diff --git a/core/modules/block/lib/Drupal/block/BlockAccessController.php b/core/modules/block/lib/Drupal/block/BlockAccessController.php index 85f449e..7c61bc6 100644 --- a/core/modules/block/lib/Drupal/block/BlockAccessController.php +++ b/core/modules/block/lib/Drupal/block/BlockAccessController.php @@ -106,9 +106,6 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A // listed in $block->pages. $page_match = !($visibility['path']['visibility'] xor $page_match); } - elseif (module_exists('php')) { - $page_match = php_eval($visibility['path']['pages']); - } // If there are page visibility restrictions and this page does not // match, deny access. diff --git a/core/modules/block/lib/Drupal/block/BlockFormController.php b/core/modules/block/lib/Drupal/block/BlockFormController.php index b2fa783..3915315 100644 --- a/core/modules/block/lib/Drupal/block/BlockFormController.php +++ b/core/modules/block/lib/Drupal/block/BlockFormController.php @@ -157,14 +157,6 @@ public function form(array $form, array &$form_state) { ); $description = $this->t("Specify pages by using their paths. Enter one path per line. The '*' character is a wildcard. Example paths are %user for the current user's page and %user-wildcard for every user page. %front is the front page.", array('%user' => 'user', '%user-wildcard' => 'user/*', '%front' => '')); - if ($this->moduleHandler->moduleExists('php') && $access) { - $options += array(BLOCK_VISIBILITY_PHP => $this->t('Pages on which this PHP code returns TRUE (experts only)')); - $title = $this->t('Pages or PHP code'); - $description .= ' ' . $this->t('If the PHP option is chosen, enter PHP code between %php. Note that executing incorrect PHP code can break your Drupal site.', array('%php' => '')); - } - else { - $title = $this->t('Pages'); - } $form['visibility']['path']['visibility'] = array( '#type' => 'radios', '#title' => $this->t('Show block on specific pages'), @@ -173,7 +165,7 @@ public function form(array $form, array &$form_state) { ); $form['visibility']['path']['pages'] = array( '#type' => 'textarea', - '#title' => '' . $title . '', + '#title' => '' . $this->t('Pages') . '', '#default_value' => !empty($visibility['path']['pages']) ? $visibility['path']['pages'] : '', '#description' => $description, ); diff --git a/core/modules/filter/lib/Drupal/filter/Tests/FilterSecurityTest.php b/core/modules/filter/lib/Drupal/filter/Tests/FilterSecurityTest.php index 24d3aa0..d24042a 100644 --- a/core/modules/filter/lib/Drupal/filter/Tests/FilterSecurityTest.php +++ b/core/modules/filter/lib/Drupal/filter/Tests/FilterSecurityTest.php @@ -20,7 +20,7 @@ class FilterSecurityTest extends WebTestBase { * * @var array */ - public static $modules = array('node', 'php', 'filter_test'); + public static $modules = array('node', 'filter_test'); /** * A user with administrative permissions. diff --git a/core/modules/php/config/filter.format.php_code.yml b/core/modules/php/config/filter.format.php_code.yml deleted file mode 100644 index 289ab21..0000000 --- a/core/modules/php/config/filter.format.php_code.yml +++ /dev/null @@ -1,13 +0,0 @@ -format: php_code -name: 'PHP code' -status: '1' -weight: '11' -cache: '0' -filters: - php_code: - id: php_code - module: php - status: '1' - weight: '0' - settings: { } -langcode: und diff --git a/core/modules/php/lib/Drupal/php/Plugin/Condition/Php.php b/core/modules/php/lib/Drupal/php/Plugin/Condition/Php.php deleted file mode 100644 index ca097e5..0000000 --- a/core/modules/php/lib/Drupal/php/Plugin/Condition/Php.php +++ /dev/null @@ -1,74 +0,0 @@ -configuration['php'])) { - // Initialize an empty value. - $this->configuration['php'] = FALSE; - } - $form['php'] = array( - '#type' => 'textarea', - '#title' => t('When the following PHP return TRUE (experts only)'), - '#default_value' => $this->configuration['php'], - '#description' => t('Enter PHP code between . Note that executing incorrect PHP code can break your Drupal site. Return TRUE in order for this condition to evaluate as TRUE.'), - '#access' => user_access('use PHP for settings') - ); - return $form; - } - - /** - * {@inheritdoc} - */ - public function submitForm(array &$form, array &$form_state) { - $this->configuration['php'] = $form_state['values']['php']; - parent::submitForm($form, $form_state); - } - - /** - * {@inheritdoc} - */ - public function summary() { - if (!empty($this->configuration['php'])) { - return t('When the given PHP evaluates as @state.', - array( - '@state' => !empty($this->configuration['negate']) ? 'FALSE' : 'TRUE' - ) - ); - } - else { - return t('No PHP code has been provided.'); - } - } - - /** - * {@inheritdoc} - */ - public function evaluate() { - return php_eval($this->configuration['php']); - } - -} diff --git a/core/modules/php/lib/Drupal/php/Plugin/Filter/Php.php b/core/modules/php/lib/Drupal/php/Plugin/Filter/Php.php deleted file mode 100644 index 53b7a5e..0000000 --- a/core/modules/php/lib/Drupal/php/Plugin/Filter/Php.php +++ /dev/null @@ -1,75 +0,0 @@ -' . t('Using custom PHP code') . ''; - $output .= '

' . t('Custom PHP code may be embedded in some types of site content, including posts and blocks. While embedding PHP code inside a post or block is a powerful and flexible feature when used by a trusted user with PHP experience, it is a significant and dangerous security risk when used improperly. Even a small mistake when posting PHP code may accidentally compromise your site.') . '

'; - $output .= '

' . t('If you are unfamiliar with PHP, SQL, or Drupal, avoid using custom PHP code within posts. Experimenting with PHP may corrupt your database, render your site inoperable, or significantly compromise security.') . '

'; - $output .= '

' . t('Notes:') . '

'; - $output .= ''; - $output .= '

' . t('A basic example: Creating a "Welcome" block that greets visitors with a simple message.') . '

'; - $output .= ''; - $output .= '

' . t('Drupal.org offers some example PHP snippets, or you can create your own with some PHP experience and knowledge of the Drupal system.', array('@drupal' => url('http://drupal.org'), '@php-snippets' => url('http://drupal.org/documentation/customization/php-snippets'))) . '

'; - return $output; - } - else { - return t('You may post PHP code. You should include <?php ?> tags.'); - } - } - -} diff --git a/core/modules/php/lib/Drupal/php/Plugin/views/argument_default/Php.php b/core/modules/php/lib/Drupal/php/Plugin/views/argument_default/Php.php deleted file mode 100644 index 84f1c76..0000000 --- a/core/modules/php/lib/Drupal/php/Plugin/views/argument_default/Php.php +++ /dev/null @@ -1,63 +0,0 @@ - ''); - - return $options; - } - - public function buildOptionsForm(&$form, &$form_state) { - parent::buildOptionsForm($form, $form_state); - $form['code'] = array( - '#type' => 'textarea', - '#title' => t('PHP contextual filter code'), - '#default_value' => $this->options['code'], - '#description' => t('Enter PHP code that returns a value to use for this filter. Do not use <?php ?>. You must return only a single value for just this filter. Some variables are available: the view object will be "$view". The argument handler will be "$argument", for example you may change the title used for substitutions for this argument by setting "argument->validated_title"".'), - ); - - // Only do this if using one simple standard form gadget - $this->checkAccess($form, 'code'); - } - - /** - * Only let users with PHP block visibility permissions set/modify this - * default plugin. - */ - public function access() { - return user_access('use PHP for settings'); - } - - public function getArgument() { - // set up variables to make it easier to reference during the argument. - $view = &$this->view; - $argument = &$this->argument; - ob_start(); - $result = eval($this->options['code']); - ob_end_clean(); - return $result; - } - -} diff --git a/core/modules/php/lib/Drupal/php/Plugin/views/argument_validator/Php.php b/core/modules/php/lib/Drupal/php/Plugin/views/argument_validator/Php.php deleted file mode 100644 index 2dfab78..0000000 --- a/core/modules/php/lib/Drupal/php/Plugin/views/argument_validator/Php.php +++ /dev/null @@ -1,63 +0,0 @@ - ''); - - return $options; - } - - public function buildOptionsForm(&$form, &$form_state) { - parent::buildOptionsForm($form, $form_state); - $form['code'] = array( - '#type' => 'textarea', - '#title' => t('PHP validate code'), - '#default_value' => $this->options['code'], - '#description' => t('Enter PHP code that returns TRUE or FALSE. No return is the same as FALSE, so be SURE to return something if you do not want to declare the argument invalid. Do not use <?php ?>. The argument to validate will be "$argument" and the view will be "$view". You may change the argument by setting "$handler->argument". You may change the title used for substitutions for this argument by setting "$handler->validated_title".'), - ); - - $this->checkAccess($form, 'code'); - } - - /** - * Only let users with PHP block visibility permissions set/modify this - * validate plugin. - */ - public function access() { - return user_access('use PHP for settings'); - } - - public function validateArgument($argument) { - // set up variables to make it easier to reference during the argument. - $view = &$this->view; - $handler = &$this->argument; - - ob_start(); - $result = eval($this->options['code']); - ob_end_clean(); - return $result; - } - -} diff --git a/core/modules/php/lib/Drupal/php/Tests/Condition/PhpConditionTest.php b/core/modules/php/lib/Drupal/php/Tests/Condition/PhpConditionTest.php deleted file mode 100644 index 13c339a..0000000 --- a/core/modules/php/lib/Drupal/php/Tests/Condition/PhpConditionTest.php +++ /dev/null @@ -1,73 +0,0 @@ - 'PHP Condition Plugin', - 'description' => 'Tests that the PHP Condition, provided by the php module, is working properly.', - 'group' => 'Condition API', - ); - } - - protected function setUp() { - parent::setUp(); - - $this->manager = $this->container->get('plugin.manager.condition'); - } - - /** - * Tests conditions. - */ - public function testConditions() { - // Grab the PHP condition and configure it to check against a php snippet. - $condition = $this->manager->createInstance('php') - ->setConfig('php', ''); - $this->assertTrue($condition->execute(), 'PHP condition passes as expected.'); - // Check for the proper summary. - $this->assertEqual($condition->summary(), 'When the given PHP evaluates as TRUE.'); - - // Set the PHP snippet to return FALSE. - $condition->setConfig('php', ''); - $this->assertFalse($condition->execute(), 'PHP condition fails as expected.'); - - // Negate the condition. - $condition->setConfig('negate', TRUE); - // Check for the proper summary. - $this->assertEqual($condition->summary(), 'When the given PHP evaluates as FALSE.'); - - // Reverse the negation. - $condition->setConfig('negate', FALSE); - // Set and empty snippet. - $condition->setConfig('php', FALSE); - // Check for the proper summary. - $this->assertEqual($condition->summary(), 'No PHP code has been provided.'); - } - -} diff --git a/core/modules/php/lib/Drupal/php/Tests/PhpAccessTest.php b/core/modules/php/lib/Drupal/php/Tests/PhpAccessTest.php deleted file mode 100644 index 10d2b75..0000000 --- a/core/modules/php/lib/Drupal/php/Tests/PhpAccessTest.php +++ /dev/null @@ -1,39 +0,0 @@ - 'PHP filter access check', - 'description' => 'Make sure that users who don\'t have access to the PHP filter can\'t see it.', - 'group' => 'PHP', - ); - } - - /** - * Makes sure that the user can't use the PHP filter when not given access. - */ - function testNoPrivileges() { - // Create node with PHP filter enabled. - $web_user = $this->drupalCreateUser(array('access content', 'create page content', 'edit own page content')); - $this->drupalLogin($web_user); - $node = $this->createNodeWithCode(); - - // Make sure that the PHP code shows up as text. - $this->drupalGet('node/' . $node->id()); - $this->assertText('print', 'PHP code was not evaluated.'); - - // Make sure that user doesn't have access to filter. - $this->drupalGet('node/' . $node->id() . '/edit'); - $this->assertNoRaw('