--- webform.module.orig	2009-01-07 18:22:10.000000000 +0200
+++ webform.module	2009-01-08 05:46:39.000000000 +0200
@@ -244,7 +244,8 @@
  * Implementation of hook_perm().
  */
 function webform_perm() {
-  return array("create webforms", "edit own webforms", "edit webforms", "access webform results", "clear webform results", "access own webform submissions", "edit own webform submissions", "edit webform submissions", "use PHP for additional processing");
+  return array("create webforms", "edit own webforms", "edit webforms", "access webform results", "clear webform results", "access own webform submissions", "edit own webform submissions", "edit webform submissions", "use PHP for additional processing", "use PHP for default component values",
+  );
 }
 
 /**
@@ -1861,6 +1862,15 @@
 function _webform_filter_values($string, $node = NULL, $submission = NULL, $strict = TRUE) {
   global $user;
 
+  // Eval php for default values if there is php code and the author of the node has permission to
+  if (strpos($string, '<?php') !== FALSE && arg(0) == 'node' && is_numeric(arg(1))) {
+    $webform_author_uid = db_result(db_query("select uid from {node} where nid = %d",arg(1)));
+    $webform_author = user_load(array('uid' => $webform_author_uid));
+    if (user_access('use PHP for default component values',$webform_author)) {
+      $string = drupal_eval($string);
+    }
+  }
+
   // Setup default token replacements.
   $find = array('%username', '%useremail', '%site', '%date');
   $replace = array($user->name, $user->mail, variable_get('site_name', 'drupal'), format_date(time(), 'large'));
@@ -2089,6 +2099,15 @@
   $output .= t('You can use %server[key] to add any of the special PHP <a href="http://www.php.net/reserved.variables#reserved.variables.server">$_SERVER</a> variables, %session[key] to add any of the special PHP <a href="http://www.php.net/reserved.variables#reserved.variables.session">$_SESSION</a> variables and %get[key] to create prefilled forms from the <a href="http://www.php.net/reserved.variables#reserved.variables.get">URL</a>. %cookie, %request and %post also work with their respective PHP variables. For example %server[HTTP_USER_AGENT], %session[id], or %get[q].');
   if (module_exists('profile')) {
     $output .= ' '. t('If you are using the profiles module, you can also access all profile data using the syntax %profile[form_name]. If you for example have a profile value named profile_city, add the variable %profile[profile_city].');
+    if (arg(0) == 'node' && is_numeric(arg(1))) {
+      $webform_author_uid = db_result(db_query("select uid from {node} where nid = %d",arg(1)));
+      $webform_author = user_load(array('uid' => $webform_author_uid));
+      if (user_access('use PHP for default component values',$webform_author)) {
+        $output .= ' '. t('You can also use &lt;?php ... ?&gt; syntax for evaluating php code. Eg. &lt;?php print date("U"); ?&gt;'); 
+      } else {
+        $output .= ' '. t("You can not use PHP syntax here as the author of this webform does not have the "). "'use PHP for default component values'". ' '. t("permission.");
+      }
+    }
   }
 
   $fieldset = array(