eval() in wp-admin/includes/class-pclzip.php should be replaced

[Hans Spath]

On some systems eval() is disabled due to security reasons.

In wp-admin/includes/class-pclzip.php eval() is used several times like this:

      // ----- Call the callback
      // Here I do not use call_user_func() because I need to send a reference to the
      // header.
      eval('$v_result = '.$p_options[PCLZIP_CB_PRE_ADD].'(PCLZIP_CB_PRE_ADD, $v_local_header);');

It's true that passing references with call_user_func() is a problem, but you can use either

    $v_result = $p_options[PCLZIP_CB_PRE_ADD] (PCLZIP_CB_PRE_ADD, $v_local_header);

or

    $v_result = call_user_func_array($p_options[PCLZIP_CB_PRE_ADD], array(PCLZIP_CB_PRE_ADD, &$v_local_header));

instead.

[westi]

Looking into the best solution for this.

Trying to work with the upstream developer to get this changed.

[westi]

(In [11993]) Update pclzip to 2.8.2 - Fixes #10650 and #10777.
Includes:

• Removal of eval()s
• Merge WordPress 64 bit fix upstream