Martijn Faassen wrote:
Martin Dougiamas wrote:
Paul Everitt wrote:
The quotes switch DTML into "expr" (expression) mode. Outside of expressions, DTML is limited to very safe operations. Getting attributes (the dot) is an operation that requires the security machinery to get involved, to make sure that you have permission.
Oh. I was logged in as manager .... so I didn't think security was a problem. Is there any other way to do this?
I think you misunderstood Paul just now; he didn't mean security was a problem, he just intended to give an explanation of why the foo.bar trick only works in quotes. The quotes are simply a short cut to 'expr="foo.bar"', i.e.:
<!--#var "foo.bar"-->
is the same as
<!--#var expr="foo.bar"-->
but
<!--#var foo.bar-->
doesn't work, as apparently this expression is too complicated to evaluate safely without the quotes.
Well, it was not so much a misunderstanding, so much as a further plea for help with my original problem! :) The discussion on NG DTML is very interesting, but I'm still trying to call objects in "Aunty" folders using the current version of DTML. Putting it in quotes means that the contents of the DTML document are inserted "raw" into my current document, rather than being evaluated. ie:
I used to call DTML documents with
<!--#var myfunction-->
so now, since they are in a sibling folder under the root folder, (eg /myapp) I tried:
<!--#var myapp.myfunction-->
But it doesn't work any more - keeps giving KeyErrors.
The funny thing is that
<!--#var "myapp.myfunction"-->
correctly returns all the raw content of the DTML document, so it *can* find it OK.
Martin -- ### Martin Dougiamas -- Internet Agent is == i see ### Centre for Educational Advancement ### http://cea.curtin.edu/staff/martin