Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Hello all,i have made this lil patch to enable fixable dynamic calls for arg()
all u have to add fill the input box with the "arg(n)" with any mixed string and integer.
please give me a feedback.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | arg-urls-0.2.diff | 1.13 KB | 3emad |
| arg-urls.diff | 1.6 KB | 3emad |
Comments
Comment #1
pasquallethe problem with this patch is that you are allowing almost any php code written into the views argument field, which might be a security risk.
Comment #2
3emad commentedthe arguments should be passed through by configuration for quick tabbing......
admin decides which variables are passed...
let say the admin put "arg(0),awsome" and it was given by the value....
we will have an array with two arguments strings..if the "(" exists in any value of the array,it will eval it as a php code...which is although given by the quick tabs configuration.
BRIEFLY:
arg() functions are secured,cause i'm evaling the string passed from the configuration of arguments in quicktabs,so its up to the own super-admin to kill his own website :P
Comment #3
pasquallemaybe it is super-admin on your site, but it can be a simple user with 'administer blocks' permission on other sites.
who just write a simple view argument like:
and you know what comes next..
it would better without the eval(). check how the %X arguments are replaced in the 6.x-2.x version..
Comment #4
3emad commentedyou totally got a point there Pasqualle so i have done the following
removed eval and have implemented more strict to call the number of arguments on using a prefix of "%" along with the number.
Comment #5
3emad commentedi guess we can call it for a ported patch?
Comment #6
3emad commentedComment #7
pasqualleI need to review this, as this is not the direct backport from 6.x-2.x, and I remember there were some real problems with the implementation of argument handling..
Comment #8
pasqualleDrupal 5 version of the Quick Tabs module is no longer supported. Closing.
If you have this same problem with later versions, feel free to reopen this issue.
Comment #9
pasqualle