# Can Rails have views with restricted execution? **URL:** \ **Category:** Rails\ **Created:** [May 13, 2007, 3:14pm UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038 "2007-05-13T15:14:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![maurice-gladwell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@maurice-gladwell](https://www.ruby-forum.com/u/maurice-gladwell)\ **Post date:** [May 13, 2007, 3:14pm UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038/1 "2007-05-13T15:14:36Z")
Is there a restricted execution solution that works with ERb or any other Rails templating format? I’m writing a CMS and would like to allow my users to execute a very limited set of methods. Specifically, I’d like to allow them to call a predefined set of methods on a predefined object. They can specify any of the core datatypes - strings, numbers, arrays, hashes - as arguments. Any way to do that in Rails? Thanks in advance, Maurice B. Gladwell ---
**Author:** ![maurice-gladwell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@maurice-gladwell](https://www.ruby-forum.com/u/maurice-gladwell)\ **Post date:** [May 13, 2007, 6:22pm UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038/2 "2007-05-13T18:22:54Z")
Sounds like Liquid templating engine is what you are looking for: [http://home.leetsoft.com/liquid](http://home.leetsoft.com/liquid) On May 13, 9:14 am, Maurice G. \ **Author:** ![maurice-gladwell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@maurice-gladwell](https://www.ruby-forum.com/u/maurice-gladwell)\ **Post date:** [May 14, 2007, 12:41am UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038/3 "2007-05-14T00:41:36Z") On May 13, 7:22 pm, removed\_email\_address@domain.invalid wrote: > Sounds like Liquid templating engine is what you are looking for: > > [http://home.leetsoft.com/liquid](http://home.leetsoft.com/liquid) Thanks a lot, Liquid almost cuts it… but not quite. The most powerful tool in the Liquid set is Liquid Drops. "Liquid Drops [1] Drops let you provide the user with custom functionality. They’re very much like a standard Ruby class, but have all un-needed and potentialy dangerous methods removed. From the user’s perspective a drop acts very much like a Hash, thought methods are accessed with dot-notation aswell as element selection. A drop method cannot be invoked with arguments. Drops are called just-in-time thus allowing you to lazily load objects." Problem is… I need to invoke them with (core data-types) arguments. I’ll keep looking. M. [1] [http://home.leetsoft.com/liquid/wiki/HowTo#LiquidDrops](http://home.leetsoft.com/liquid/wiki/HowTo#LiquidDrops) ---
**Author:** ![maurice-gladwell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@maurice-gladwell](https://www.ruby-forum.com/u/maurice-gladwell)\ **Post date:** [May 14, 2007, 2:37am UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038/4 "2007-05-14T02:37:47Z")
> Problem is… I need to invoke them with (core data-types) arguments. Radiant uses a tag based one called Radius or something? There’s also HAML, but I’m not sure it’s “safe” like liquid or radius. Other then that, you’re on your own… – Rick O. [http://lighthouseapp.com](http://lighthouseapp.com) [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) [http://mephistoblog.com](http://mephistoblog.com) ---
**Author:** ![maurice-gladwell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@maurice-gladwell](https://www.ruby-forum.com/u/maurice-gladwell)\ **Post date:** [May 20, 2007, 3:03am UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038/5 "2007-05-20T03:03:09Z")
Thanks Rick, I’ve looked at Radius[1], and it’s much more powerful and suited to my needs than Liquid. Though to be fair, they have different design goals, with Liquid apparently more end-user oriented. The only thing Radius lacks is typed-arguments: all Radius arguments are Strings. Havn’t looked at HAML yet, though I suspect - as you did - that it lacks any sort of security layer, being a full-power ERb alternative. Generally I like Radius as a format a lot, even as something to learn from and improve on, so thanks for recommending it. M. [1] [http://radius.rubyforge.org/](http://radius.rubyforge.org/) On May 14, 3:36 am, “Rick O.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > Problem is… I need to invoke them with (core data-types) arguments. > > Radiant uses a tag based one called Radius or something? There’s also > HAML, but I’m not sure it’s “safe” like liquid or radius. Other then > that, you’re on your own… > > – > Rick O.[http://lighthouseapp.comhttp](http://lighthouseapp.comhttp)://weblog.techno-weenie.nethttp://mephistoblog.com Rick O. wrote: > > Problem is… I need to invoke them with (core data-types) arguments. > > Radiant uses a tag based one called Radius or something? There’s also > HAML, but I’m not sure it’s “safe” like liquid or radius. Other then > that, you’re on your own… > > – > Rick O. > [http://lighthouseapp.com](http://lighthouseapp.com) > [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) > [http://mephistoblog.com](http://mephistoblog.com) ---
**Author:** ![maurice-gladwell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@maurice-gladwell](https://www.ruby-forum.com/u/maurice-gladwell)\ **Post date:** [May 20, 2007, 3:16am UTC](https://www.ruby-forum.com/t/can-rails-have-views-with-restricted-execution/104038/6 "2007-05-20T03:16:43Z")
Thanks Rick, I’ve looked at Radius[1], and it’s much more powerful and suited to my needs than Liquid. Though to be fair, they have different design goals, with Liquid apparently more end-user oriented. The only thing Radius lacks is typed-arguments: all Radius arguments are Strings. Havn’t looked at HAML yet, though I suspect - as you did - that it lacks any sort of security layer, being a full-power ERb alternative. Generally I like Radius as a format a lot, even as something to learn from and improve on, so thanks for recommending it. M. [1] [http://radiantcms.org/blog/archives/2006/09/18/how-to-understanding-radius-tags/](http://radiantcms.org/blog/archives/2006/09/18/how-to-understanding-radius-tags/)