? cck-php-227951-1.patch
? cck-php-227951-2.patch
? cck-php-227951-6.patch
? cck-php-227951-7.patch
? cck_php_1st_pass.patch
? cck_problem_post.patch
? cck_xss_1st_pass.patch
? cck_xss_php_1st_pass.patch
Index: content.module
===================================================================
RCS file: /cvs/drupal/contributions/modules/cck/content.module,v
retrieving revision 1.301
diff -u -p -r1.301 content.module
--- content.module	3 Jun 2008 12:52:23 -0000	1.301
+++ content.module	14 Jun 2008 01:54:53 -0000
@@ -111,6 +111,13 @@ function content_menu_needs_rebuild($reb
 }
 
 /**
+ * Implementation of hook_perm().
+ */
+function content_perm() {
+  return array('Use PHP input for default and allowed values (dangerous - grant with care)');
+}
+
+/**
  * Implementation of hook_menu().
  */
 function content_menu() {
Index: includes/content.admin.inc
===================================================================
RCS file: /cvs/drupal/contributions/modules/cck/includes/content.admin.inc,v
retrieving revision 1.181
diff -u -p -r1.181 content.admin.inc
--- includes/content.admin.inc	3 Jun 2008 12:25:44 -0000	1.181
+++ includes/content.admin.inc	14 Jun 2008 01:54:53 -0000
@@ -880,29 +880,41 @@ function _content_admin_field(&$form_sta
       '#collapsible' => TRUE,
       '#collapsed' => empty($field['widget']['default_value_php']),
     );
-    $db_info = content_database_info($field);
-    $columns = array_keys($db_info['columns']);
-    foreach ($columns as $key => $column) {
-      $columns[$key] = "'$column' => value for $column";
+
+    if (user_access('Use PHP input for default and allowed values (dangerous - grant with care)')) {
+      $db_info = content_database_info($field);
+      $columns = array_keys($db_info['columns']);
+      foreach ($columns as $key => $column) {
+        $columns[$key] = "'$column' => value for $column";
+      }
+      $sample = 'array(
+    0 => array('. implode(', ', $columns) .'),
+    // You\'ll usually want to stop here. Provide more values
+    // if you want your \'default value\' to be multi-valued :
+    1 => array('. implode(', ', $columns) .'),
+    2 => ...
+  );';
+
+      $form['widget']['default_value_fieldset']['advanced_options']['default_value_php'] = array(
+        '#type' => 'textarea',
+        '#title' => t('Code'),
+        '#default_value' => isset($field['widget']['default_value_php']) ? $field['widget']['default_value_php'] : '',
+        '#rows' => 6,
+        '#tree' => TRUE,
+        '#description' => t("Advanced usage only: PHP code that returns a default value. Should not include &lt;?php ?&gt; delimiters. If this field is filled out, the value returned by this code will override any value specified above. Expected format :<pre>!sample</pre>Using !link_devel's 'devel load' tab on a %type content page might help you figure out the expected format.", array(
+          '!sample' => $sample,
+          '!link_devel' => l('devel.module', 'http://www.drupal.org/project/devel'),
+          '%type' => $type_name)),
+      );
+    }
+    else {
+      $form['widget']['default_value_fieldset']['advanced_options']['markup_default_value_php'] = array(
+        '#type' => 'item',
+        '#title' => t('Code'),
+        '#value' => !empty($field['widget']['default_value_php']) ? '<code>'. check_plain($field['widget']['default_value_php']) .'</code>' : t('&lt;none&gt;'),
+        '#description' => empty($field['widget']['default_value_php']) ? t("You're not allowed to input PHP code.") : t('This PHP code was set by an administrator and will override any value specified above.'),
+      );
     }
-    $sample = 'array(
-  0 => array('. implode(', ', $columns) .'),
-  // You\'ll usually want to stop here. Provide more values
-  // if you want your \'default value\' to be multi-valued :
-  1 => array('. implode(', ', $columns) .'),
-  2 => ...
-);';
-    $form['widget']['default_value_fieldset']['advanced_options']['default_value_php'] = array(
-      '#type' => 'textarea',
-      '#title' => t('Code'),
-      '#default_value' => isset($field['widget']['default_value_php']) ? $field['widget']['default_value_php'] : '',
-      '#rows' => 6,
-      '#tree' => TRUE,
-      '#description' => t("Advanced usage only: PHP code that returns a default value. Should not include &lt;?php ?&gt; delimiters. If this field is filled out, the value returned by this code will override any value specified above. Expected format :<pre>!sample</pre>Using !link_devel's 'devel load' tab on a %type content page might help you figure out the expected format.", array(
-        '!sample' => $sample,
-        '!link_devel' => l('devel.module', 'http://www.drupal.org/project/devel'),
-        '%type' => $type_name)),
-    );
   }
 
   $form['field'] = array(
Index: modules/number/number.module
===================================================================
RCS file: /cvs/drupal/contributions/modules/cck/modules/number/number.module,v
retrieving revision 1.91
diff -u -p -r1.91 number.module
--- modules/number/number.module	13 May 2008 16:40:00 -0000	1.91
+++ modules/number/number.module	14 Jun 2008 01:54:53 -0000
@@ -138,13 +138,23 @@ function number_field_settings($op, $fie
         '#collapsible' => TRUE,
         '#collapsed' => empty($field['allowed_values_php']),
       );
-      $form['allowed_values_fieldset']['advanced_options']['allowed_values_php'] = array(
-        '#type' => 'textarea',
-        '#title' => t('Code'),
-        '#default_value' => !empty($field['allowed_values_php']) ? $field['allowed_values_php'] : '',
-        '#rows' => 6,
-        '#description' => t('Advanced usage only: PHP code that returns a keyed array of allowed values. Should not include &lt;?php ?&gt; delimiters. If this field is filled out, the array returned by this code will override the allowed values list above.'),
-      );
+      if (user_access('Use PHP input for default and allowed values (dangerous - grant with care)')) {
+        $form['allowed_values_fieldset']['advanced_options']['allowed_values_php'] = array(
+          '#type' => 'textarea',
+          '#title' => t('Code'),
+          '#default_value' => !empty($field['allowed_values_php']) ? $field['allowed_values_php'] : '',
+          '#rows' => 6,
+          '#description' => t('Advanced usage only: PHP code that returns a keyed array of allowed values. Should not include &lt;?php ?&gt; delimiters. If this field is filled out, the array returned by this code will override the allowed values list above.'),
+        );
+      }
+      else {
+        $form['allowed_values_fieldset']['advanced_options']['markup_allowed_values_php'] = array(
+          '#type' => 'item',
+          '#title' => t('Code'),
+          '#value' => !empty($field['allowed_values_php']) ? '<code>'. check_plain($field['allowed_values_php']) .'</code>' : t('&lt;none&gt;'),
+          '#description' => empty($field['allowed_values_php']) ? t("You're not allowed to input PHP code.") : t('This PHP code was set by an administrator and will override the allowed values list above.'),
+        );
+      }
       return $form;
 
     case 'validate':
Index: modules/text/text.module
===================================================================
RCS file: /cvs/drupal/contributions/modules/cck/modules/text/text.module,v
retrieving revision 1.95
diff -u -p -r1.95 text.module
--- modules/text/text.module	1 Jun 2008 21:59:56 -0000	1.95
+++ modules/text/text.module	14 Jun 2008 01:54:53 -0000
@@ -97,13 +97,23 @@ function text_field_settings($op, $field
         '#collapsible' => TRUE,
         '#collapsed' => empty($field['allowed_values_php']),
       );
-      $form['allowed_values_fieldset']['advanced_options']['allowed_values_php'] = array(
-        '#type' => 'textarea',
-        '#title' => t('Code'),
-        '#default_value' => !empty($field['allowed_values_php']) ? $field['allowed_values_php'] : '',
-        '#rows' => 6,
-        '#description' => t('Advanced usage only: PHP code that returns a keyed array of allowed values. Should not include &lt;?php ?&gt; delimiters. If this field is filled out, the array returned by this code will override the allowed values list above.'),
-      );
+      if (user_access('Use PHP input for default and allowed values (dangerous - grant with care)')) {
+        $form['allowed_values_fieldset']['advanced_options']['allowed_values_php'] = array(
+          '#type' => 'textarea',
+          '#title' => t('Code'),
+          '#default_value' => !empty($field['allowed_values_php']) ? $field['allowed_values_php'] : '',
+          '#rows' => 6,
+          '#description' => t('Advanced usage only: PHP code that returns a keyed array of allowed values. Should not include &lt;?php ?&gt; delimiters. If this field is filled out, the array returned by this code will override the allowed values list above.'),
+        );
+      }
+      else {
+        $form['allowed_values_fieldset']['advanced_options']['markup_allowed_values_php'] = array(
+          '#type' => 'item',
+          '#title' => t('Code'),
+          '#value' => !empty($field['allowed_values_php']) ? '<code>'. check_plain($field['allowed_values_php']) .'</code>' : t('&lt;none&gt;'),
+          '#description' => empty($field['allowed_values_php']) ? t("You're not allowed to input PHP code.") : t('This PHP code was set by an administrator and will override the allowed values list above.'),
+        );
+      }
       return $form;
 
     case 'save':