On Sep 28, 2005, at 7:03 PM, Ludovic Dubost wrote: If I do this, can the groovy code then access the xwiki document that is including the groovy document? BTW, $xwiki.renderText(groovyScript, $doc) in the vm file also seems to work. I understand the performance implications if the compiled groovy code isn't cached (but I thought it was...?), but what are the security implications if I control what goes in the vm file? Thanks, Matt

On Sep 29, 2005, at 3:13 PM, Ludovic Dubost wrote: I still don't see the problem - probably just because I'm not as familiar with the system as you are :) Say I use the renderText() method to run some groovy, and someone creates a skin that overrides my vm file, they still aren't executing anything other than what I enabled in my vm file - in fact they are explicitly choosing to not execute my groovy code unless they include it somehow. Or are you saying that that to alllow groovy scripts in general in vm files would be a security risk because then any skin could include a groovy script in them? If thats the case, isn't this just a matter of adding the programming rights check to the vm files in the skin? Having the ability to use a scripting language in the vm files is great for allowing me to quickly prototype stuff, or for others to customize xwiki behavior without having to go through the overhead of creating a plugin - but only if it can be done without creating a security risk. Matt