On Thursday 28 January 2010 05:31:49, Randy Brown wrote :
> Do you have any general guidance as to what is safe and what isn't?
I have: if it is written by Pm, it is safe. :-)
No, the actual code needs to be examined and it takes you time and effort, and
you read and learn in the process, yet nothing is completely bug-free.
But that's fine: when people find a bug, they tell you and you fix it. :-)
> I ask because I've got another directive in which I'd like to let markup
> appear on the page normally unless condition X exists:
>
> (:mydirective if X is true, let this markup evaluate:)
>
> where the markup could be any valid PmWiki markup.
>
> Here is how I am currently obtaining the argument:
>
> Markup('mydirective', 'directives',
> '/\\(:mydirective (.*?):\\)/e',
> "mydirective('$1')");
>
> I assume (I hope not too naively) that it's safe concatenate the argument,
> for example:
>
> saferesult = $Prefix.$arg.$Suffix;
>
> But I'm not so sure whether this is safe:
>
> return PRR($arg);
>
> Do I need to restrict the argument, or pass it through a filter before
> giving it to PRR()?
No, it should be ok -- although you may want to pass it through PSS() before,
to strip possible slashes added by the regexp engine.
Petko
> On Jan 27, 2010, at 9:47 PM, Petko Yotov wrote:
> > Hello. You can pass the string through MakePageName()
>
_______________________________________________
pmwiki-devel mailing list
pmwiki-devel@pmichaud.com
http://www.pmichaud.com/mailman/listinfo/pmwiki-devel
