2 added 8 characters in body
source | link

You can either place entire code into an array as below:

$safe= array(

    'get_template_part(\'content/block\', \'branding\');',
    'get_template_part(\'content/block\', \'footer\');'
);

And then introduce the below check into your function to make sure that no kind of code other than what you already listed can be sent to eval:

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval($string);
    }
}

add_action('before_content', 'add_before_content');

Or, just modify the function and check against different types of template that can be included:

$safe= array(

    'branding',
    'footer',
);

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval(get_template_part"get_template_part('content/block', '".$string."');;");
    }
}

add_action('before_content', 'add_before_content');

In either way, there will be no possibility for the user to be able to send eval() anything other than what you allowed, so it will be safe.

I prefer the latter one since its cleaner.

You can either place entire code into an array as below:

$safe= array(

    'get_template_part(\'content/block\', \'branding\');',
    'get_template_part(\'content/block\', \'footer\');'
);

And then introduce the below check into your function to make sure that no kind of code other than what you already listed can be sent to eval:

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval($string);
    }
}

add_action('before_content', 'add_before_content');

Or, just modify the function and check against different types of template that can be included:

$safe= array(

    'branding',
    'footer',
);

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval(get_template_part('content/block', $string););
    }
}

add_action('before_content', 'add_before_content');

In either way, there will be no possibility for the user to be able to send eval() anything other than what you allowed, so it will be safe.

I prefer the latter one since its cleaner.

You can either place entire code into an array as below:

$safe= array(

    'get_template_part(\'content/block\', \'branding\');',
    'get_template_part(\'content/block\', \'footer\');'
);

And then introduce the below check into your function to make sure that no kind of code other than what you already listed can be sent to eval:

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval($string);
    }
}

add_action('before_content', 'add_before_content');

Or, just modify the function and check against different types of template that can be included:

$safe= array(

    'branding',
    'footer',
);

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval("get_template_part('content/block', '".$string."');");
    }
}

add_action('before_content', 'add_before_content');

In either way, there will be no possibility for the user to be able to send eval() anything other than what you allowed, so it will be safe.

I prefer the latter one since its cleaner.

1
source | link

You can either place entire code into an array as below:

$safe= array(

    'get_template_part(\'content/block\', \'branding\');',
    'get_template_part(\'content/block\', \'footer\');'
);

And then introduce the below check into your function to make sure that no kind of code other than what you already listed can be sent to eval:

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval($string);
    }
}

add_action('before_content', 'add_before_content');

Or, just modify the function and check against different types of template that can be included:

$safe= array(

    'branding',
    'footer',
);

function add_before_content() {
    global $options;
    global $safe;
    $string = (this comes from user)
    if(in_array($string,$safe))
    {
        return eval(get_template_part('content/block', $string););
    }
}

add_action('before_content', 'add_before_content');

In either way, there will be no possibility for the user to be able to send eval() anything other than what you allowed, so it will be safe.

I prefer the latter one since its cleaner.