Question

I am working on a Grails site which although it needs to include a deal of CMS-like functionality is yet not (for various reasons) being built as part of an actual CMS installation. One thing that I need to allow the user to do is to edit the HTML layout — which, in a Grails application, is laid out in a GSP file — and other normally-static elements of the different pages, which will neither be tied to any specific domain object nor form any part of one of the CRUD pages which deal with domain objects.

I know both that it is possible to specify the views directory and that it is possible to write, from within the app somewhere, to actual files in the running app. I know further that it might require a great enormous deal of care, if I were to do this, to be sure that the user does not too badly destroy the entire layout and content of the page, and I am prepared to deal with that. But is it possible to allow user editing of the layouts and other GSP files used to create a Grails page? If so, how might I go about it?

Answer 1

If you store the template/layout in the database (as some have suggested above) you can
render it using the GroovyPagesTemplateEngine:

package com.mycompany

import groovy.text.Template;
import org.codehaus.groovy.grails.web.pages.GroovyPagesTemplateEngine 

class TemplatingService {
  GroovyPagesTemplateEngine groovyPagesTemplateEngine

  def render(String templateString, Map model) {
    ByteArrayInputStream bais = new ByteArrayInputStream(templateString.getBytes());
    Template template = groovyPagesTemplateEngine.createTemplate(bais)

    try {
      def writer = new StringWriter()
      template.make(model).writeTo(writer)
      return writer.toString()
    } catch (Exception e) {
      // handle exception
      return ""    // or "[an error occurred]" or rethrow the exception
    }
  }
}

Now, while you CAN do this, please be sure to think of the implications. Anything you could execute in a gsp can be executed in this context. Like writing to, or deleting files, executing commands, etc.

I never figured out how to leverage a SecurityManager to limit what could be done in the templates, so my solution was to not allow users to enter templates into the database. If I want a new template, I put it there myself, after checking it for security implications.

You can also improve performance by caching the results of createTemplate() to avoid recompiling it each time.