Make WordPress Core

Opened 15 years ago

Closed 15 years ago

#10650 closed defect (bug) (fixed)

eval() in wp-admin/includes/class-pclzip.php should be replaced

Reported by: hans-spath's profile Hans Spath Owned by: westi's profile westi
Milestone: 2.9 Priority: normal
Severity: normal Version:
Component: Administration Keywords:
Focuses: Cc:


On some systems eval() is disabled due to security reasons.

In wp-admin/includes/class-pclzip.php eval() is used several times like this:

      // ----- Call the callback
      // Here I do not use call_user_func() because I need to send a reference to the
      // header.
      eval('$v_result = '.$p_options[PCLZIP_CB_PRE_ADD].'(PCLZIP_CB_PRE_ADD, $v_local_header);');

It's true that passing references with call_user_func() is a problem, but you can use either

    $v_result = $p_options[PCLZIP_CB_PRE_ADD] (PCLZIP_CB_PRE_ADD, $v_local_header);


    $v_result = call_user_func_array($p_options[PCLZIP_CB_PRE_ADD], array(PCLZIP_CB_PRE_ADD, &$v_local_header));


Change History (3)

#1 @westi
15 years ago

  • Milestone changed from Unassigned to 2.9
  • Owner set to westi
  • Status changed from new to reviewing

#2 @westi
15 years ago

Looking into the best solution for this.

Trying to work with the upstream developer to get this changed.

#3 @westi
15 years ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

(In [11993]) Update pclzip to 2.8.2 - Fixes #10650 and #10777.

  • Removal of eval()s
  • Merge WordPress 64 bit fix upstream
Note: See TracTickets for help on using tickets.