dynamic wiki content (Re: FrontPage and AllPages)

[Simon Michael]

Just some thoughts on this -

Alexander Poslavsky wrote:

>>It's just a matter of enabling DTML script in pages. Then you'll be free
>>to make listings like http://zwiki.org/AllPages ,
>>http://zopewiki.org/AllPages , and whatever macro-type things you want.
>>Personally I would just bite the bullet and enable DTML on this wiki.
>>    
>>
>DTML scripting seems a *very* nice feature to have. If it is decided
>to activate this functionality, then we would be able to perform
>several of the wishes written in the WikiWishes-page.
>
>As member of the doc-team I would be very interested in seeing this
>feature be activated, but since it has not (yet) been activated, maybe
>somebody could point out the reasons for not doing so. It might be a
>valid technical reason or more mundane, just a lack of time.
>
We discussed this a little on irc. Excerpt:

 sm: well, you need it for dynamic lists etc, which everyone is so keen on
 lulu: yes...
 plovs: and a database frontend for the hardware database which should 
just be in a database
 sm: it weakens security more than moin macros, because it's an open 
ended scripting language - someone could write dtml to erase all zope 
objects (worst case)
 lulu: that's what I heard...
 sm: you can prevent that by restricting permissions of the wiki 
folder's owner
 lulu: sm: could we not have prewritten scripts that we can call...
 lulu: sm: but not editable...
 lulu: and anyone can "link" them in a page...
 sm: yes we could.. moin-a-likes.. but that would take a bit of time
 sm: which I seem to be terribly short of :)
 sm: it's probably a good idea; I personally find dtml worth the bother 
and use it everywhere
 lulu: sm: what skills would people need to write these scripts?
 lulu: and does anyone else in the team have them?
 sm: some python programming ability, willingness to dive into the zwiki 
codebase, with pointers from me
 lulu: sm: what if we drew up a list of specific scripts that we 
need....and put a bounty and a deadline on it?
 lulu: and is this a priority over and above the other things on the 
wish list?
 lulu: perhaps we should prioritise things on the wiki wish list?
 sm: that's a great idea
 sm: bounties make it easier for me (or anyone) to justify it

and then

 sm: lulu, plovs: but this issue of custom tags vs dtml can use some 
more discussion/exploration imho
 sm: we can see how it works out

because

- let's be sure we really want to spend resources implementing yet 
another strange scripting language. plovs' comment about databases makes 
me think this will be an open-ended task; more custom tags will always 
be wanted. DTML was (and is) a standard, documented, versatile.

- pro dtml: The security issue is quite manageable. We make sure the 
folder is owned by "nobody" or equivalent, and verify that user doesn't 
have the rights to delete anything in the wiki folder or above. This 
just requires a bit of attention and testing. Then we know that dtml in 
pages is similarly constrained, no matter who view it, and we can safely 
forget about it.

- will the moin-style macros work only in moin page type ? then you'll 
tend to have to use that markup. You probably would want these to work 
in all pages, or at least in both moin and restructured text. How hard 
will it be to make them work in RST ?

- anti dtml: related: right now DTML doesn't work in RST either. It's 
only available in the structured text and HTML page types.

Cheers
-Simon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-doc/attachments/20041117/cbe9096e/attachment.html>