On Feb 28, 3:04 am, Michael Pavling <pavl...@gmail.com> wrote: > On 27 February 2010 21:15, Dudebot <craign...@gmail.com> wrote: > > > Needless to say, this code is *not safe*. A user can run anything in > > that eval. In my application, only trusted users have access to > > building templates. > > I don't think it's needless... I think it's extremely important to > say. For anyone reading this post and thinking it's a solution to > their problem - if anyone sat back and presented this as a "fix" to > me, I would fire them for their recklessness :-/
That's exactly why I said it ;) Believe it or not, in this particular application we have written contracts with the administrators that would be creating templates (for other reasons as well.) However, I am eager to find a better way, and thanks, Jarin, for the reference to Liquid! Thanks, Craig -- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-t...@googlegroups.com. To unsubscribe from this group, send email to rubyonrails-talk+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en.
