Exclude working directory from library path (CVE-2016-1238)

[git.ikiwiki.info.git] / doc / ikiwiki / directive / template.mdwn

diff --git a/doc/ikiwiki/directive/template.mdwn b/doc/ikiwiki/directive/template.mdwn
index 052ca78732cc2ad5477cc2ae4d03a15deef80438..dd1ca3d5250d7b75dd29dc64b1385dfca1a516d8 100644 (file)
--- a/doc/ikiwiki/directive/template.mdwn
+++ b/doc/ikiwiki/directive/template.mdwn
@@ -31,14 +31,27 @@ large chunks of marked up text to be embedded into a template:
 
 ## Creating a template
 
-The template is a regular wiki page, located in the `templates/`
+The template is in a regular wiki page, located in the `templates/`
 subdirectory inside the source directory of the wiki.
+The contents of the [[templatebody]] directive are used as the
+template. Anything outside that directive is not included in the template,
+and is usually used as documentation describing the template.
 
-(Alternatively, templates can be stored in a directory outside the wiki,
+If the template does not contain a [[templatebody]] directive, the entire
+source of the page is used for the template. This is deprecated, because
+it leads to the template markup being interpreted as ordinary
+page source when the page is built, as well as being used as the template.
+
+Alternatively, templates can be stored in a directory outside the wiki,
 as files with the extension ".tmpl".
-By default, these are searched for in `/usr/share/ikiwiki/templates`;
+By default, these are searched for in `/usr/share/ikiwiki/templates`,
 the `templatedir` setting can be used to make another directory be searched
-first.)
+first.  When referring to templates outside the wiki source directory, the "id"
+parameter is not interpreted as a pagespec, you must include the full filename
+of the template page including the ".tmpl" extension,
+and the templatebody directive is not used. E.g.:
+
+    \[[!template id=blogpost.tmpl]]
 
 The template uses the syntax used by the [[!cpan HTML::Template]] perl
 module, which allows for some fairly complex things to be done. Consult its
@@ -53,25 +66,30 @@ few things:
 * To insert the raw value of a variable, with wiki markup not yet converted
   to html, use `<TMPL_VAR raw_variable>`.
 * To make a block of text conditional on a variable being set use
-  `<TMPL_IF NAME="variable">text</TMPL_IF>`.
+  `<TMPL_IF variable>text</TMPL_IF>`.
 * To use one block of text if a variable is set and a second if it's not,
-  use `<TMPL_IF NAME="variable">text<TMPL_ELSE>other text</TMPL_IF>`
+  use `<TMPL_IF variable>text<TMPL_ELSE>other text</TMPL_IF>`
 
 Here's a sample template:
 
+        \[[!templatebody <<ENDBODY
         <span class="infobox">
         Name: \[[<TMPL_VAR raw_name>]]<br />
         Age: <TMPL_VAR age><br />
-        <TMPL_IF NAME="color">
+        <TMPL_IF color>
         Favorite color: <TMPL_VAR color><br />
         <TMPL_ELSE>
         No favorite color.<br />
         </TMPL_IF>
-        <TMPL_IF NAME="notes">
+        <TMPL_IF notes>
         <hr />
         <TMPL_VAR notes>
         </TMPL_IF>
         </span>
+        ENDBODY]]
+
+       This template describes a person. Parameters: name, age,
+       color (favorite color, optional), notes (optional).
 
 The filled out template will be formatted the same as the rest of the page
 that contains it, so you can include WikiLinks and all other forms of wiki