Skip to content

Use sandbox to include every user defined PHP files #3321

New issue
New issue
Closed
#3478
Closed
Use sandbox to include every user defined PHP files#3321
#3478
Labels
enhancementNew feature or requestgood first issueGood for newcomers
@ozh

Description

@ozh
ozh
opened on May 4, 2022

Since YOURLS 1.9 we have a foolproof sandbox to safely include PHP files, used for plugins :

YOURLS/includes/functions-plugins.php

Lines 682 to 696 in 27375bc

/**
* Plugin activation sandbox
*
* @since 1.8.3
* @param string $pluginfile Plugin filename (full path)
* @return string|true string if error or true if success
*/
function yourls_activate_plugin_sandbox( $pluginfile ) {
try {
include_once $pluginfile;
return true;
} catch ( \Throwable $e ) {
return $e->getMessage();
}
}

Rename this function to make it more generic, update tests accordingly, and reuse it for :

Pages:

YOURLS/includes/functions-html.php

Line 865 in 27375bc

include_once( YOURLS_PAGEDIR . "/$page.php" );

Custom DB error:

YOURLS/includes/Database/YDB.php

Line 161 in 27375bc

include_once( YOURLS_USERDIR . '/db_error.php' );

Custom maintenance page:

YOURLS/includes/functions.php

Line 1052 in 27375bc

include_once( YOURLS_USERDIR.'/maintenance.php' );

Custom DB or cache layer:

YOURLS/includes/Config/Init.php

Lines 143 to 165 in 27375bc

/**
* @since 1.7.3
* @return void
*/
public function include_db_files() {
// Allow drop-in replacement for the DB engine
if (file_exists(YOURLS_USERDIR.'/db.php')) {
require_once YOURLS_USERDIR.'/db.php';
} else {
require_once YOURLS_INC.'/class-mysql.php';
yourls_db_connect();
}
}
/**
* @since 1.7.3
* @return void
*/
public function include_cache_files() {
if (file_exists(YOURLS_USERDIR.'/cache.php')) {
require_once YOURLS_USERDIR.'/cache.php';
}
}

(by the way, rename that "cache.php" to something understandable -- must-use-plugin.php? unconditional-use-plugin.php?)

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestgood first issueGood for newcomers

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions