On Thu, Feb 16, 2012 at 8:49 AM, Nolan Darilek <[email protected]>wrote:
> On 02/16/2012 06:55 AM, Richard Hipp wrote: > > > > On Wed, Feb 15, 2012 at 11:15 PM, Nolan Darilek <[email protected]>wrote: > >> So is it currently possible to use TH1 to generate dynamic webpages? >> Could I use it to, say, select the last 5 events and display them on the >> main page? Or is that still out of reach? >> >> Just curious, since it seems like there are lots of scripting >> possibilities coming down the pipeline. >> Thanks! >> > > I was once open to this kind of thing. But since the security risks have > been pointed out to me, I'm now very reluctant to do anything like this. > > >> >> >> I thought the point of TH1 was that it prevented this type of thing, > that's why it's used in reporting. If TH1 isn't a secure, minimal TCL that > can generate reports and, presumably, might be expanded a bit to pull and > display information on artifacts, then what is it? > TH1 is secure by virtual of being minimalist. It really doesn't do much beyond simple variable substitution and if-then-else. The point is, I want to keep it that way so that it does not evolve into a security threat. We want to keep the "attack surface" as small as possible. > > _______________________________________________ > fossil-users mailing list > [email protected] > http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users > > -- D. Richard Hipp [email protected]
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
