1 files changed, 57 insertions, 1 deletions

diff --git a/modules/php/php.module b/modules/php/php.module
index de7371b7f..cd1ea53ca 100644
--- a/modules/php/php.module
+++ b/modules/php/php.module
@@ -22,6 +22,62 @@ function php_help($path, $arg) {
 }
 
 /**
+ * Implementation of hook_perm().
+ */
+function php_perm() {
+  return array(
+    'use PHP for settings' => array(
+      'title' => t('Use PHP for settings'),
+      'description' => t('Enter PHP in settings fields where PHP is allowed. %warning', array('%warning' => t('Warning: Give to trusted roles only; this permission has security implications.'))),
+    ),
+  );
+}
+
+/**
+ * Evaluate a string of PHP code.
+ *
+ * This is a wrapper around PHP's eval(). It uses output buffering to capture both
+ * returned and printed text. Unlike eval(), we require code to be surrounded by
+ * <?php ?> tags; in other words, we evaluate the code as if it were a stand-alone
+ * PHP file.
+ *
+ * Using this wrapper also ensures that the PHP code which is evaluated can not
+ * overwrite any variables in the calling code, unlike a regular eval() call.
+ *
+ * @param $code
+ *   The code to evaluate.
+ * @return
+ *   A string containing the printed output of the code, followed by the returned
+ *   output of the code.
+ */
+function php_eval($code) {
+  global $theme_path, $theme_info, $conf;
+
+  // Store current theme path.
+  $old_theme_path = $theme_path;
+
+  // Restore theme_path to the theme, as long as php_eval() executes,
+  // so code evaluated will not see the caller module as the current theme.
+  // If theme info is not initialized get the path from theme_default.
+  if (!isset($theme_info)) {
+    $theme_path = drupal_get_path('theme', $conf['theme_default']);
+  }
+  else {
+    $theme_path = dirname($theme_info->filename);
+  }
+
+  ob_start();
+  print eval('?>' . $code);
+  $output = ob_get_contents();
+  ob_end_clean();
+
+  // Recover original theme path.
+  $theme_path = $old_theme_path;
+
+  return $output;
+}
+
+/**
  * Implementation of hook_filter_tips().
  */
 function php_filter_tips($delta, $format, $long = FALSE) {
@@ -79,7 +135,7 @@ function php_filter($op, $delta = 0, $format = -1, $text = '') {
     case 'description':
       return t('Executes a piece of PHP code. The usage of this filter should be restricted to administrators only!');
     case 'process':
-      return drupal_eval($text);
+      return php_eval($text);
     default:
       return $text;
   }