Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeDNN Open Source...DNN Open Source...Module ForumsModule ForumsXMLXMLXML v04.03.03 Breaking change -Execution of scripts was prohibited...XML v04.03.03 Breaking change -Execution of scripts was prohibited...
Previous
 
Next
New Post
4/4/2007 3:50 PM
 

Working with dnn 4.4.1 xml/xsl v04.03.03 on a local install using xp pro sp2.

The previous version of the XML/XSL module had no trouble when I was using a custom xml / xsl combo that uses scripts inside the xsl.  The header is like this:

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
  xmlns:msxsl="urn:schemas-microsoft-com:xslt"
  xmlns:user="urn:my-scripts">

The script is a simple implementation of a call to a user function:

<msxsl:script language="C#" implements-prefix="user">
     <![CDATA[
     public string today(){
    return (DateTime.Now.ToString("yyyyMMdd"));
     }
     public string TodayDateTime(){
    return (DateTime.Now.ToString("yyyyMMddHHmm"));
     }
     ]]>
</msxsl:script>

After upgrading to the new version, I'm getting the following error:

System.Xml.Xsl.XslTransformException
Execution of scripts was prohibited. Use the XsltSettings.EnableScript property to enable it. An error occurred at C:\dnn4x\WebSite\Portals\0\iLinksNew.xsl(94,1).

The offending xsl line is where the script is invoked.

<xsl:variable name="myCurDate" select="user:today()"/>

The module was working before the upgrade to the new version with the same xml source and xsl transformation file. 

In the error message a references is made to 'Use the XsltSettings.EnableScript property to enable it.'  Where exactly is this property enabled? 

Any reason why this feature is not supported in the new version, but is in the previous version?

 
New Post
4/4/2007 4:02 PM
 

Ok, found sort of an explanation at this link:

http://msdn2.microsoft.com/en-us/library/wk7yxab1.aspx

Basically, I'm guessing since the upgrade is now using the XslCompiledTransform class, the property was not set to enable the use of xslt extensions using scripts.  I understand the security issues, but since I trust my source (Me, in fact), I think there ought to be a way to allow the usage.  I use a lot of xml/xsl that feature xslt and the new version is missing support for it.  At least, a way to enable the features in the module setup should be available.

Any views on the subject?  Anyone else tried something like the one I described?

 
New Post
4/5/2007 11:28 AM
 

As previous versions did not disallow using xslt extensions and scripting from within an xsl file, and the switch to using the XslCompiledTransform class is not set to enable usage, I have logged a point in the issue tracker for attention to this 'breaking change'. This issue negatively impacts production sites that are already using such features in their existing module usage, and may be the cause of several reports of issues when upgrading to the latest version of the module on v4.4.1 sites.

The point is logged as issue XML-5364. 

 
New Post
4/5/2007 11:34 AM
 
Thank you Phil, we will take care of it in future versions.

Cheers from Germany,
Sebastian Leupold

dnnWerk - The DotNetNuke Experts   German Spoken DotNetNuke User Group

Speed up your DNN Websites with TurboDNN
 
New Post
4/14/2007 5:26 PM
 
I don't think that I am going to enable scripting  again.
There might be security issues related to scripting. I know that I could be managed so that only host is able to enable scripting, adding custom permissions or similar.
But the main reason is related to the way scripting works. The script inside the xsl stylesheets are getting compiled into a temporary assembly and get loaded into the app domain of the dotnetnuke site afterwards. It will stay in memory until the application recycles. Each call to the Xml odule would require more memory.
I agree that XSLT is lacking some important functions and there is a need for functions like date time handling and formating. However I  think the way we should go is using XSLT extension objects.
Your thoughts?
 
Previous
 
Next
HomeHomeDNN Open Source...DNN Open Source...Module ForumsModule ForumsXMLXMLXML v04.03.03 Breaking change -Execution of scripts was prohibited...XML v04.03.03 Breaking change -Execution of scripts was prohibited...


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out