Small width layout Medium width layout Maximum width layout Small text Medium text Large text
     Search
Downloads Downloads Directory Directory Forums Forums Forge Forge Blogs Blogs        Marketplace Marketplace Careers Program Careers
Community › Forums Register  |  

AspDotNetStoreFront
  Need Help?  
Professional technical support for DotNetNuke is available from DotNetNuke Corporation.
 


  Ads  
OnyakTech
 


  Sponsors  

Meet Our Sponsors

Portal Webhosting - Hosting For Developers
Red-Gate Software
MaximumASP
SourceGear - Tools for Developers
.: CounterSoft :.
telerik
 


DotNetNuke Forums
 
  Forum  DotNetNuke® Pro...  XML Module [Lea...  XML v04.03.03 Breaking change -Execution of scripts was prohibited...
Previous Previous
 
Next Next
New Post 4/4/2007 12:50 PM
User is offline iwonder
409 posts
8th Ranked


XML v04.03.03 Breaking change -Execution of scripts was prohibited... 
Modified By iwonder  on 4/5/2007 11:42:25 AM)

Working with dnn 4.4.1 xml/xsl v04.03.03 on a local install using xp pro sp2.

The previous version of the XML/XSL module had no trouble when I was using a custom xml / xsl combo that uses scripts inside the xsl.  The header is like this:

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
  xmlns:msxsl="urn:schemas-microsoft-com:xslt"
  xmlns:user="urn:my-scripts">

The script is a simple implementation of a call to a user function:

<msxsl:script language="C#" implements-prefix="user">
     <![CDATA[
     public string today(){
    return (DateTime.Now.ToString("yyyyMMdd"));
     }
     public string TodayDateTime(){
    return (DateTime.Now.ToString("yyyyMMddHHmm"));
     }
     ]]>
</msxsl:script>

After upgrading to the new version, I'm getting the following error:

System.Xml.Xsl.XslTransformException
Execution of scripts was prohibited. Use the XsltSettings.EnableScript property to enable it. An error occurred at C:\dnn4x\WebSite\Portals\0\iLinksNew.xsl(94,1).

The offending xsl line is where the script is invoked.

<xsl:variable name="myCurDate" select="user:today()"/>

The module was working before the upgrade to the new version with the same xml source and xsl transformation file. 

In the error message a references is made to 'Use the XsltSettings.EnableScript property to enable it.'  Where exactly is this property enabled? 

Any reason why this feature is not supported in the new version, but is in the previous version?

 
New Post 4/4/2007 1:02 PM
User is offline iwonder
409 posts
8th Ranked


Re: Execution of scripts was prohibited... 

Ok, found sort of an explanation at this link:

http://msdn2.microsoft.com/en-us/library/wk7yxab1.aspx

Basically, I'm guessing since the upgrade is now using the XslCompiledTransform class, the property was not set to enable the use of xslt extensions using scripts.  I understand the security issues, but since I trust my source (Me, in fact), I think there ought to be a way to allow the usage.  I use a lot of xml/xsl that feature xslt and the new version is missing support for it.  At least, a way to enable the features in the module setup should be available.

Any views on the subject?  Anyone else tried something like the one I described?

 
New Post 4/5/2007 8:28 AM
User is offline iwonder
409 posts
8th Ranked


Re: Execution of scripts was prohibited... 

As previous versions did not disallow using xslt extensions and scripting from within an xsl file, and the switch to using the XslCompiledTransform class is not set to enable usage, I have logged a point in the issue tracker for attention to this 'breaking change'. This issue negatively impacts production sites that are already using such features in their existing module usage, and may be the cause of several reports of issues when upgrading to the latest version of the module on v4.4.1 sites.

The point is logged as issue XML-5364. 

 
New Post 4/5/2007 8:34 AM
User is offline Sebastian Leupold
13566 posts
www.deutschnetnuke.de
1st Ranked












Re: Execution of scripts was prohibited... 
Thank you Phil, we will take care of it in future versions.
Sebastian Leupold

DeutschNetNuke dnnWerk - The DotNetNuke Experts German DotNetNuke User-Group

DotNetNuke Project UserDefinedTable
DotNetNuke Project Release Tracker
 
New Post 4/14/2007 2:26 PM
User is offline Stefan Cullmann
1431 posts
6th Ranked








Re: Execution of scripts was prohibited... 
I don't think that I am going to enable scripting  again.
There might be security issues related to scripting. I know that I could be managed so that only host is able to enable scripting, adding custom permissions or similar.
But the main reason is related to the way scripting works. The script inside the xsl stylesheets are getting compiled into a temporary assembly and get loaded into the app domain of the dotnetnuke site afterwards. It will stay in memory until the application recycles. Each call to the Xml odule would require more memory.
I agree that XSLT is lacking some important functions and there is a need for functions like date time handling and formating. However I  think the way we should go is using XSLT extension objects.
Your thoughts?

Stefan Cullmann - stefan.cullmann [at] dotnetnuke.com

forms & Lists (UDT5.0) will be the next major release of the User Defined Table project.
A first Preview is available, though it requires DotnetNuke 5 (Beta 5).

 
Previous Previous
 
Next Next
  Forum  DotNetNuke® Pro...  XML Module [Lea...  XML v04.03.03 Breaking change -Execution of scripts was prohibited...
 


Forum Policy

These Discussion Forums are dedicated to the discussion of the DotNetNuke Web Application Framework.

For the benefit of the community and to protect the integrity of the project, please observe the following posting guidelines:

1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DotNetNuke.
2. Discussion or promotion of DotNetNuke product releases under a different brand name are strictly prohibited.
3. No Flaming or Trolling.
4. No Profanity, Racism, or Prejudice.
5. Site Moderators have the final word on approving/removing a thread or post or comment.
6. English language posting only, please.

 


Perpetual Motion Interactive Systems Inc.
A solutions company specializing in Microsoft enterprise technologies.
www.perpetualmotion.ca
Icthus Technologies
Building Faith on the Internet
www.icthustech.com
Efficion Consulting
A premier DotNetNuke consulting firm providing complete DNN services including: custom module development, skinning and design, installation and integration services.
www.efficionconsulting.com

DotNetNuke Corporation   Terms Of Use  Privacy Statement
DotNetNuke®, DNN®, and the DotNetNuke logo are trademarks of DotNetNuke Corporation
Hosted by MaximumASP