Re: Include acquisition

Daniel Dekany wrote:

> Wednesday, June 29, 2011, 1:13:28 PM, Denis Bredelet wrote:
> 
>> 
>> Daniel Dekany wrote:
>> 
>> 
>> You also know this feature?
>> http://freemarker.org/docs/ref_directive_include.html#ref_directive_include_acquisition
>> 
>> I didn't know about this feature. It is cool, but how do you make
>> sure templates are not loaded from a wrong place?
> 
> What exactly do you mean? The "*" is only replaced with the current
> directory, and then by its parent directories, until the template is
> found. So it's not like it searches the template everywhere.

What I mean is that I have things that have nothing to do with Freemarker at the root of the drive. If a template is missing, I am afraid this feature could load malicious content inadvertently.

> 
>> Eg. <#include "*/tmp/quickfix.ftl">
>> 
>> Is there a configuration setting that tells Freemarker /tmp is
>> off-limits?
> 
> No, but you have included "tmp" in the path above, so then why would
> you want to exclude "tmp"?

I want to exclude /tmp because that directory is typically world-writable.

-- Denis.

> 
>> A way to tell the minimum length or minimum prefix of the wildcard part.
> 
> Nope.
> 
> (FM acquisition do have a problems though... If template A includes
> template */B, and then template B includes */C, the searching of C
> starts from the (real) directory of B, not from the directory of A.
> Some may thinks that's all right, but it's just not how acquisition
> meant to work.)
> 
>> Cheers
>> -- Denis. 
> 
> -- 
> Best regards,
> Daniel Dekany
> 


------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2