Recent changes to 1678: Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

#1678 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-07-02T10:08:16.240000Z

For the advisor, the alternative would be to move the logic of the rules to PHP. However, I do not see a security threat in using eval here as no user input it involved.

#1678 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-03T16:02:55.133000Z

Ticket moved from /p/phpmyadmin/bugs/4935/

#4935 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-02T12:43:02.686000Z

Yes, I was wondering whether the two reasons given are still valid. Especially the one about PHP crashing might no longer be true.

#4935 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-02T12:25:56.081000Z

Indeed, I'll have a look for possible alternatives.
For the record, this is why we do not use native Gettext in PHP. https://wiki.phpmyadmin.net/pma/Gettext_for_developers#Why_not_to_use_native_Gettext_in_PHP

#4935 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-02T12:20:40.027000Z

assigned_to: Madhura Jayaratne --> nobody

#4935 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-02T12:18:42.119000Z

But php-gettext's last update was on 2010-12-24, maybe we should do something about it.

#4935 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-02T12:13:02.347000Z

php-gettext is a third party library used by phpMyAdmin.

#4935 Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-02T10:16:42.209000Z

assigned_to: Madhura Jayaratne

Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-01T13:54:16.593000Z

A few of the PHP scripts in phpMyAdmin use the eval() language construct of PHP. However, some hosts disable that feature for security reasons, e.g. with the help of Suhosin. Hence, phpMyAdmin will not work on hosts with such configurations.

Could you please rewrite the affected scripts (there are only a few as of release 4.4.8) so that they do not use eval() at all? That would allow folks to use phpMyAdmin on machines that disabled eval().

Relevant scripts might be the following:

~/git_repos/phpmyadmin$ grep -rn --fixed-strings "eval(" --include \*.php ./
./libraries/Advisor.class.php:346:            eval('$value = ' . $expr . ';');
./libraries/php-gettext/gettext.php:361:    eval("$string");

(There might be more occurences of eval() in earlier releases.)

Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled

2015-06-01T13:54:16.593000Z

Ticket 4935 has been modified: Eliminate remaining occurences of eval() in phpMyAdmin to make it work on machines where eval() is disabled
Edited By: Madhura Jayaratne (madhuracj)
Owner updated: None => u'madhuracj'