trac-GenshiMacro 0.1

描述

GenshiMacro 允许您使用新的 Genshi 处理器在wiki页面上直接编写和渲染Genshi模板。

您的模板将可以通过 req 访问请求，这在执行如URL生成、为POST请求渲染表单令牌和检查登录用户等任务时可能很有用。

注意：制作此插件时没有任何安全考虑。这可能是件糟糕的事情。Trac 核心开发者Remy Blank 说

> Genshi templates allow executing arbitrary Python code. So you basically
> give users who can insert the macro anywhere (wiki page, ticket comment,
> etc) permission to act as the user running Trac, including running run
> any shell command.
>
{{{#!Genshi
<div>${open('/etc/apache2/htpasswd').read()}</div>
}}}

{{{#!Genshi
<?python
  import os
  os.system("rm /path/to/env/db/trac.db")
?>
}}}
>
> So my advice is, only enable this macro on sites where you trust *all*
> users who can edit *any* wiki text with the web server's account.

配置和用法

要使用此插件，请将其安装到您的Trac环境中，并在 trac.ini 中启用其组件

[components]
genshimacro.* = enabled

然后您可以直接在wiki页面上编写Genshi模板，如下所示

{{{
#!Genshi
<div xmlns:py="http://genshi.edgewall.org/">
 <py:choose>
  <py:when test="req.session.authenticated">
   <form method="POST" action="${req.href.newticket()}">
    <input type="text" name="field_summary" placeholder="My new ticket"
           id="field-summary" />
    <input type="hidden" name="__FORM_TOKEN" value="${req.form_token}" />
    <input type="submit" />
   </form>
  </py:when>
  <py:otherwise>
   <b>To file a new ticket, you'll need to
      <a href="${req.href.login()}">log in</a> or
      <a href="${req.href.register()}">create an account</a>
      first.</b>
  </py:otherwise>
 </py:choose>
</div>
}}}