Is it possible to have groovy script in the "*.vm" templates that are in a custom (or default) skin? I tried adding some groovy script, but the script just got echoed verbatim to the output html. I have no problem adding groovy to an xwiki document. Matt
No this is not possible.. There are performance and security reasons for that.. If you want to do that you should refer to an xwiki document: #set($mydoc = $xwiki.getDocument("..")) #set($mydoc.renderedContent) and have groovy in the document Ludovic Matthew Conway wrote:
Is it possible to have groovy script in the "*.vm" templates that are in a custom (or default) skin? I tried adding some groovy script, but the script just got echoed verbatim to the output html. I have no problem adding groovy to an xwiki document.
Matt
------------------------------------------------------------------------
-- You receive this message as a subscriber of the [email protected] mailing list. To unsubscribe: mailto:[email protected] For general help: mailto:[email protected]?subject=help ObjectWeb mailing lists service home page: http://www.objectweb.org/wws
-- Ludovic Dubost XPertNet: http://www.xpertnet.fr/ Blog: http://www.ludovic.org/blog/ XWiki: http://www.xwiki.com Skype: ldubost AIM: nvludo Yahoo: ludovic
On Sep 28, 2005, at 7:03 PM, Ludovic Dubost wrote:
No this is not possible.. There are performance and security reasons for that.. If you want to do that you should refer to an xwiki document:
#set($mydoc = $xwiki.getDocument("..")) #set($mydoc.renderedContent)
and have groovy in the document
If I do this, can the groovy code then access the xwiki document that is including the groovy document? BTW, $xwiki.renderText(groovyScript, $doc) in the vm file also seems to work. I understand the performance implications if the compiled groovy code isn't cached (but I thought it was...?), but what are the security implications if I control what goes in the vm file? Thanks, Matt
The problem is that since skins and be done as XWiki pages, you might not control what goes in vm files.. Ludovic Matthew Conway wrote:
On Sep 28, 2005, at 7:03 PM, Ludovic Dubost wrote:
No this is not possible.. There are performance and security reasons for that.. If you want to do that you should refer to an xwiki document:
#set($mydoc = $xwiki.getDocument("..")) #set($mydoc.renderedContent)
and have groovy in the document
If I do this, can the groovy code then access the xwiki document that is including the groovy document?
BTW, $xwiki.renderText(groovyScript, $doc) in the vm file also seems to work.
I understand the performance implications if the compiled groovy code isn't cached (but I thought it was...?), but what are the security implications if I control what goes in the vm file?
Thanks,
Matt
------------------------------------------------------------------------
-- You receive this message as a subscriber of the [email protected] mailing list. To unsubscribe: mailto:[email protected] For general help: mailto:[email protected]?subject=help ObjectWeb mailing lists service home page: http://www.objectweb.org/wws
-- Ludovic Dubost XPertNet: http://www.xpertnet.fr/ Blog: http://www.ludovic.org/blog/ XWiki: http://www.xwiki.com Skype: ldubost AIM: nvludo Yahoo: ludovic
On Sep 29, 2005, at 3:13 PM, Ludovic Dubost wrote:
The problem is that since skins and be done as XWiki pages, you might not control what goes in vm files..
I still don't see the problem - probably just because I'm not as familiar with the system as you are :) Say I use the renderText() method to run some groovy, and someone creates a skin that overrides my vm file, they still aren't executing anything other than what I enabled in my vm file - in fact they are explicitly choosing to not execute my groovy code unless they include it somehow. Or are you saying that that to alllow groovy scripts in general in vm files would be a security risk because then any skin could include a groovy script in them? If thats the case, isn't this just a matter of adding the programming rights check to the vm files in the skin? Having the ability to use a scripting language in the vm files is great for allowing me to quickly prototype stuff, or for others to customize xwiki behavior without having to go through the overhead of creating a plugin - but only if it can be done without creating a security risk. Matt
participants (2)
-
Ludovic Dubost -
Matthew Conway