I wanted to be able to use conditional statements using tokens, so I needed to use PHP on the fields in the administration section.

I have changed the text fields to textareas in /admin/content/page_title

Then i changed:
from
$title = token_replace_multiple($title, $types);
to
$title = php_filter('process', 0, -1, token_replace_multiple($title, $types));

in page_title.module...

And now I can handle conditional page titles.

Are there any security issues with this approach, if yes, please explain, if no, can it be included in the next commit. Or any other better approaches are welcome.

Thanks in advance.

Comments

nicholasthompson’s picture

nicholasthompson
Primary language English
commented
Status: Active » Postponed (maintainer needs more info)

I'm not a big fan of PHP Filtering for 2 main reasons...
1) It gives anyone logged in as that user DIRECT code-level access to your server. Not good for security.
2) The code inside that textarea cannot be opcode cached. It will always be recompiled on every load. Thats not efficient.

I quite like the idea - although I cant see why you'd ever need to. What's your use-case for it exactly?

nicholasthompson’s picture

nicholasthompson
Primary language English
commented
Status: Postponed (maintainer needs more info) » Closed (won't fix)

Marking this as "wont fix" because the module has a hook_page_title_alter() system which would allow a more efficient way of achieving this.