On Wed, Aug 29, 2012 at 11:26 AM, Marius Dumitru Florea
<[email protected]> wrote:
> Sorry, wrong key combination..
>
> On Wed, Aug 29, 2012 at 12:22 PM, Marius Dumitru Florea
> <[email protected]> wrote:
>> Hi devs,
>>
>> I need to have some Velocity macros in the file system because one use
>> case where I need them is when the database is empty. So I put them in
>> a new Velocity template file under /templates folder. I didn't want to
>> add them to macros.vm because they are very specific and not used very
>> often. Plus, I don't like the idea of putting all the macros in one
>> single file.
>>
>> I then tried to include these macros in my other template and some
>> wiki page using #template. It didn't work. Surprisingly, when I
>> attached the template with the macros to the skin it worked.
>>
>> By looking at the code I noticed that #template calls
>> XWiki#evaluateTemplate which (if I understood correctly) registers the
>> Velocity macros under
>> * '' (global) namespace if the template is part of a skin
>> * template name namespace if the template is not part of the skin.
>>
>> Both seem wrong:
>
> * in the first case, once you include the template the Velocity macros
> become available globally, for the entire farm, even with a different
> skin
> * in the second case, the Velocity macros are not visible in the
> including template/wiki page
>
> Since this cod is pretty old it's quite tricky to fix. Thomas
> suggested to use instead of '' and template name the current namespace
> so that #template behaves like a real include (e.g. like the include
> macro).
>
> WDYT?

Big +1, the skin behaviour is a security issue and the other one does
not make any sense (you can get variables and not macros...).

>
> Thanks,
> Marius
> _______________________________________________
> devs mailing list
> [email protected]
> http://lists.xwiki.org/mailman/listinfo/devs



-- 
Thomas Mortagne
_______________________________________________
devs mailing list
[email protected]
http://lists.xwiki.org/mailman/listinfo/devs

Reply via email to