List Info

Thread: Plans for Template-Latex




Plans for Template-Latex
user name
2006-06-01 08:34:39
Having had more of a look through the Template-Latex code I
plan to make 
(at least) two releases in the next couple of weeks.

The first release will remove the 'latex', 'pdflatex'
and 'dvips' 
parameters from the filter interface.  These parameters
allow absolute 
program pathnames to be specified in template code and to my
mind 
represent a security risk.  Currently the code builds
command lines that 
are executed with system(), using either the paths
configured when the 
module was installed (defaulting to
"/usr/bin/latex", etc) or paths 
specified as arguments to the FILTER directive.  The current
code does 
no sanity checking of the paths, so there is nothing to stop
a malicious 
template specifying something like "FILTER latex(latex
=> 'rm -rf 
/home')".  It should still be possible though to set
up these paths from 
perl code as configuration items when TT2 is invoked.  I
hope to make 
this first release sometime next week.

Please let me know if you have any issues with this change.

The second release will follow a week or two later and will
add 
functionality to run "bibtex" and
"makeindex" on the latex code if the 
plugin detects that that is necessary, plus the plugin will
re-run 
"latex" (or "pdflatex") if it
detects that there are unresolved labels.  
I will provide an option to turn off this behaviour, so that
the plugin 
just runs "latex" a specified number of times:
e.g. once, twice (needed 
if there are forward references or a table of contents) or
three times 
(e.g. if there are forward references and a table of
contents) 
irrespective of whether that leaves unresolved labels.  I
will refine 
this proposal and post it when I make the first release.  If
you have 
any comments on this let me know.

I also have in mind to add options to explicitly specify the
temporary 
directory in which the latex commands are run and to
suppress the 
subsequent removal of this directory.  This would primarily
be for 
testing and debugging and the options would not be exposed
as FILTER 
parameters at the template level.

Regards
Andrew

-- 
Andrew Ford,  Director    Pauntley Prints / Ford & Mason
Ltd            
A.Fordford-mason.co.uk   South Wing Compton House          
           
pauntley-prints.co.uk     Compton Green, Redmarley  Tel: +44
1531 829900
ford-mason.co.uk          Gloucester GL19 3JB       Fax: +44
1531 829901
refcards.com cronolog.org Great Britain          Mobile: +44
7785 258278



_______________________________________________
templates mailing list
templatestemplate-toolkit.org
http://lists.template-toolkit.org/mailman/listinfo/t
emplates
Plans for Template-Latex
user name
2006-06-06 08:24:24
I have started making my changes to the Template-Latex code
and have 
decided not to make a separate release just to remove the
"latex", 
"pdflatex" and "dvips" parameters
from the filter interface.  I still 
hope to have a release incorporating changes to run
"bibtex" and 
"makeindex" ready next week.

Thinking about use of TeX-related programs I realized that I
also use 
texinfo (albeit currently not with TT2).  It would be
relatively trivial 
to add support for texinfo to the Template-Latex package
(formating 
texinfo documentation normally requires tex (or pdftex) to
be run twice 
then "texindex *.??" and finally tex again).  I
was thinking of adding a 
module Template::Plugin::Texinfo, which would provide a
"texinfo" filter 
in a similar vein to the "latex" filter.  The
Perl code for the latex 
filter is defined in Template::Latex; I am reworking that
code to run a 
sequence of programs (for latex it is (expressed in a
regexp-ish way): 
"latex{1,3} (bibtex latex)? (makeindex
latex{1,2})?"; for texinfo it 
would be "tex{1,2} (texindex tex)?" or
"makinfo").  It could also run 
other sequences of tex-related programs.  The obvious
question is "where 
does one stop?".  It looks like one could factor out a
generic "external 
filter chain" plugin ,that the various tex-related
filters could use, 
but that might also be useful in other contexts.

Any thoughts?

I also want to add a couple of configuration options (which
could be 
passed in to the "Template->new()" call). 
Currently I am thinking of 
options to specify: the name of the temporary directory
where processing 
takes place, a flag to instruct the code not to delete the
temporary 
directory when the filter has finished, and settings for the
TEXINPUTS 
environment variable.  The former two options are intended
for debugging 
- if  there are Latex errors one can set the temp directory
explicitly 
and set it not to be cleared and then go in, look at the log
files that 
have been left and maybe run the latex commands manually to
work out 
what is going wrong.

Are there any naming conventions for configuration options?

Regards
Andrew

Andrew Ford wrote:
> Having had more of a look through the Template-Latex
code I plan to 
> make (at least) two releases in the next couple of
weeks.
>
> The first release will remove the 'latex',
'pdflatex' and 'dvips' 
> parameters from the filter interface.  These parameters
allow absolute 
> program pathnames to be specified in template code and
to my mind 
> represent a security risk.  Currently the code builds
command lines 
> that are executed with system(), using either the paths
configured 
> when the module was installed (defaulting to
"/usr/bin/latex", etc) or 
> paths specified as arguments to the FILTER directive. 
The current 
> code does no sanity checking of the paths, so there is
nothing to stop 
> a malicious template specifying something like
"FILTER latex(latex => 
> 'rm -rf /home')".  It should still be possible
though to set up these 
> paths from perl code as configuration items when TT2 is
invoked.  I 
> hope to make this first release sometime next week.
>
> Please let me know if you have any issues with this
change.
>
> The second release will follow a week or two later and
will add 
> functionality to run "bibtex" and
"makeindex" on the latex code if the 
> plugin detects that that is necessary, plus the plugin
will re-run 
> "latex" (or "pdflatex") if it
detects that there are unresolved 
> labels.  I will provide an option to turn off this
behaviour, so that 
> the plugin just runs "latex" a specified
number of times: e.g. once, 
> twice (needed if there are forward references or a
table of contents) 
> or three times (e.g. if there are forward references
and a table of 
> contents) irrespective of whether that leaves
unresolved labels.  I 
> will refine this proposal and post it when I make the
first release.  
> If you have any comments on this let me know.
>
> I also have in mind to add options to explicitly
specify the temporary 
> directory in which the latex commands are run and to
suppress the 
> subsequent removal of this directory.  This would
primarily be for 
> testing and debugging and the options would not be
exposed as FILTER 
> parameters at the template level.
>
> Regards
> Andrew
>

-- 
Andrew Ford,  Director    Pauntley Prints / Ford & Mason
Ltd            
A.Fordford-mason.co.uk   South Wing Compton House          
           
pauntley-prints.co.uk     Compton Green, Redmarley  Tel: +44
1531 829900
ford-mason.co.uk          Gloucester GL19 3JB       Fax: +44
1531 829901
refcards.com cronolog.org Great Britain          Mobile: +44
7785 258278



_______________________________________________
templates mailing list
templatestemplate-toolkit.org
http://lists.template-toolkit.org/mailman/listinfo/t
emplates
Plans for Template-Latex
user name
2006-06-06 21:58:15
Andrew Ford wrote:
> Having had more of a look through the Template-Latex
code I plan to make 
> (at least) two releases in the next couple of weeks.

Andrew,

The release of Template::Latex that is currently on CPAN
(2.16) claims 
to require TT 2.16. But the latest released version of TT is
2.15.

Is this an error with your packaging? Or are you awaiting a
new TT release?

Dave...


_______________________________________________
templates mailing list
templatestemplate-toolkit.org
http://lists.template-toolkit.org/mailman/listinfo/t
emplates
Plans for Template-Latex
user name
2006-06-07 05:17:14
Dave Cross wrote:
> Andrew Ford wrote:
>> Having had more of a look through the
Template-Latex code I plan to 
>> make (at least) two releases in the next couple of
weeks.
>
> Andrew,
>
> The release of Template::Latex that is currently on
CPAN (2.16) claims 
> to require TT 2.16. But the latest released version of
TT is 2.15.
>
> Is this an error with your packaging? Or are you
awaiting a new TT 
> release? 
That was actually in the code I took over.  I ignored the
warning and it 
works fine for me with TT 2.15.  I'll change the dependency
to 2.15 and 
put out a new version.

Andrew

-- 
Andrew Ford,  Director    Pauntley Prints / Ford & Mason
Ltd            
A.Fordford-mason.co.uk   South Wing Compton House          
           
pauntley-prints.co.uk     Compton Green, Redmarley  Tel: +44
1531 829900
ford-mason.co.uk          Gloucester GL19 3JB       Fax: +44
1531 829901
refcards.com cronolog.org Great Britain          Mobile: +44
7785 258278



_______________________________________________
templates mailing list
templatestemplate-toolkit.org
http://lists.template-toolkit.org/mailman/listinfo/t
emplates
[1-4]

about | contact  Other archives ( Real Estate discussion Medical topics )