I've notice as a side effect of the move from eval() to php_eval() to evaluate the before/after PHP code that it's not possible to manipulate variable passed to MultiCell (for example $border).
As it was the only way to display borders on table cells, I reset the use of php_eval() to eval() on my working copy.
Is php_eval() safer ? What's the good tradeoff between use of safe Drupal internal API or allow any variable manipulation to a (less) safe use of eval() ?
If php_eval() is going to stay, we must imagine a way to provide (at least) a way to set the $border value in every place we got it set by using the PHP code block.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 1910156-option-to-use-eval.patch | 1013 bytes | garphy |
Comments
Comment #1
simon georges commentedCross-referencing #1513490: Fatal error: Call to undefined function php_eval().
Comment #2
killua99 commentedduplicate
Comment #3
garphy@killua99
#1513490: Fatal error: Call to undefined function php_eval() is about making php_eval actually callable but the point of this issue is actually that using php_eval is pointless when you want to alter context variables (to setup borders and so...)
In fact, i think we should work out a way to allow the use of regular 'eval()' on an administrative opt-in basis.
We've got a need for that here, I'll work on a patch.
Comment #4
garphyFirst draft.
Comment #5
killua99 commentedOk I lost the point of this issue sorry ... as you can see I'm making a full patching queue.
So I'm going to commit this patch because I don't see any fault on this. Thanks garphy.
Committed.
Reopen this issue if php_eval cause any bug.
Comment #6
vegansupreme commentedThis isn't working for me. Even something as simple as
$x=5;doesn't evaluate. I still don't understand why we're not sticking with eval(). Other modules use it. Views Bulk Operations, for example has the action "Execute arbitrary PHP script". In that case it can even be exposed to end users. Though there are action permissions so you can control access.We need full PHP in order to leverage TCPDFs many advanced features—for example:
$this->AddPage();and$this->record++;adding barcodes, etc.Comment #7
killua99 commentedOk but I don't get it. Did you see what php_eval do?. Maybe we're not seen the real bug. So don't complaint about use or not use the php_eval.
The php page recommend don't use eval, for security reasons. Maybe we have to refactoring the code and use an hook for this.
Other things, you're using the git code? Not the stable or the compile dev version
Comment #8
garphyWell... i think we really want to revert this commit and reopen #1513490: Fatal error: Call to undefined function php_eval() for further analysis. I will elaborate there.
Comment #9
killua99 commentedUntil the others maintainers speak or say something this will be closed. Don't reopen it.