Easier custom reporting (maybe Lua)?

[Geert Janssens]

On Sunday 23 October 2016 09:24:19 John Ralls wrote:
> > On Oct 23, 2016, at 8:53 AM, Sébastien de Menten
> > <sdementen at gmail.com> wrote:
> > 
> > Would it be feasible in gnucash to use the guile/scheme report
> > system to call an external process (a command line program) that
> > would return the proper html to display in the report ? The
> > external program could take arguments generated by the options
> > system of the report (the GUI that is used to customize a report).
> > If so, we could have a more open system for report generation.
> > Piecash could be used by pythoneers but others could use a mix of
> > sql + any external program to build reports.
> > 
> > Does this make sense ? Or are there blocking issues I am not aware
> > of ?
> Yes, it's possible: The quote retrieval code works by calling a perl
> program, gnc-fq-helper, from Scheme. We'd need someone fluent in
> Scheme to write the external interface code. Such a report wouldn't
> have access to the in-memory state of the database, though, so it
> would be current only with the SQL backend or a freshly-saved XML
> file.
> 
Possible maybe. Desired I'm not sure.

There is an important difference between gnucash calling gnc-fq-helper 
or adding an api to call whatever program on the system. The difference 
being gnc-fq-helper is a script that comes installed with gnucash and 
can't normally be altered by any user except someone with administrator 
rights on the system. It's been verified by the developers to not do any 
nasty things on your system.

Adding an option to call whatever program on the system opens a 
potential security hole. You are suddenly asking gnucash to run totally 
unverified code. I'm not looking forward to this for various reasons.

Regards,

Geert