Re: [SMARTY-DEV] Re: Smarty and object support

Allowing multiple parameters, OK that's a given. But nesting objects as parameters, allowing constants, etc. is NOT good IMHO. Basically, an object call in your template is no different than a template function call. You call an object method to retrieve some text. These methods can take any number of values as parameters. These values should be limited to the same syntax we allow for template function parameters. Example: {$foo->bar("foobar",$foobar,#foobar#,%foobar%)} Here's where I see problems with the others: {$foo->bar(_MY_CONSTANT)} Why allow a constant in the templates? Perceptively, templates know nothing about constants. If you want to use a constant, assign it and use $_MY_CONSTANT. We should stick to assigned values. I know that null is useful, so _maybe_ we'll allow null, although I'd lean toward sticking to rules and make $smarty.null available instead. {$foo->bar(passthru("cat /etc/passwd"))} Obvious problems, so no functions as parameters. You shouldn't need that in the templates anyways. If you do, think again and redesign your object/application. {$foo->bar($foo->bar("lala",$foo->_bar('foo','bar')); If we support this, we have to recursively parse and test for security (private function calls, etc.), function calls, etc. Design your objects and apps so the templates keep a minimal syntax. Thoughts? On Tue, 2002-12-17 at 03:00, André Rabold wrote: > Great work! It works for me but there is one annoyance: > > {$foo->bar('blah','blub')} doesn't work because you only check for > one > parameter. > I have modified Smarty_Compiler to allow multiple ones: > > Index: Smarty_Compiler.class.php > =================================================================== > RCS file: /repository/smarty/Smarty_Compiler.class.php,v > retrieving revision 1.135 > diff -r1.135 Smarty_Compiler.class.php > 238c238 > < if > (preg_match('!^\$\w+(?>(\[(\d+|\$\w+|\w+(\.\w+)?)\])|((\.|->)\$?\w+(?:\((?:' > . $this->_qstr_regexp . ')*\))*))*(?>\|@?\w+(:(?>' . $this->_qstr_regexp > . > '|[^|]+))*)*$!', $tag_command) || // if a variable > --- > > if > (preg_match('!^\$\w+(?>(\[(\d+|\$\w+|\w+(\.\w+)?)\])|((\.|->)\$?\w+(?:\((?:' > . $this->_qstr_regexp . > ')*(\s*,\s*(?:'.$this->_qstr_regexp.')*)*\))*))*(?>\|@?\w+(:(?>' . > $this->_qstr_regexp . '|[^|]+))*)*$!', $tag_command) || // if a variable > 1077c1077 > < $var_exprs = > preg_grep('!^\$\w+(?>(\[(\d+|\$\w+|\w+(\.\w+)?)\])|((\.|->)\$?\w+(?:\((?:' . > $this->_qstr_regexp . ')*\))?))*(?>\|@?\w+(:(?>' . $this->_qstr_regexp . > '|[^|]+))*)*$!', $tokens); > --- > > $var_exprs = > preg_grep('!^\$\w+(?>(\[(\d+|\$\w+|\w+(\.\w+)?)\])|((\.|->)\$?\w+(?:\((?:' . > $this->_qstr_regexp . > ')*(\s*,\s*(?:'.$this->_qstr_regexp.')*)*\))?))*(?>\|@?\w+(:(?>' . > $this->_qstr_regexp . '|[^|]+))*)*$!', $tokens); > 1131,1132c1131,1132 > < > < preg_match_all('!\[(?:\$\w+|\w+(\.\w+)?)\]|(->|\.)\$?\w+(?:\((?:' . > $this->_qstr_regexp . ')*\))?|^\w+!', $var_ref, $match); > --- > > > > preg_match_all('!\[(?:\$\w+|\w+(\.\w+)?)\]|(->|\.)\$?\w+(?:\((?:' . > $this->_qstr_regexp . > ')*(\s*,\s*(?:'.$this->_qstr_regexp.')*)*\))?|^\w+!', > $var_ref, $match); > > > --------------------------------------------------------- > > I've just added (\s*,\s*(?:'.$this->_qstr_regexp.')*)* to allow multiple > parameters. At this time > no blanks are allowed between the parameters and the comma or it will result > in a Smarty error > (because Smarty interprets it as a Smarty function parameter {func param=1} > and not as a > method parameter). > Now my application is working again. Woohoo! > > The only thing which I still would like to have are thing like NULL, TRUE > and FALSE as parameters. > Then you could do something like {$foo->bar(null,'blah')} which doesn't work > right now. Even > {$foo->bar(true)} isn't interpreted correctly. > > Perhaps the best thing would be a recursion for each specified parameter if > an object's method is called. > Then you could even use a syntax like {$foo->foo_it($bar->bar_it(true))} > which looks a bit complex > but is really usefull sometimes ;-) I'll try to implement this ... > > André > > > > > > > > "Monte Ohrt" <monte@ispi.net> schrieb im Newsbeitrag > news:1040068296.11922.76.camel@lena.ispi.prv... > > I committed to CVS, this syntax is now allowed: > > > > {$foo->bar('blah')} > > {include file=$foo->bar('blah')} > > {include file=$foo->bar->bar2->bar3->bar4('blah')} > > > > You can also embed template vars: > > > > {$foo->bar("you $foo")} > > {include file=$foo->bar("this is $my var")} > > > > Please help test this, it affects many core components. > > > > Monte > > > > -- Monte Ohrt <monte@ispi.net>