Feeling Lucky
[#1236] - Removing eval() from JDocumentHTML->countModules
- Closed
- 4 Jun 2013
- Medium
- Build: master
- # 1236
- Diff
- Bakual:patch-1
- Foreign ID 31081
- Success default The Travis CI build passed Details
User tests: Successful: Unsuccessful:
Removing an unneeded eval() call in the countModules function.
Since it's the only place Joomla uses an eval() call, removing it would allow to disable eval() on server level for added security.
Tracker:
http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=31081
realityking
- comment
- 4 Jun 2013
We've deprecated that behavior in the platform for this very reason but it hasn'tbenn merged to the CMS. I suggest doing that.
Bakual
- comment
- 4 Jun 2013
I see. Deprecate operators and removing it (with Joomla 4.x) would indeed be the best way, as it's very easy to make the same checks within the template.
Aww, forget it.
The eval() is there to support 'and' or 'or' operators. I think there should be a better (and saver) way than to use eval but need to think about it.