Description:

Allow an administrator to enter PHP code *in addition to* a URL based "diplay / no display" directive for a block.

Motivation:

There are cases where you want to use logic in addition to URL based decisions to display a block. Currently the user must choose *between* URL based or PHP based. This feature would allow for both.

Example:

I wish only users of a certain group to see a block when displaying on http://foo/bar. I adjust the URL display and add code so that tests the users group membership to determine whether or not to display the code.

Approach:

Create another text area on the admin form that allows for the entry of PHP.

Security Considerations:

Make entering PHP a separate grantable permission. (NOTE THAT THIS ALONE WILL ENHANCE THE SECURITY OF THE NEW 4.7 ABILITY TO ADD PHP INTO BLOCKS).

Status:

I've already written and tested the code - if anyone thinks this is a good idea I will submit a patch.

Comments

chx’s picture

Priority: Minor » Critical

Well, indeed it's not trivial that administer blocks privilege now means php code... yep.

Eglish’s picture

Status: Active » Fixed

This seems fixed because 4.7.0-beta2 has a radio button for "Show if the following PHP code returns TRUE (PHP-mode, experts only)." for this functionality.

dries’s picture

Status: Fixed » Closed (fixed)