8:20 a.m.
Hi,
Having just updated our testing cobbler2 server to 2.0.9 (from 2.0.5),
it seems that cheetah templates no longer support the use of the #try
and #except directives.
Is there a particular reason for this?
Or is it an unintended consequence of the changes to support later
releases of cheetah?
The snippets here use try and except quite regularly (as do examples on
the cobbler wiki). Going through them all and coding around this is not
an attractive option.
The culprit appears to be the 'whitelist' in template_api.py
Is there a way to override this without editing that file, which I'd
rather not do if possible?
As an aside, how do i track down which bugs the (BUGF) entries in the
changelog refer to? some have BZ or trac numbers, but most don't.
thanks,
Stuart
--
Stuart Sears RHCA etc.
"It's today!" said Piglet.
"My favourite day," said Pooh.
9:24 a.m.
On Mon, 10 Jan 2011 14:20:54 +0000, Stuart Sears <stuart(a)sjsears.com> wrote:
Hi,
Having just updated our testing cobbler2 server to 2.0.9 (from 2.0.5),
it seems that cheetah templates no longer support the use of the #try
and #except directives.
Is there a particular reason for this?
Or is it an unintended consequence of the changes to support later
releases of cheetah?
The snippets here use try and except quite regularly (as do examples on
the cobbler wiki). Going through them all and coding around this is not
an attractive option.
The culprit appears to be the 'whitelist' in template_api.py
Is there a way to override this without editing that file, which I'd
rather not do if possible?
Yeah, I need to make that whitelist configurable. You can set
safe_templating to 0 in the settings file to completely disable this.
Basically, cobbler now takes additional control of cheetah to prevent
people with access to cobbler_web (and template/snippet editing) from
being able to run arbitrary python as root on the cobbler server. So,
disable safe_templating with caution. I'll add try and except to the
white list in the next release. I'll also see about making the white
list configurable.
As an aside, how do i track down which bugs the (BUGF) entries in
the
changelog refer to? some have BZ or trac numbers, but most don't.
Due to many reasons in the past, BZ and trac have been neglected. For
the most part I've fixed things brought up on the wiki. Also, I don't
go looking for the BZ/trac numbers that they fix at release time. I'm
currently working on both issues and hope to have a resolution to it in
the near future.
--
Scott Henson
Red Hat CIS Operator
WVU Alum BSAE/BSME
4877
days inactive
4877
days old
cobbler-devel@lists.fedorahosted.org
1 comments
2 participants
participants (2)
-
Scott Henson -
Stuart Sears