|
|
Posted by Torgny Bjers on 08/12/05 11:12
Hello,
A while back I posted a question in relation to XSL namespaces and
callbacks, but never got a response, not even a flame, which I found a
bit odd for this list. :P I know this is pretty cutting-edge for PHP
since the XSL library has only been used in PHP 5, well, except for the
XSLT/Sablotron that was available for 4.
My original post can be found here:
http://marc.theaimsgroup.com/?l=php-general&m=112299671816888&w=2
What I am trying to do here is what the .NET framework does in XSL by
adding a custom namespace that binds to an Assembly and a class. Is this
at all possible in PHP? The reason why I am asking this is because I do
not want the end user to be able to execute any type of PHP code through
XSL, which they can if I call $xslt->registerPHPFunctions(); and enable
the php namespace through
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl">
For security reasons I would want to limit the user to a specific custom
library class instead of allowing them to use the php:function() that
can call any PHP method/function/internal.
So, instead of:
<xsl:value-of select="php:function('ClassName::Method', ./@id)"/>
I would like the call to be:
<xsl:value-of select="namespace.classname:Method(./@id)"/>
Where the stylesheet declaration looks like:
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:namespace.classname="urn:namespace.classname">
Since that way they can only call the macro classes/methods that have
been validated and added as libraries when loading the XSL renderer.
Any help in this matter is greatly appreciated. Also, if somebody can
forward this matter to the PHP internals, Jochem comes to mind, it would
be awesome. I think this would definitely be a very competitive feature
for the PHP XSL implementation.
Warm Regards,
Torgny
Navigation:
[Reply to this message]
|