remove Function constructor from template

[calvinmetcalf]

re twiiter it seems chrome extentions and firefox apps ban eval, if we don't think we are getting much of a boost (which it looks like we might not get), it might make sense to rethink this.

[Garito]

The why: http://www.html5rocks.com/en/tutorials/security/content-security-policy/?redirect_from_locale=es#eval-too
This is a question of consens not a technical one as (I think he talks at twitters @leafletjs account) @mourner said at twitter. I sort of agree with his point but I see the security potential problem too

[calvinmetcalf]

I can submit a patch, I think the key issue is not security but is the
hassle caused outweighed by the benefits, I think in hindsight @tmcw was
right all along
On Nov 20, 2013 6:12 AM, "Garito" notifications@github.com wrote:

The why:
http://www.html5rocks.com/en/tutorials/security/content-security-policy/?redirect_from_locale=es#eval-too
This is a question of consens not a technical one as (I think he talks at
twitters @leafletjs account) @mourner https://github.com/mourner said
at twitter. I sort of agree with his point but I see the security potential
problem too

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/2209#issuecomment-28879518
.

[mourner]

@Garito thanks for bringing this up and for the link.
@calvinmetcalf yeah, or perhaps we could wrap it in try-catch and fall back (LoDash does this). Although it sort of adds some complexity once again.

[Garito]

Thanks to you for your super awesome work
Happy to help

[jfirebaugh]

I'm with @tmcw -- let's just revert to what was working fine. This hassle is not worth it for a small performance optimization.