couple of SecureStateHeader issues

[Gazmik]

1. I have a button that sets the header's state on click via its "newstate" attribute. I'd like it to not change states on a shift-click (while still doing so on an unmodified click)... I assumed setting a "shift-newstate" attribute to nil or "" would work, but it doesn't seem to. Is there some other voodoo I'm missing?

2. I have a button inheriting SecureAnchorEnterTemplate that I'd like to show a standard tooltip for on mouseover. Normally one would do this by defining OnEnter/OnLeave handlers, but that's not secure... the template's handlers override them. Any suggestions?

[Vangual]

I'd also be interested in an example of a proper way to set custom tooltips on secure action buttons. Up until the 2.1PTR the snippet:

<OnEnter>
MyMod_SetTooltip()
SecureStateAnchor_RunChild(self, "OnEnter", "onenterbutton");
</OnEnter>

seemed to do its job but I've never found it documented/explained. Since the 2.1 PTR the mod causes certain action buttons (from unrelated addons) to spew these taint errors while my mod is active. (Remark 1 below for details)

Since the above mentioned OnEnter/Leave hooking is the only part of the code that feels bruteforced I'd also like to know the proper way to manually set tooltips on SecureActionButtons.


[1] My addon is called TotemGarden as seen in the error, however I'm not hooking OnClick intentionally. This error appears when clicking on buttons only. Entering or Leaving the other Action Buttons doesn't cause the messages. This happens still on the latest PTR as of 2007-04-26, not just on the "wacky" ptr builds from before.

[Gazmik]

Found a solution to #1: Set the state-change I want for unmodified clicks in the "newstate1" attribute, and set "shift-newstate1" to nil. Setting just "newstate" seems to mean "do this state change on any click, no overrides for you!"

No luck with #2, though.

[Vangual]

Update for Gazmik:
With the help of shirik I found a way to properly do tooltips on secure frames. Downside is that it'll only work in 2.1 and later:

http://wowi.pastey.net/20211

Works perfectly for me on the PTR and doesn't taint the rest of the execution line. (code is dry-copy/pasted, might contain bugs, but only the HookScript calls are interesting anyway)