Merge pull request #67 from andywer/master

Aleksander Machniak

2013-05-01 06c2d0add5cd5d6bb531bba9480039e96f98f2a2

Merge pull request #67 from andywer/master

Replaced nasty eval() code

 program/include/rcmail_output_html.php

@@ -731,14 +731,13 @@
    /**
     * Determines if a given condition is met
     *
     * @todo   Get rid off eval() once I understand what this does.
     * @todo   Extend this to allow real conditions, not just "set"
     * @param  string Condition statement
     * @return boolean True if condition is met, False if not
     */
    protected function check_condition($condition)
    {
        return eval("return (".$this->parse_expression($condition).");");
        return $this->eval_expression($condition);
    }


@@ -760,14 +759,11 @@


    /**
     * Parses expression and replaces variables
     *
     * Parse & evaluate a given expression and return its result.
     * @param  string Expression statement
     * @return string Expression value
     */
    protected function parse_expression($expression)
    {
        return preg_replace(
    protected function eval_expression ($expression) {
        $expression = preg_replace(
            array(
                '/session:([a-z0-9_]+)/i',
                '/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i',
@@ -779,14 +775,27 @@
            ),
            array(
                "\$_SESSION['\\1']",
                "\$this->app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
                "\$this->env['\\1']",
                "\$app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
                "\$env['\\1']",
                "rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)",
                "\$_COOKIE['\\1']",
                "\$this->browser->{'\\1'}",
                "\$browser->{'\\1'}",
                $this->template_name,
            ),
            $expression);
            $expression
        );
        
        $fn = create_function('$app,$browser,$env', "return ($expression);");
        if(!$fn) {
            rcube::raise_error(array(
                'code' => 505,
                'type' => 'php',
                'file' => __FILE__,
                'line' => __LINE__,
                'message' => "Expression parse error on: ($expression)"), true, false);
        }
        
        return $fn($this->app, $this->browser, $this->env);
    }


@@ -839,7 +848,7 @@
            // show a label
            case 'label':
                if ($attrib['expression'])
                    $attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";");
                    $attrib['name'] = $this->eval_expression($attrib['expression']);

                if ($attrib['name'] || $attrib['command']) {
                    // @FIXME: 'noshow' is useless, remove?
@@ -971,8 +980,7 @@

            // return code for a specified eval expression
            case 'exp':
                $value = $this->parse_expression($attrib['expression']);
                return eval("return html::quote($value);");
                return html::quote( $this->eval_expression($attrib['expression']) );

            // return variable
            case 'var':