Executing arbitrary PHP has no place in a UI, any custom code should be version controlled and not user input. A separate contrib module could be provided as legacy support.

CommentFileSizeAuthor
#3 vbo-arbitrary-behavior-2590735-3.patch1.04 KBgifad
#2 2596123.diff3.64 KBdrumm

Comments

drumm created an issue. See original summary.

drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Active » Needs review
StatusFileSize
new 2596123.diff3.64 KB
gifad’s picture

gifad commented
Related issues: +#2590735: Unexpected behaviour of "Execute arbitrary PHP script" action
StatusFileSize
new vbo-arbitrary-behavior-2590735-3.patch1.04 KB

I agree that, like any feature involving php code, explicit permission should be granted.
This is actually done by the Actions permission module.
Patch at Unexpected behaviour of "Execute arbitrary PHP script" action makes script action dependant on actions permissions enabled.

bojanz’s picture

bojanz commented

This is a dangerous action we inherited from the D6 version, but I'm afraid that removing it this late in the release cycle would cause a riot.