Cool, I'd like to at least have the discussion about that, though.

What I'd like to see, if possible, is read-only access to the repository--access to the SELECT statement, for instance, and a way to iterate over the results and output them into the pages.

To anyone afraid that I'll be calling for full-blown CMS features next, I'll note that hooks and the ability to display arbitrary repository content are the only features I've missed after nearly two years of Fossil use. I'm using it quite happily for the http://spielproject.info pages, but I'd love to display the last 5-10 events on the front page to liven it up a bit. Events are how I announce releases. I could also see displaying timeline entries and such to show the X most recent commits on certain pages, etc.

Yeah, I know I can do this with Javascript, but that doesn't make the content searchable.

Thanks.


On 02/16/2012 08:00 AM, Richard Hipp wrote:


On Thu, Feb 16, 2012 at 8:49 AM, Nolan Darilek <[email protected] <mailto:[email protected]>> wrote:

    On 02/16/2012 06:55 AM, Richard Hipp wrote:


    On Wed, Feb 15, 2012 at 11:15 PM, Nolan Darilek
    <[email protected] <mailto:[email protected]>> wrote:

        So is it currently possible to use TH1 to generate dynamic
        webpages? Could I use it to, say, select the last 5 events
        and display them on the main page? Or is that still out of reach?

        Just curious, since it seems like there are lots of scripting
        possibilities coming down the pipeline.
        Thanks!


    I was once open to this kind of thing.  But since the security
    risks have been pointed out to me, I'm now very reluctant to do
    anything like this.



    I thought the point of TH1 was that it prevented this type of
    thing, that's why it's used in reporting. If TH1 isn't a secure,
    minimal TCL that can generate reports and, presumably, might be
    expanded a bit to pull and display information on artifacts, then
    what is it?


TH1 is secure by virtual of being minimalist. It really doesn't do much beyond simple variable substitution and if-then-else. The point is, I want to keep it that way so that it does not evolve into a security threat. We want to keep the "attack surface" as small as possible.


    _______________________________________________
    fossil-users mailing list
    [email protected]
    <mailto:[email protected]>
    http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users




--
D. Richard Hipp
[email protected] <mailto:[email protected]>


_______________________________________________
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users

_______________________________________________
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users

Reply via email to