Replaced last eval(). Allowing function calls in expressions.

Andy Wermke

2013-04-05 fe245e5f5dbea1c18517471103185e04a52c89b3

Replaced last eval(). Allowing function calls in expressions.

 program/include/rcmail_output_html.php

@@ -793,12 +793,6 @@
     * @param  string Expression statement
     */
    protected function eval_expression ($expression) {
        // Prevent function calls in `expression`:
        $expression = str_replace("\n", "", $expression);
        if(preg_match('#\w+ \s* (/\* .* \*/)* \s* \(#ix', $expression))
            return false;

        // Evaluate expression:
        $expression = $this->parse_expression($expression);
        $fn = create_function('$app,$browser,$env', "return ($expression);");
        return $fn($this->app, $this->browser, $this->env);
@@ -854,7 +848,7 @@
            // show a label
            case 'label':
                if ($attrib['expression'])
                    $attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";");
                    $attrib['name'] = $this->eval_expression($attrib['expression']);

                if ($attrib['name'] || $attrib['command']) {
                    // @FIXME: 'noshow' is useless, remove?