Forum OpenACS Development: Re: Using tcl expressions in l10n messages

i am not sure, where and when the feature was lost, but altogether, allowing arbitrary commands in strings that could be supplied by users opens potentially a wide set of attack vectors (one could e.g. shut the server down via entries in the message catalog).

The better approach is to use named bind variables, such as:

ad_page_contract_filter string_length { name value length } {
    Checks whether the string is less or greater than the minimum or
    maximum length specified, inclusive
    e.g.address_1:notnull,string_length(max|100) will test address_1 for
    maximum length of 100.

    @author Randy Beggs (randyb@arsdigita.com)
    @creation-date August 2000
} {
    set actual_length [string length $value]
    if { [lindex $length 0] eq "min" } {
	if { $actual_length < [lindex $length 1] } {
	    set binding [list name $name actual_length $actual_length min_length [lindex $length 1]]
	    ad_complain "[_ acs-tcl.lt_name_is_too_short__Pl_1]"
	    return 0
	}
    } else {
	if { $actual_length > [lindex $length 1] } {
	    set binding [list name $name actual_length $actual_length max_length [lindex $length 1]]
	    ad_complain "[_ acs-tcl.lt_name_is_too_long__Ple_1 $binding]"
	    return 0
	}
    }
    return 1
}