in reply to question on tmpl_include
Hi
I'm guesings from the tag syntax that you're using HTML::Template. In which case, no, you can't put a tmpl_var inside an include. This is probably not a bad thing from a security point of view, as if it were possible, it'd be temptingly easy to do something like:
my $tpl = HTML::Template->new(); my $q = CGI->new(); $tpl->param( 'file' => $q->param('file') ); # Then in your template <tmpl_include name="<tmpl_var name=file>">
Which is all nice, until someone requests the page with /cgi-bin/myscript.pl?foo=bar&file=/path/to/my/secrets.
To work round it, I'd suggest using the tmpl_if constructs to include different specified alternatives depending on a variable's values:
<tmpl_if name="foo"> <tmpl_include name="foo.inc"> </tmpl_if> <tmpl_if name="bar"> <tmpl_include name="bar.inc"> </tmpl_if>
IIRC, the way this is implemented means that it can be wasteful if you have lots of includes within conditionals, as all the includes get opened at the parse stage. If you have SO many alternatives that this is unwieldy, then maybe you need to rethink how your application is working - maybe what you are trying to include is data that should, in fact, be passed into the template like other params? Or maybe HTML::Template's filter facilites might help?
cheers
ViceRaid
|
---|