Pseudo register_globals

Discussions and requests related to new CMSimple features, plugins, templates etc. and how to develop.
Please don't ask for support at this forums!
Post Reply
cmb
Posts: 14225
Joined: Tue Jun 21, 2011 11:04 am
Location: Bingen, RLP, DE
Contact:

Pseudo register_globals

Post by cmb » Sun Apr 22, 2012 3:11 pm

Hello Developers,

one thing that bothers me since quite some time, is the setting of arbitrary GET parameters without value to 'true'. cmsimple/cms.php line 193ff:

Code: Select all

    for ($i = 0; $i < $v; $i++)
        if (!strpos($rq[$i], '='))
            $GLOBALS[$rq[$i]] = 'true';
 
This is no pitfall as dangerous as register_globals On, but nonetheless could lead to undesirable behaviour, if not even to security issues. And it prohibits to name a toplevel page the same as an installed plugin, if this has an admin.php.

So shouldn't these lines be removed? Let's ask the oracle ;)

The problem: this would break compatibility with all existing plugins, as those are called by their name as GET parameter. IMO it would be way better to call them by a special GET parameter with their name as value, e.g. instead of http://www.example.com/?pagemanager to call them by http://www.example.com/?xhplugin=pagemanager.

Perhaps you consider the following intermediate solution: plugins using this new style could be marked as such (e.g. by having a file newstyle.htm in the plugin's folder). So the core and PL can check for the existance of this file, and if found, could emit the new style links in the plugin menu. To maintain backward compatibility with older versions of CMSimple(_XH), the plugin should emit those links with respect to CMSIMPLE_VERSION or PLUGINLOADER_VERSION. This could be simplified by using a function along the following lines (a constant might be used as well):

Code: Select all

function my_plugin_link() {
    return (version_compare(PLUGINLOADER_VERSION, '2.2', '>=') ? 'xhplugin=' : '') ? 'my_plugin';
}
 
After some time hopefully many plugins could be written this way, so the "pseudo register_globals" code might be removed from CMSimple_XH alltogether.

An additional benefit: the name of the plugin could be used as global array to store the plugin's global data.

What do you think? Did I oversee some other use of the "pseudo register_globals" code? Can this solution be improved?

Christoph
Christoph M. Becker – Plugins for CMSimple_XH

Post Reply