit IRC | 09:05 | |
*** stu2 has joined #zope3-dev | 09:05 | |
*** stu2 is now known as stub | 09:05 | |
*** hdima has joined #zope3-dev | 09:11 | |
*** afd__ has quit IRC | 09:16 | |
*** __mac__ has left #zope3-dev | 09:25 | |
*** d2m has joined #zope3-dev | 09:34 | |
*** reco has joined #zope3-dev | 09:36 | |
*** __mac__ has joined #zope3-dev | 09:38 | |
*** timte has joined #zope3-dev | 09:43 | |
*** sorindregan has quit IRC | 09:43 | |
*** ghendi has joined #zope3-dev | 09:45 | |
*** timte has quit IRC | 09:46 | |
*** sorin has joined #zope3-dev | 09:46 | |
*** timte has joined #zope3-dev | 09:46 | |
*** sorin is now known as sorindregan | 09:47 | |
*** jodok has joined #zope3-dev | 09:52 | |
*** toutpt has joined #zope3-dev | 09:52 | |
*** jodok has quit IRC | 09:58 | |
*** stub has quit IRC | 10:03 | |
*** stub has joined #zope3-dev | 10:04 | |
*** afd_ has joined #zope3-dev | 10:07 | |
*** dobee has joined #zope3-dev | 10:11 | |
*** dobee has joined #zope3-dev | 10:12 | |
*** d21 has joined #zope3-dev | 10:24 | |
*** goschtl has joined #zope3-dev | 10:25 | |
*** menesis has joined #zope3-dev | 10:25 | |
*** harobed has joined #zope3-dev | 10:38 | |
*** d21 has quit IRC | 10:39 | |
*** d2m has quit IRC | 10:39 | |
*** pelle_ has joined #zope3-dev | 10:40 | |
timte | srichter: can z3c.pdftemplate use css to style html so the style is also shown in the pdf? | 10:46 |
---|---|---|
srichter | timte: no, it uses RML to generate PDF, not HTML and CSS | 10:48 |
*** tarek has joined #zope3-dev | 10:50 | |
timte | ah, so you need to learn rml | 10:50 |
srichter | yes | 10:50 |
srichter | HTML simply does not suffice for layout | 10:51 |
*** markusleist has joined #zope3-dev | 11:01 | |
*** jodok has joined #zope3-dev | 11:03 | |
*** greenman has joined #zope3-dev | 11:05 | |
*** markusleist has quit IRC | 11:12 | |
*** wiggy has joined #zope3-dev | 11:13 | |
*** wiggy has left #zope3-dev | 11:13 | |
*** __mac__ has left #zope3-dev | 11:18 | |
*** jpcw2002 has joined #zope3-dev | 11:20 | |
*** quodt has joined #zope3-dev | 11:20 | |
baijum | srichter, may be HTML+CSS would be suffice for layout as Pisa doing: http://www.htmltopdf.org/ (based on RML & Reportlab) | 11:34 |
*** maurits has joined #zope3-dev | 11:42 | |
srichter | baijum: sure, HTML -> RML is okay, but you could not replace RML with HTML | 11:44 |
*** MJ has joined #zope3-dev | 11:45 | |
srichter | baijum: unfortunately, pisa uses PML | 11:46 |
baijum | srichter, PML is extended RML, is it ? | 11:46 |
srichter | no, I think it is a totally different XML dialect, as far as I remember | 11:47 |
baijum | srichter, is there any any other package to convert HTML+CSS to RML ? | 11:47 |
baijum | may be based on z3c.rml ? | 11:49 |
srichter | I don't think so | 11:49 |
srichter | baijum: I would welcome one though | 11:49 |
srichter | maybe pisa could be abstracted to support both | 11:50 |
baijum | ok | 11:53 |
*** stub has quit IRC | 12:01 | |
*** ktwilight has quit IRC | 12:02 | |
*** ktwilight_ has joined #zope3-dev | 12:02 | |
*** ktwilight has joined #zope3-dev | 12:05 | |
*** agroszer has joined #zope3-dev | 12:06 | |
*** maurits__ has joined #zope3-dev | 12:08 | |
*** thruflo has joined #zope3-dev | 12:09 | |
*** maurits has quit IRC | 12:12 | |
*** maurits__ is now known as maurits | 12:12 | |
*** ktwilight_ has quit IRC | 12:20 | |
*** quodt has quit IRC | 12:27 | |
*** quodt has joined #zope3-dev | 12:38 | |
*** d2m has joined #zope3-dev | 12:41 | |
*** thruflo has left #zope3-dev | 12:48 | |
*** jodok has quit IRC | 13:04 | |
*** mkerrin has joined #zope3-dev | 13:06 | |
*** regebro has joined #zope3-dev | 13:06 | |
*** pyqwer has joined #zope3-dev | 13:13 | |
pyqwer | srichter: I have a pattern for z3c.form where I need to delete widgets (=correctly entered input fields) in the action routine, however, z3c.form.util.Manager does not have a __del__ method. Is there any reason why? | 13:15 |
srichter | pyqwer: I guess I thought you never need that, because you can do you selection in the field and button manager: | 13:17 |
srichter | def update(self): | 13:17 |
srichter | self.fields = self.fields.omit('myname') | 13:18 |
srichter | ... | 13:18 |
pyqwer | Hmmm, in my case, I check the correctness of input fields in the action routine. Correct input fields should not be shown, wrong ones should be present. | 13:19 |
pyqwer | So the only way seems to me to delete unneeded widgets in the action routine, before render() is called. | 13:19 |
*** toutpt has quit IRC | 13:20 | |
srichter | pyqwer: ok, I agree that __del__ is a use case | 13:22 |
srichter | pyqwer: you could also just switch them to the mode "hide" | 13:22 |
srichter | or "hidden" (?) | 13:22 |
pyqwer | Yes, hiding would be an option. But I think __del__ is not much work and quite simple, too. If you wait a little, I'll send you some code for util.py which should work... | 13:23 |
srichter | ok | 13:23 |
srichter | feel free to check it in | 13:23 |
srichter | just make sure you write a test, so that test coverage stays at 100% | 13:23 |
pyqwer | Ok. | 13:24 |
pyqwer | But I can't check in, I still have no SVN write permission yet, so I'll send it to you. | 13:24 |
srichter | ok | 13:25 |
projekt01 | pyqwer, why __del__ , widget.mode='hidden' works like you need | 13:25 |
projekt01 | but I'm fine with the __del__ method | 13:25 |
*** maurits__ has joined #zope3-dev | 13:27 | |
pyqwer | Hmmm, hiding it is ok, but to me, deleting unneeded widgets seems somehow cleaner. Moreover, I think a __del__ method never hurts. | 13:28 |
projekt01 | pyqwer, I'm fine with __del__, It cuold give a sppedup if you delete the wideget before you update them | 13:29 |
projekt01 | don't delete after setup and update, right? | 13:30 |
pyqwer | projekt01: Ummm, well, I thought about deleting the widget in the action handler. | 13:31 |
pyqwer | That's after the updateWidget() routine. | 13:31 |
projekt01 | that doesn't work because sometimes there is a redirect in action handler | 13:32 |
projekt01 | the action is only called on form processing, it has nothing to do with rendereing | 13:32 |
pyqwer | projekt01: Yes, that's exactly my case: If input fields are correctly processed, they should not be shown. I process them in the action handle, therfore I need to also delete them there, right? | 13:34 |
projekt01 | this means if you click on abort whihc does a redirect you will get all widgets or if you refresh the browser with F5, you will get all widgets too | 13:35 |
projekt01 | that doesn't work | 13:35 |
projekt01 | you need to make the desicion and delete widgets during the udpate call | 13:35 |
pyqwer | Well, the fields are dynamically added in the update() method. | 13:35 |
*** salfield has quit IRC | 13:36 | |
projekt01 | but that doesn't work in the core, I think you have a valid usecase but not for the z3c.form in general | 13:37 |
*** maurits has quit IRC | 13:37 | |
*** maurits__ is now known as maurits | 13:37 | |
projekt01 | pyqwer, probably you can use a session and store the available widgets names there and use them for widget rendering, this makes the form consistent with browser page refresh etc. | 13:39 |
projekt01 | then you can set widgets names in the action and use them in the update if you redirect after your action call | 13:40 |
projekt01 | note, everything you will do in the action just works if the button get clicked, this means it's not consitent with the HTTP stateless concept | 13:41 |
*** fcorrea has joined #zope3-dev | 13:41 | |
projekt01 | if you like to have forms which works with browser page reload etc, you need to do everything in the update method | 13:41 |
projekt01 | pyqwer, do you know what I mean? | 13:42 |
pyqwer | Hmmm, I'm not really sure. | 13:43 |
pyqwer | My usecase is stateless, as I have the condition in the update() and render method. | 13:43 |
projekt01 | the form action handler is like a post processing step of a form, but it' only processing if the button get cklicked | 13:43 |
projekt01 | this means you will get different HTML rendered if you cklick the button or not if you put some rendering relvant stuff into the action | 13:44 |
pyqwer | Yes, true. Before that come the update/updateWidgets() methods. | 13:44 |
pyqwer | Yes, but that's my intention. | 13:44 |
pyqwer | Perhaps I illustrate my example: | 13:44 |
*** maurits is now known as maurits|lunch | 13:45 | |
projekt01 | it's only a question if the form should work consistent or not. Remeber you can navigate with back and F5 buttons too in browsers | 13:45 |
pyqwer | I have an object that is assigned to other users. To confirm that assignment, all these users have to input their password in a "save" form. | 13:45 |
pyqwer | If a password is correctly entered, the widget for this user password should not be shown again. All wrongly entered password-widgets should be still shown. | 13:46 |
pyqwer | So, my update() method adds fields for all users who have not confirmed the assignment. And the action routine then deletes all widgets with correct passwords. | 13:47 |
projekt01 | try to implement this and you will see what happens | 13:48 |
pyqwer | ;-) | 13:48 |
projekt01 | think about what happens if you you click the second time when only one field is wrong and submitted | 13:48 |
pyqwer | Maybe I'll a little stubborn, so I'll try to find out... | 13:48 |
projekt01 | I guess then it will render the missing first correct widget again | 13:48 |
projekt01 | because you cant delete them | 13:49 |
projekt01 | because it's missing | 13:49 |
projekt01 | it's a kind of egg and ckicken problem | 13:49 |
projekt01 | I defently whould use sessions support for handling such use case | 13:50 |
projekt01 | 1. setup widgets in update. 2. exclude widget names in action, store this names in a session. 3. redirect to the form in action | 13:53 |
projekt01 | then you can delete the widgets in step 1 based on widget names stored in the session | 13:54 |
*** ignas has joined #zope3-dev | 14:01 | |
*** afd_ has quit IRC | 14:05 | |
*** danielblackburn has joined #zope3-dev | 14:06 | |
baijum | What is the advantage of z3c.recipe.dev over zc.zope3recipes ? | 14:15 |
*** maurits|lunch is now known as maurits | 14:15 | |
baijum | Is there any buildout recipe for setting up a WSGI application like zopeproject ? | 14:18 |
projekt01 | baijum, z3c.recipe.dev doesn't use the daemon | 14:19 |
projekt01 | and z3c.recipe.dev offers a python script runner recipe | 14:20 |
baijum | ah. ok, will it run in Windows also ? | 14:20 |
projekt01 | zope3recipe is for production use and z3c.recipe.dev only for development | 14:20 |
projekt01 | Yes, windows was the reason I started that piece | 14:20 |
projekt01 | started/developed | 14:21 |
baijum | ok, thanks ! | 14:21 |
projekt01 | z3c.recipe.dev doesn't start a python instance which starts another python (daemon) instance which starts zope | 14:21 |
projekt01 | np | 14:21 |
*** thruflo has joined #zope3-dev | 14:22 | |
pyqwer | projekt01: Hmmm, I thought about it and coded it and it seems to work (apart from some problems). | 14:22 |
pyqwer | Using a session seems of no much use as there's only one form in my pattern. | 14:23 |
projekt01 | pyqwer, cool | 14:23 |
projekt01 | the session is only needed for stateless support | 14:23 |
pyqwer | In my pattern I can recreate the needed state anytime. | 14:23 |
projekt01 | if you use a session the users could use the back button and switch to the same form later and the widget exlude concept still works | 14:24 |
*** danielblackburn has quit IRC | 14:24 | |
pyqwer | Yes and no: If they use the back button, users see widgets that they should not see. There's nothing I can do about that. | 14:25 |
pyqwer | However, I simply ignore all unneeded widgets in my action routine. | 14:25 |
pyqwer | My problem with sessions is that I somehow have to manage data stored in there, I'm not sure if I can rely on some "magic garbage collection". | 14:26 |
pyqwer | projekt01: Anyway, I still have the problem that implementing __del__() for util.Manager raises some errors during Zope3 startup: | 14:27 |
pyqwer | Exception exceptions.TypeError: '__del__() takes exactly 2 arguments (1 given)' in <bound method Buttons.__del__ of <z3c.form.button.Buttons object at 0x37fa8d0>> ignored | 14:27 |
pyqwer | Moreover, I can't use del widgets[xyz] on the manager but have to use widgets.__del__(xyz). | 14:28 |
pyqwer | There seems to be some black magic involved I don't know about. | 14:28 |
*** salfield has joined #zope3-dev | 14:28 | |
* pyqwer leaving for lunch... | 14:29 | |
projekt01 | pyqwer, you mean __delitem__, I guess the manager is a IContainer, right? | 14:31 |
*** jodok has joined #zope3-dev | 14:40 | |
*** rcrafton has joined #zope3-dev | 14:47 | |
*** timte_ has joined #zope3-dev | 14:51 | |
*** quodt_ has joined #zope3-dev | 14:56 | |
*** quodt has quit IRC | 14:56 | |
*** timte has quit IRC | 14:58 | |
*** timte_ is now known as timte | 14:59 | |
*** quodt has joined #zope3-dev | 14:59 | |
*** niemeyer has joined #zope3-dev | 15:04 | |
pyqwer | projekt01: Oh my, thanks, yes, __delitem__ instead of __del__! | 15:16 |
*** benji has joined #zope3-dev | 15:16 | |
*** jayaraj has quit IRC | 15:16 | |
*** toutpt has joined #zope3-dev | 15:16 | |
*** quodt_ has quit IRC | 15:17 | |
pyqwer | srichter: Ok, I think I successfully implemented the __delitem__ method, I think, but it seems the z3c.form tests fail because interestingly "zopetest z3c.form" runs also tests from other packages, (e.g. from z3c.formdemo) - do you know why? | 15:22 |
projekt01 | did you use the z3c.form trunk? | 15:24 |
pyqwer | Yes. | 15:24 |
projekt01 | does it buildout with z3c.formdemo? | 15:24 |
pyqwer | Hmmm, I never used buildout, but probably. | 15:25 |
projekt01 | you need to use buildout for z3c.form package development | 15:25 |
projekt01 | evrything works just ou of the box with buildout for development, or at least it shuold | 15:26 |
pyqwer | Pffft, hmmm, that's bad. So I have to switch my environment to buildout... | 15:28 |
projekt01 | for z3c package development, yes | 15:34 |
srichter | the reason z3c.formdemo is also run is because the regex "z3c.form" matches also z3c.formdemo | 15:37 |
*** rocky|away is now known as rocky | 15:38 | |
pyqwer | Ah, I see. Hmmm, something like "zopetest 'z3c.form$'" does help. | 15:39 |
pyqwer | Ah, does NOT help. | 15:39 |
*** greenman has quit IRC | 15:39 | |
srichter | maybe it does only substring matching | 15:39 |
srichter | but I agree with Roger, you should switch to buildout, at least for the package development | 15:40 |
*** yvl has joined #zope3-dev | 15:40 | |
srichter | you can then use everything as you are used to for your other stuff | 15:40 |
pyqwer | Ok, that makes things easier for me. | 15:41 |
*** danielblackburn has joined #zope3-dev | 15:43 | |
*** lucielejard has joined #zope3-dev | 15:47 | |
*** ignas has quit IRC | 15:47 | |
*** afd_ has joined #zope3-dev | 15:52 | |
pyqwer | srichter: Ok, I got around buildout this time :-> I just sent you the two changed files for checkin. | 15:58 |
pyqwer | projekt01: I still have these security problems here (objects are not proxied), as I read that you are up to high security standards and probably use IPageletBrowserLayer I wonder if you also experience such problems? | 16:00 |
projekt01 | yes, I will add a ISecureLayer to z3c.layer.security | 16:01 |
*** maurits__ has joined #zope3-dev | 16:02 | |
pyqwer | projekt01: So this means, there's a but that will be fixed? | 16:02 |
projekt01 | the trusted part is not a bug it's needed if you have nested ISite with own PAU installed | 16:02 |
pyqwer | s/but/bug | 16:02 |
projekt01 | no there will be a new layer next to the existing one | 16:03 |
*** maurits has quit IRC | 16:03 | |
*** maurits__ is now known as maurits | 16:03 | |
projekt01 | that's not a bug that's a simpe configuration which allows you to use nested ISite | 16:03 |
romanofski | hi maurits :) | 16:03 |
maurits | hi romanofski | 16:03 |
pyqwer | Hmmm, It seems we are talking of different things. I have a _very_ simple example, existing of one object and one view. And if I use IPageletBrowserLayer, the object is not proxied any more. | 16:03 |
pyqwer | It's very strange: On some occasions, it is proxied, but when I add objects, it's not. | 16:04 |
projekt01 | Yes, that's fine | 16:04 |
*** mweichert has quit IRC | 16:04 | |
pyqwer | Especially, directly after a login, it is proxied. | 16:04 |
projekt01 | nobody can do anything with that unproxied object except you have bad views with wrong permission settings accessible for that object | 16:05 |
projekt01 | I think it depends on which traverser servers your view | 16:05 |
projekt01 | some of them are registered as trusted which will remove the proxy | 16:05 |
projekt01 | see the z3c.layer.pagelet configure.zcml | 16:06 |
* maurits colleagues are playing with/repairing the wireless/adsl. | 16:06 | |
pyqwer | Ok, but that means that configuring security on object/class attributes are senseless when using IPageletBrowserLayer? | 16:06 |
projekt01 | you can simply override them in your layer or define a own layer and configure them again as NOT trusted | 16:06 |
*** sp0cksbeard has joined #zope3-dev | 16:07 | |
projekt01 | the pagelet layer implementation was a copy of our project whihc needs trusted traverser, that was probably bad that we didn't cleanup the trusted part | 16:07 |
projekt01 | But I guess if we remove them we will bring a lot of people in trouble which do not know how to configure permissions | 16:08 |
*** maurits has quit IRC | 16:08 | |
*** ignas has joined #zope3-dev | 16:08 | |
*** malthe has quit IRC | 16:08 | |
projekt01 | I think it's better to add a secure layer which explicit is NOT trusted | 16:09 |
pyqwer | projekt01: Hmmm, I can't completely follow you - does this mean that permissions should be mapped to views only? | 16:09 |
afd_ | projekt01: my two cents, I'd say the least surprise for a zope developer would be to get proxied objects | 16:09 |
projekt01 | with pagelet layer, yes | 16:09 |
afd_ | although I admit that may be just me being used to proxied objects | 16:09 |
pyqwer | afd_: Well, after reading Phillips book I had the impression that objects are proxied everywhere. | 16:10 |
projekt01 | If we really like ot cleanup this, we need to fix the broken parent lookup implementation in Zope | 16:10 |
pyqwer | The problem about not having security on objects is that some silly page-template developer may thus reveal data that should be accessible. | 16:11 |
pyqwer | Ah, NOT be accessible. | 16:11 |
projekt01 | pyqwer, you only have to change the 3 trusted traverseing adapter in the pagelet layer, then you are fine | 16:12 |
* pyqwer looking at z3c.layer.pagelet/configure.zcml | 16:13 | |
projekt01 | But I think if poeple don't know how security works it doesn't matter if there is a trusted adapter and a proxied object or not | 16:13 |
pyqwer | projekt01: Well, yes and no. I'm no expert but I followed the guidelines in Philipps book, configured permissions/roles/classes, everything was fine. | 16:14 |
projekt01 | remember the z3c.layer package offers only a simple implementation of a layer, just copy that and remove the trusted="True" arguments from the adapter configurations | 16:15 |
pyqwer | And then just added the IPageletBrowserLayer to my request and the security was gone (And I was not even aware of it for quite some time as things continued to work). | 16:15 |
pyqwer | So I think there should a big WARNING at some of the Readme's that point that out. | 16:16 |
projekt01 | that's the problem with general phrases in books, it doesn't work like this. Yes, everything get proxied in zope, BUT, if you use trusted adapters they get removed during adaption | 16:16 |
projekt01 | so it is really important to know what component you are using in zope and to understand what each piece does. | 16:17 |
*** faassen has joined #zope3-dev | 16:17 | |
projekt01 | there is so quick some bad code loaded from a package which does really bad things | 16:17 |
pyqwer | Ah, now I understand it. Because I digged into the source code and wondered why the heck queryAdapter removed the security proxy. | 16:18 |
projekt01 | it's just a onliner in zcml trusted="True" | 16:18 |
pyqwer | Yes, I can see that now. | 16:18 |
pyqwer | it's in zope.traversing.browser.zcml | 16:19 |
projekt01 | do you understand why I don't like ot much packages installed on a server which I don't know? | 16:19 |
pyqwer | projekt01: Yes, I think I do now. | 16:19 |
projekt01 | there are som many ways in zope wich allows others to open backdoors in thier packages | 16:19 |
projekt01 | that's the bad thing about a component architecture ;-) | 16:20 |
pyqwer | It definitely is. | 16:20 |
projekt01 | I implemented one of this backdoors in z3c.layer.pagelet ;-( | 16:21 |
projekt01 | but the good thing this door is locked till somebody does bad things in views | 16:21 |
*** sp0cksbeard has quit IRC | 16:22 | |
pyqwer | Hmmm, well, it's not only up to the programmer of the views, unfortunately security may thus be shifted to the pagetemplate designer, which should never happen. | 16:22 |
srichter | pyqwer: I agree | 16:23 |
srichter | I think we should try harder not to use trusted=Truw | 16:23 |
*** jsadjohnson has joined #zope3-dev | 16:24 | |
pyqwer | srichter: I think we should point out this problem in z3c.form also, as most people seem to start out with z3c.form and are even not aware of pagelets that much. | 16:24 |
srichter | well, it is not really a problem in z3c.form, but that of the traversal | 16:25 |
*** baijum has quit IRC | 16:26 | |
projekt01 | srichter, can you remeber the broken parent lookup in zope, this doesn't let us to use trusted views only for one context? | 16:27 |
projekt01 | The __parent__ lookup in the while loop should use the adaption pattern for parent lookup | 16:27 |
pyqwer | srichter: True, nevertheless people may start out using z3c.form without looking at other packages at all. | 16:27 |
*** alga has joined #zope3-dev | 16:28 | |
srichter | projekt01: yeah, but if anonymous always has the permission to __getitem__ (and maybe some other methods on the container) it should work, right? | 16:28 |
projekt01 | then this is fixed and we can use trusted adatper for ISite object whihc need to allow to traverse to sub ISite | 16:28 |
*** J1m has joined #zope3-dev | 16:28 | |
projekt01 | not it doesn't | 16:28 |
srichter | ok, so we need to allow __parent__ as well | 16:28 |
projekt01 | no we need to get the right trusted traverser per context | 16:29 |
projekt01 | and not at the end of the parent lookup chain | 16:29 |
srichter | mh, then I don't remember the problem fully | 16:30 |
projekt01 | remember the parent site is protected becaues this is the management tool for sub sites | 16:30 |
projekt01 | the subsite is the extranet for one customer | 16:30 |
projekt01 | I know that's probably a wired use case but that's the concet if one site manages different CMS sites | 16:30 |
projekt01 | the management (parent) site is the protected site and sub sites are probably public | 16:31 |
projekt01 | that's how each CMS works it it uses sub sites | 16:31 |
projekt01 | that's not possible without trusted traversers at the end of the chain (e.g. view), and this makes the parent chain trusted to the root | 16:32 |
*** faassen has quit IRC | 16:42 | |
*** danielblackburn has quit IRC | 16:45 | |
pyqwer | Hmmm, now I disabled the trusted=True directive and there are a lot of permission problem. :-( | 16:46 |
pyqwer | For instance, it makes a difference when accessing a container with "index.html" and without. Hmmm. | 16:47 |
projekt01 | pyqwer, that's the reason why I don't disable them in the package, it whould be a pain for others to fix thier apps wihtout any security knowledge | 16:50 |
pyqwer | projekt01: But is it fixable? Or are there some security quirks that are not? | 16:50 |
projekt01 | ther is nothing to fix becasue we have to concepts of traversing, trusted or not trusted, the pagelet layer offers the trusted traversal concept. | 16:51 |
*** yvl has left #zope3-dev | 16:51 | |
pyqwer | Btw., is there a simple way to tell Zope3 to somehow log what attribute lacks the required permissions? E.g. via raising an error? | 16:51 |
projekt01 | it's a bad idea to change this. it will hurt other developers which need a trusted layer | 16:52 |
pyqwer | No, only for me, as I don't know which are the offending attributes (and all I can see is the login page). | 16:52 |
projekt01 | see the security tool from daniel, I guess that's the only thing we have in zope for good security review | 16:52 |
projekt01 | He is working very hard since the last Boston sprint on that tool | 16:53 |
pyqwer | Well, my approach is to deny all and carefully permit access to certain attributes. | 16:54 |
afd_ | pyqwer: I think if you configure the root error log utility not to ignore Unauthorised exceptions you'll get details about what attribute and permissions you need to have | 16:56 |
pyqwer | afd_: Ah, that's possible? How? | 16:57 |
afd_ | just go to ZMI, error tab and take out the Unauthorized from that list | 16:57 |
pyqwer | afd_: Hmmm, I don't have/use ZMI - at least not at my local errorReportingUtility. So I assume, there's a way to set that directly? | 16:58 |
afd_ | I'm not sure, you could check the relevant packages source code | 16:59 |
pyqwer | Ok, I'll do that. | 16:59 |
*** danielblackburn has joined #zope3-dev | 16:59 | |
*** malthe has joined #zope3-dev | 16:59 | |
pyqwer | Btw., z3c.securitytool seems to be broken in the current SVN. browser/configure.zcml is cluttered with what seems to be SVN messages. | 17:00 |
afd_ | pyqwer: just to make sure, do you have ZMI on you zope? if you can configure the root error utility it will be just as well, as far as I know | 17:00 |
pyqwer | Yes, I do have ZMI I just don't use it for my application, so I'll try that, thanks. | 17:01 |
*** norro has joined #zope3-dev | 17:02 | |
*** hdima has quit IRC | 17:04 | |
pyqwer | afd_: Yes, that seems to work. | 17:07 |
afd_ | should make debugging those permissions easier | 17:08 |
*** markusleist has joined #zope3-dev | 17:08 | |
pyqwer | afd_: Btw., I have to use the local error reporting utility, there I needed to remove the Unauthorized exception and view the errors via the ZMI. | 17:08 |
*** MJ has quit IRC | 17:11 | |
pyqwer | Hmmm, it's strange: The unauthorized attribute is "__getitem__". | 17:13 |
afd_ | you probably need security assertions for IReadContainer | 17:13 |
afd_ | IWriteContainer would be __setitem__ | 17:13 |
*** ignas has quit IRC | 17:16 | |
pyqwer | afd_: Yes, it was that simple, thanks, it was just IReadContainer. | 17:16 |
fcorrea | Hello there. Can a viewlet has a class and a template so the template can use the logic of the class like a view? | 17:18 |
pyqwer | Yes. | 17:18 |
pyqwer | The view has - I think - an update() method you can use, but let me have a look... | 17:18 |
pyqwer | Ah, s/view/viewlet | 17:19 |
fcorrea | mmm...Just wondering if I can cook some tal inside the class and render it on the template | 17:19 |
afd_ | fcorrea: just register the viewlet with a template attribute and set inside that template tal:content="view/mysomething" | 17:19 |
afd_ | just like you'd do with a regular view | 17:19 |
pyqwer | Why would you do tal inside the class/python code? | 17:20 |
*** jodok has quit IRC | 17:20 | |
fcorrea | afd_: Dos the viewlet directive support the allowed_attributes from a view? I will check if I can just call it | 17:20 |
pyqwer | I don't think so. | 17:21 |
pyqwer | allowed_attributes are for content objects only. | 17:21 |
fcorrea | pyquer: I need to return a series of metal:use-macro for the template and the template needs to render it | 17:21 |
pyqwer | You can only give permissions to the whole viewlet. | 17:21 |
fcorrea | That's what I thought | 17:22 |
afd_ | fcorrea: you can do something like this: | 17:22 |
pyqwer | What you can do - although I don't like tal code in the class - to override the render method. | 17:22 |
afd_ | inside your viewlet: mymacros = ViewPageTemplate('template_with_macros.pt'_ | 17:22 |
afd_ | and then inside your viewlet's template | 17:22 |
*** jodok has joined #zope3-dev | 17:22 | |
pyqwer | Yes, that should do it. | 17:23 |
afd_ | metal:use-macro="view/mymacros/macros/macroname" | 17:23 |
afd_ | but you'd have an easier life using z3c.macro :) | 17:23 |
pyqwer | Or don't use macros at all :-) | 17:23 |
fcorrea | That'd would be cool. Let me try it. | 17:23 |
afd_ | pyqwer: why not use macros? as a templating mechanism, they're great | 17:23 |
fcorrea | aft_, pyqwer: This is a plone2.5 with a requirement like: Get plone.portlets like runing on plone2.5 | 17:24 |
pyqwer | fcorrea: Ok, then use macros ;-) | 17:24 |
fcorrea | hehe, k thanks | 17:24 |
*** whit has joined #zope3-dev | 17:24 | |
pyqwer | afd_: I don't like macros that much, I prefer viewlets/pagelets. | 17:24 |
fcorrea | pyqwer: I am kinda doing a frankeinstein here. I ZopeFind() all templates with "portlet" macros and render them in a viewlet :D | 17:25 |
fcorrea | Well, that's what I am trying to do :) | 17:25 |
afd_ | viewlets won't help a lot getting rid of macros, pagelets might go some way | 17:27 |
afd_ | I'm not saying go crazy with macros like plone, but for general use templates (for example, defining how a box looks like), I think they're still ok | 17:27 |
pyqwer | Yes, maybe, I just try to use as less technology as possible. And macros can get quite complex, too. So in my case, things work out well without macros. | 17:28 |
afd_ | yes | 17:29 |
fcorrea | I agree with both of you. I usually use z3c cool stuff on z3 projects only...but this one is different. It is zope2.9 + Five | 17:29 |
danielblackburn | pyqwer: z3c.securitytool was just updated in the svn, and seems fine when I do an update | 17:30 |
*** maurits has joined #zope3-dev | 17:32 | |
*** ghendi has quit IRC | 17:33 | |
*** danielblackburn has quit IRC | 17:33 | |
* Theuni found another error while using persistent zeo caches | 17:33 | |
*** danielblackburn has joined #zope3-dev | 17:33 | |
*** sorindregan has quit IRC | 17:34 | |
*** rmarianski has joined #zope3-dev | 17:34 | |
*** pcardune has joined #zope3-dev | 17:36 | |
pyqwer | danielblackburn: yes, thanks, it seems to work again. | 17:36 |
danielblackburn | pyqwer: cool, I would also appreciate any feedback you may have. I will be announcing the beta pretty soon | 17:37 |
pyqwer | danielblackburn: Ok, I'll do that. | 17:37 |
danielblackburn | pyqwer: thanks! | 17:38 |
pyqwer | Thank YOU for z3c.securitytool :-) | 17:38 |
danielblackburn | pyqwer: no prob | 17:38 |
*** nathany has joined #zope3-dev | 17:39 | |
fcorrea | afd_: It didn't work. The viewlet is blind about the methods inside it. The render method wont interpret the metal:use-macros...only a page template can do that. | 17:46 |
afd_ | fcorrea: I think it should, could you show the code? | 17:46 |
fcorrea | sure | 17:46 |
fcorrea | sec | 17:47 |
afd_ | ok | 17:47 |
pyqwer | projekt01: Thanks a LOT for the hint on trusted="True", things seem to work out now. Great! | 17:48 |
fcorrea | aft_: http://paste.plone.org/19638 | 17:48 |
pyqwer | I simply use an override.zcml file that overrides these three adapters without trusted="True". I wonder if it wouldn't be an idea to include this file along with some z3c-projects and point out what it's about. | 17:49 |
*** afd__ has joined #zope3-dev | 17:49 | |
fcorrea | The question is: How to render the macros in a viewlet ? :D | 17:50 |
afd__ | fcorrea: move the macro template in a file | 17:50 |
afd__ | and set macro_template = ViewPageTemplateFile('path/file.pt') | 17:50 |
afd__ | inside the template, instead of: | 17:50 |
afd__ | # | 17:50 |
afd__ | <metal:view tal:replace="structure view/portlet_macros"></metal:view> | 17:50 |
afd__ | you should do the regular way | 17:50 |
afd__ | metal:use-macro="view/macro_template/macros/macro_name" | 17:51 |
afd__ | ok, I should look closer to your code | 17:51 |
afd__ | you're doing something trickier :) | 17:51 |
fcorrea | afd__ : The point is that the macro paths are dynamic and returns as strings that I need to render. I don't have one singe macro so I can point...they just appear as a result of the computation | 17:52 |
*** goschtl has quit IRC | 17:53 | |
fcorrea | aft__: What I am after, maybe, is something like: ViewPageTemplate(macro_string) | 17:54 |
fcorrea | instead of a file | 17:54 |
afd__ | yes, that could be | 17:54 |
fcorrea | Do you know if there is such thing? | 17:54 |
afd__ | there is PageTemplate | 17:55 |
*** menesis has quit IRC | 17:55 | |
afd__ | PageTemplateFile subclasses it and adds some stuff to read the file content | 17:55 |
srichter | fcorrea: have a look at z3c.template | 17:55 |
srichter | fcorrea: it allows you to select a macro and makes it behave like a page template | 17:55 |
fcorrea | srichter: Thanks, but this is a zope2.9 + Five and I don't think it will work in there | 17:56 |
srichter | mmh, I would try it | 17:56 |
fcorrea | Well, I don't have more hair to tear off so I can try anything :) | 17:57 |
*** natea has quit IRC | 17:57 | |
*** jayaraj has joined #zope3-dev | 17:59 | |
afd__ | fcorrea: looking in the PageTemplateFile implementation, it seems that you could subclass it and override some of its method to feed it a string instead of it looking in a file | 18:00 |
*** jodok has quit IRC | 18:00 | |
fcorrea | afd__ : Thanks, I am trying ZopePageTemplate first. I got a good hint on TemplateFields plone product | 18:01 |
*** alga has quit IRC | 18:05 | |
pyqwer | danielblackburn: I'm just playing around with securitytool, it works for the root site, but not for mine. Any clue why? | 18:06 |
*** afd_ has quit IRC | 18:06 | |
pyqwer | I get a 404 when appending @@securityMatrix.html to my site. | 18:06 |
*** ignas has joined #zope3-dev | 18:09 | |
srichter | pyqwer: maybe the tool runs on a different skin? also try vum.html | 18:09 |
afd__ | pyqwer: you probably have a different skin | 18:09 |
pyqwer | Yes, I have a different skin - my application needs specific layers. | 18:10 |
pyqwer | perhaps I need to register these views for my layer? | 18:11 |
srichter | yes | 18:11 |
srichter | though you should be able to simply reuse the security tool skin | 18:11 |
pyqwer | srichter: how would I do that? | 18:12 |
pyqwer | By manually specifying a skin? | 18:12 |
srichter | let me check how the security matrix is registered | 18:12 |
srichter | pyqwer: ok, the views are registered against the default layer | 18:13 |
srichter | pyqwer: do you have rotterdam? | 18:13 |
pyqwer | Ah, yes, it works with rotterdam! | 18:13 |
srichter | you can select your skin in the tool, so you get all the info you need | 18:13 |
pyqwer | Yes, right. | 18:13 |
*** danielblackburn has quit IRC | 18:15 | |
pyqwer | Hmmm, but it does not seem of too much use as it shows only the permissions for zope.manager. | 18:16 |
pyqwer | I can't see any other of my defined roles than zope.manager. Hmmm, I'll contact daniel for that. | 18:20 |
*** natea_ has joined #zope3-dev | 18:22 | |
pyqwer | Ah, I got it. I simply need to be logged in to see the permissions for the current principal. | 18:22 |
*** rmarianski has quit IRC | 18:23 | |
*** jayaraj has quit IRC | 18:27 | |
*** dobee has quit IRC | 18:27 | |
*** reco has quit IRC | 18:29 | |
*** reco has joined #zope3-dev | 18:36 | |
*** zagy has quit IRC | 18:39 | |
*** menesis has joined #zope3-dev | 18:45 | |
*** b52laptop has quit IRC | 18:49 | |
*** b52laptop has joined #zope3-dev | 18:50 | |
*** rmarianski has joined #zope3-dev | 18:56 | |
*** dobee has joined #zope3-dev | 18:57 | |
*** pelle_ has quit IRC | 18:59 | |
*** markusleist has quit IRC | 19:03 | |
*** baijum has joined #zope3-dev | 19:06 | |
*** malthe has quit IRC | 19:06 | |
*** malthe has joined #zope3-dev | 19:08 | |
*** baijum has quit IRC | 19:09 | |
*** jpcw2002 has left #zope3-dev | 19:20 | |
*** projekt01 has quit IRC | 19:25 | |
*** markusleist has joined #zope3-dev | 19:26 | |
*** harobed has quit IRC | 19:27 | |
*** danielblackburn has joined #zope3-dev | 19:28 | |
*** davidstryker has joined #zope3-dev | 19:30 | |
*** Theuni has quit IRC | 19:34 | |
*** davidstryker has left #zope3-dev | 19:35 | |
*** Theuni has joined #zope3-dev | 19:37 | |
*** toutpt has quit IRC | 19:39 | |
*** danielblackburn has quit IRC | 19:41 | |
fcorrea | Hey, I am debugging my code here and while doing it I reached PageTemplate. That is very cool that is has variables like c . Pdb simply wont print it | 19:41 |
bigkevmcd | print c | 19:43 |
bigkevmcd | or rather pp c | 19:43 |
fcorrea | that did the trick. Thanks | 19:46 |
bigkevmcd | people naming varilables like "c" or "s" or "n" is bad for pdbing through :-) | 19:47 |
bigkevmcd | s/varilables/variables/ | 19:47 |
*** philiKON has joined #zope3-dev | 19:50 | |
*** malthe has quit IRC | 19:51 | |
*** pbugni has joined #zope3-dev | 19:53 | |
*** rmarianski has quit IRC | 19:54 | |
*** rmarianski has joined #zope3-dev | 19:55 | |
*** quodt has quit IRC | 20:03 | |
*** whitmo has joined #zope3-dev | 20:03 | |
*** whit has quit IRC | 20:03 | |
*** whitmo has quit IRC | 20:09 | |
*** whit has joined #zope3-dev | 20:09 | |
*** whit has quit IRC | 20:13 | |
*** benji has quit IRC | 20:13 | |
*** whit has joined #zope3-dev | 20:13 | |
*** markusleist has quit IRC | 20:13 | |
*** benji has joined #zope3-dev | 20:14 | |
foodels | hey! What's the simplest way to provide my own zpt instead of the standard one used for login (@@loginForm.html) | 20:15 |
*** whitmo has joined #zope3-dev | 20:17 | |
*** RaFromBRC has joined #zope3-dev | 20:20 | |
*** whitmo has quit IRC | 20:21 | |
*** whitmo has joined #zope3-dev | 20:21 | |
*** whitmo has joined #zope3-dev | 20:22 | |
*** jukart has quit IRC | 20:28 | |
*** maurits has quit IRC | 20:28 | |
*** natea_ is now known as natea | 20:29 | |
*** agroszer_ has joined #zope3-dev | 20:30 | |
*** danielblackburn has joined #zope3-dev | 20:33 | |
*** whit has quit IRC | 20:36 | |
*** whit has joined #zope3-dev | 20:41 | |
hazmat | foodels, override the login form either in your own layer, or directly in an overrides.zcml | 20:42 |
*** agroszer has quit IRC | 20:44 | |
fcorrea | afd__ : still around? I got it working :). Now I have a @@manage_portles that stores portlet configuration in annotation using old-style plone portlets | 20:48 |
*** whit has quit IRC | 20:49 | |
*** natea has quit IRC | 20:54 | |
*** whitmo has quit IRC | 20:57 | |
*** whit has joined #zope3-dev | 20:58 | |
foodels | hazmat: ah, cheers.. | 21:00 |
*** pelle_ has joined #zope3-dev | 21:01 | |
*** thruflo has quit IRC | 21:01 | |
*** pcardune_ has joined #zope3-dev | 21:15 | |
*** mgedmin has joined #zope3-dev | 21:16 | |
*** niemeyer has quit IRC | 21:18 | |
*** niemeyer has joined #zope3-dev | 21:18 | |
*** quodt has joined #zope3-dev | 21:20 | |
*** sp0cksbeard has joined #zope3-dev | 21:21 | |
*** febb has joined #zope3-dev | 21:29 | |
febb | hola !! hi all. ! | 21:31 |
*** rmarianski has quit IRC | 21:33 | |
*** pcardune has quit IRC | 21:33 | |
*** febb has quit IRC | 21:36 | |
*** dobee has quit IRC | 21:42 | |
*** whit is now known as whit|blt | 21:42 | |
*** ignas has quit IRC | 21:49 | |
*** rmarianski has joined #zope3-dev | 21:55 | |
*** febb has joined #zope3-dev | 21:57 | |
afd__ | fcorrea: how did you do it? | 22:05 |
*** markusleist has joined #zope3-dev | 22:08 | |
*** mkerrin has quit IRC | 22:09 | |
*** menesis has quit IRC | 22:09 | |
*** febb has quit IRC | 22:11 | |
*** greenman has joined #zope3-dev | 22:14 | |
*** danielblackburn has quit IRC | 22:18 | |
*** salfield has quit IRC | 22:22 | |
*** dunny_ has joined #zope3-dev | 22:32 | |
fcorrea | afd__ : Needed to use PageTemplate instead of ZopePageTemplate. For that I neede to put everything back in the extra_context of pt_render(). Now it works properly | 22:36 |
afd__ | cool | 22:37 |
fcorrea | It is nasty but works | 22:37 |
*** dunny has quit IRC | 22:40 | |
*** Macarse has joined #zope3-dev | 22:41 | |
mgedmin | the multitude of page template classes is confusing | 22:41 |
Macarse | hi | 22:41 |
fcorrea | indeed | 22:45 |
*** whit|blt is now known as whit | 22:59 | |
*** RaFromBRC has quit IRC | 23:02 | |
*** dobee has joined #zope3-dev | 23:04 | |
*** quodt_ has joined #zope3-dev | 23:05 | |
*** reco has quit IRC | 23:05 | |
*** RaFromBRC has joined #zope3-dev | 23:19 | |
*** agroszer_ has quit IRC | 23:21 | |
*** quodt has quit IRC | 23:23 | |
*** mgedmin has quit IRC | 23:30 | |
*** quodt has joined #zope3-dev | 23:34 | |
*** BjornT has quit IRC | 23:35 | |
*** BjornT has joined #zope3-dev | 23:36 | |
*** d2m has quit IRC | 23:51 | |
*** quodt_ has quit IRC | 23:53 |
Generated by irclog2html.py 2.15.1 by Marius Gedminas - find it at mg.pov.lt!