On Nov 18, 12:55 pm, Chris Wanstrath <
ch...@ozmm.org> wrote:
> You'd just need to setup a hash with all the data you'd like to make
> available, then render that.
>
> def show
> @view = Views::Profile.new # Profile is a Mustache subclass
> @view[:name] = @
user.name
> @view[:joined] = @user.created_at.to_s(:short)
> end
>
So, you're talking about allowing the User to code the template, but
not the associated Mustache subclass? If so, the actual templates the
user would be able to create would be quite limited. To use your
example, the user would be limited to displaying the date formatted
asto_s(:short), since that's how you added it to the view, and
Mustache by design does not allow any logic or functions in the
templates.
I would imagine that for most people, liquid templates would be a
better option, since the templates allow a limited amount of logic,
and predefined filters (aka functions) give the template writer more
power, while preventing unwanted code execution and thus being usable
by untrusted users. Continuing your example, the user could write this
as {{ joined | date: "%a" }}
Now, if you're talking about allowing the user to write the view code
associated with the template, and still run in a trusted environment,
I'd be extremely interested. I think there is potential for view code
being javascript, and sandboxing the javascript code server side,
perhaps through Johnson. If anyone has ideas on this topic, I'd love
to hear them.