On 17/02/2012, at 2:15 AM, Nolan Darilek wrote: > Cool, I'd like to at least have the discussion about that, though. > > What I'd like to see, if possible, is read-only access to the > repository--access to the SELECT statement, for instance, and a way to > iterate over the results and output them into the pages. > > To anyone afraid that I'll be calling for full-blown CMS features next, I'll > note that hooks and the ability to display arbitrary repository content are > the only features I've missed after nearly two years of Fossil use. I'm using > it quite happily for the http://spielproject.info pages, but I'd love to > display the last 5-10 events on the front page to liven it up a bit. Events > are how I announce releases. I could also see displaying timeline entries and > such to show the X most recent commits on certain pages, etc. > > Yeah, I know I can do this with Javascript, but that doesn't make the content > searchable. > > Thanks.
FWIW, you could turn a Jim Tcl interpreter into a "safe" interpreter by removing a handful of commands from the interpreter, such as: readdir, open, exec, source, cd, file To be most useful, read-only access to the fossil db (with some restrictions?) would also be required. Of course, Jim Tcl were used for hook scripts, this interpreter would need to be non-safe to be useful. Cheers, Steve > > > On 02/16/2012 08:00 AM, Richard Hipp wrote: >> >> >> >> On Thu, Feb 16, 2012 at 8:49 AM, Nolan Darilek <[email protected]> >> wrote: >> On 02/16/2012 06:55 AM, Richard Hipp wrote: >>> >>> >>> >>> On Wed, Feb 15, 2012 at 11:15 PM, Nolan Darilek <[email protected]> >>> wrote: >>> So is it currently possible to use TH1 to generate dynamic webpages? Could >>> I use it to, say, select the last 5 events and display them on the main >>> page? Or is that still out of reach? >>> >>> Just curious, since it seems like there are lots of scripting possibilities >>> coming down the pipeline. >>> Thanks! >>> >>> I was once open to this kind of thing. But since the security risks have >>> been pointed out to me, I'm now very reluctant to do anything like this. >>> >>> >>> >> I thought the point of TH1 was that it prevented this type of thing, that's >> why it's used in reporting. If TH1 isn't a secure, minimal TCL that can >> generate reports and, presumably, might be expanded a bit to pull and >> display information on artifacts, then what is it? >> >> TH1 is secure by virtual of being minimalist. It really doesn't do much >> beyond simple variable substitution and if-then-else. The point is, I want >> to keep it that way so that it does not evolve into a security threat. We >> want to keep the "attack surface" as small as possible. >> >> >> >> _______________________________________________ >> fossil-users mailing list >> [email protected] >> http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users >> >> >> >> >> -- >> D. Richard Hipp >> [email protected] >> >> >> _______________________________________________ >> fossil-users mailing list >> [email protected] >> http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users > > _______________________________________________ > fossil-users mailing list > [email protected] > http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users -- µWeb: Embedded Web Framework - http://uweb.workware.net.au/ WorkWare Systems Pty Ltd W: www.workware.net.au P: +61 434 921 300 E: [email protected] F: +61 7 3391 6002
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
