I'm coming here based on #2053075: prevent PHP execution by Skinr module.

There's no easy way I could find to prevent the execution of php inside of skinr*.module except to just make it impossible to enable skinr_ui, skinr_context_ui.

The ideal thing to do is make execution of php in a module depend on the php.module being enabled AND a permission inside of your module that has 'restrict access' => TRUE.

Any chance you can add that?

Comments

moonray’s picture

moonray commented

Where in skinr is php allowed to be used?
Skinr context uses context module. So whatever is allowed by context is used in Skinr Context's UI. As for Skinr UI, I'm not finding anywhere PHP is allowed.

Can you provide URLs?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented 
tacotown:skinr greggles$ grep -Hnr eval\( *
skinr_context/skinr_context_ui.module:485:  eval($form_state['values']['skinr_groups']);
skinr_ui.admin.inc:1082:  eval($form_state['values']['skinr_skins']);
tacotown:skinr greggles$
moonray’s picture

moonray commented

These are for import/export. This is the same as views does it (or used to do it). How was that handled in their case?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

The page callback for the views import form uses views_import_access which returns:

return user_access('administer views') && user_access('use PHP for settings');

That solution is being debated in #870938: Add new permission for controlling imports where people are pushing for a dedicated permission.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Slight update:

1. There's a patch for views.module to make the access to the ability to execute php depend on php.module being enabled as well: #2329259: Refine import permissions / update php argument access.

+  return module_exists('php') && user_access('administer views') && user_access('use PHP for settings');

2. I've committed #2053075: prevent PHP execution by Skinr module so if people are asking why skinr_*ui is disabled, that could be why ;)

astonvictor’s picture

astonvictor commented
Status: Active » Closed (outdated)

D7 reached its EOL back in January 2025, and there is no active release for D7 for this module anymore.
Development or support is not planned for D7. All D7-related issues are marked as outdated in a bunch.

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.