Log in
Forgot your password?
The Dublin Core metadata element set
is a standard for cross-domain information resource description.
|
||
| Element | Description | Value |
|---|---|---|
| Identifier | resource ID | http://old.zope.org/Members/ivo/patches |
| Title | resource name | Ivo's patches |
| Description | resource summary | <dtml-var standard_html_header> <h2><dtml-var title_or_id></h2> <p> Every now and then I run into small problems with zope. I usually try to fix these with a patch which (hopefully) will make it into a next Zope release. </p> <h3>webdav anonymous login fix</h3> <p> As someone pointed out on #zope, it is possible to view folder contents using a webdav client as an anonymous user. <p> I.e. download <a href="http://www.webdav.org/cadaver/">cadaver</a>, open yourzopeserver:8080 and do ls. Then decide if you want anyone to be able to access this. Eventhough hiding this information may be security by obscurity, there are some things you just don't want everyone to see. </p> <p> This allows you to see, for example, the installed products on the server. A hacker might use this knowledge to exploit some known bug in a zope product if one exists. </p> <p> Most people (like me) probably think it's harmless to let old objects, documents etc linger around as you can't view them in listings through ftp or http. They don't realize webdav is running by default. Actually, it can't even be disabled! (z2.py -X -w80 won't do the trick!) </p> <p> Personally I'd rather see this secured. It's not possible to disable 'view contents information' for anonymous users in zope, as this will ruin your entire site (all anonymous access will then be disabled), so the solution would be to create a new permission for access contents through webdav. </p> <p> And that's what the following (trivial) patch does. </p> <p> After applying you'll get a new permission in your security tab, which is set to manager by default. To get the old behaviour back, just set the permission back to anonymous. </p> <p> Apply it using patch -p1 ../webdav.patch in your SOFTWARE_HOME (i.e. the Zope-2.3.2-src dir). </p> <p> Or just edit lib/python/webdav/Resource.py by hand :) </p> <p> I've tested it with Zope 2.3.2, I can't guarantee it will work with other versions (use at your own risk anyway). </p> <p> You can find the patch <a href="webdav_patch">here</a> </p> <h3>dtml-in improvement/fix</h3> <p> When using batching in dtml-in, why is 'previous-sequence' only defined at the first iteration of the current batch? And why is 'next-sequence' only defined at the last iteration of the current batch? </p><p> This behaviour makes it difficult to display a batch like this: </p><p><pre> -- begin sample -- Item N Item N+1 Item N+2 (link to previous items) (link to next items) -- end sample -- </pre> </p><p> Because the code would be something like: </p><p><pre> -- begin sample -- <dtml-in something start=query_start size=3> [do something with sequence-item] <dtml-if sequence-end> <!-- check if last item of batch --> <dtml-if previous-sequence> (link to previous items) </dtml-if> <dtml-if next-sequence> (link to next items) </dtml-if> </dtml-if> </dtml-in> -- end sample -- </pre> </p><p> However, if your batchsize is larger than 1, 'previous-sequence' will always be untrue at the last item (when next-sequence is true). </p><p> The only solution would be implement a second dtml-in after the first one purely for displaying the previous link. </p><p> Also, dtml-in would re-execute your "expr" (which it does not very efficiently),so if you want to avoid doing the "expr" twice, you'd have to store it temporarily using dtml-let (or my dtml-set tag ;). </p><p> The end result would be: </p><p><pre> -- start sample -- <dtml-let foo="expr"> <dtml-in foo start=start_query size=3> [do something with sequence-item] </dtml-in> <dtml-in foo start=start_query size=3> <!-- code below is safe, as the variables are only true at the resp. top and end, though the truly paranoid could check for sequence-start / -end patch #1 below would break such code! --> <dtml-if sequence-end> <dtml-if previous-sequence> (link to previous items) </dtml-if> <dtml-if next-sequence> (link to next items) </dtml-if> </dtml-if> </dtml-in> </dtml-let> -- end sample -- </pre> </p><p> And at this point I really would start to implement the batching myself in python :) </p><p> Of course, basically the same applies if you want both the previous/next link at the top of the batch display. </p><p> (Imagine you want both! :) </p><p> Either I'm missing something really obvious here, or the patches below make sense. There are two versions: </p><p> - patch #1: This version fixes the issue above by enabling the values of previous/next-sequence throughout the entire batch (and other related variables as well: X-sequence, X-sequence-start-index, X-sequence-end-index, X-sequence-size) (which may break existing sites), and </p><p> - patch #2: This version introduces new variablenames, leaving the behaviour of previous/next-sequence. </p><p> A third alternative would be to only define the variables at the top and bottom of the batch. </p><p> Both versions fix (I think) a grammatical error. </p><p> It's up to the DC guys if they feel like incorporating either of these patches in a next release :) </p><p> patch #1: define variables everywhere in the batch </p><p> This patch makes sure that the following variables are available through each iteration of dtml-in, for each item. </p><p> !!!!! This patch may break alot of dtml code !!!!!! </p><p> <ul> <li>next-sequence <li>next-sequence-start-index <li>next-sequence-end-index <li>next-sequence-size <li>previous-sequence <li>previous-sequence-start-index <li>previous-sequence-end-index <li>previous-sequence-size </ul> </p><p> You can find the patch <a href="dtml_in_patch_no1">here</a> </p><p> patch #2: introduce new variables </p><p> This patch introduces the variables </p><p> <ul> <li>batch-next-sequence <li>batch-next-sequence-start-index <li>batch-next-sequence-end-index <li>batch-next-sequence-size <li>batch-previous-sequence <li>batch-previous-sequence-start-index <li>batch-previous-sequence-end-index <li>batch-previous-sequence-size </ul> </p><p> Which behave exactly the same as the variables withouth 'batch-' in front, but these are available with each iteration/item of dtml-in, not just the first/last. This patch should not break any existing dtml code. </p><p> You can find the patch <a href="dtml_in_patch_no2">here</a> </p> <dtml-var standard_html_footer> |
| Creator | resource creator | ZopeOrgSite |
| Date | default date | 2001-06-27 10:56:32 |
| Format | resource format | text/html |
| Type | resource type | Software Package |
| Subject | resource keywords | Patches |
| Contributors | resource collaborators | |
| Language | resource language | |
| Publisher | resource publisher | No publisher |
| Rights | resource copyright | |
|
||
| Element | Description | Value |
| CreationDate | date resource created | 2001-06-27 10:56:32 |
| ModificationDate | date resource last modified | 2001-06-27 10:56:32 |
| EffectiveDate | date resource becomes effective | None |
| ExpirationDate | date resource expires | None |
Backlinks:
via
Google
/
Technorati
RDF:
view RDF data