vb.org Archive - where to place my safe custom functions?

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=15)

- - where to place my safe custom functions? (https://vborg.vbsupport.ru/showthread.php?t=313232)

where to place my safe custom functions?

Hi...

Possibly a new security feature of my vBulletin is stopping me from including my custom php file which has a custom-function within it and then using that function in a custom template, where should I place my 'safe' function and get my template working again?

The error I'm having is:

Fatal error: Call to undefined function customfunction() in /home/www/xxx/includes/adminfunctions_template.php(3950) : eval()'d code(277) : eval()'d code on line 47

please advise

Use hook: template_safe_faunctions

Code:

$safe_functions[] = 'my_php_function_name';

Hopefully, I understood your question correctly. :)

Quote:

Originally Posted by tbworld (Post 2508270)

Use hook: template_safe_faunctions

Code:

$safe_functions[] = 'my_php_function_name';

Hopefully, I understood your question correctly. :)

Yes I think you have...Not sure where to use it, but i'll try thanks

This should help. :)

http://www.vbulletin.com/docs/html/f...n_conditionals

If you have a specific question and you can show your work, then I can be of more assistance. :)

Thank you...

Yes were on the right track...

I have a custom php file in my forums directory which through a template is being included, all that php file really has in it is that function, the template is not being saved telling me it's undefined...

So in the php file I've included the line : $safe_functions[] = 'myFunction';
but it's a no show still...

It all used to work :) using vBulletin 3.8.7 Patch Level 4 - Just need to let vB know that myFunction is a good'un and I'm golden.. the custom php file is being included, just can't save the template without an error....

Thanks for the help.

\
EDIT, I'm getting it now I think....

Quote:

Originally Posted by b6gm6n (Post 2508279)

"Safe Functions" allows a PHP function or user function to be accessible via a template. It's main purpose was to limit harmful functions from being executed at presentation. "$safe_function" is an array that you can add the name of your function to, this is added to the array at template hook: "template_safe_functions". (See .. "/includes/adminfunctions_template.php" around line ~1888.

I have a notion that you are trying to send information to the template through output buffering, but cannot be sure without seeing your code. My forte' lies with vb4, so you could be still doing something I am not familiar with.

Yeah I dunno...

just want a function included simple as...

so I see in my 'adminfunctions_template.php' this line:

($hook = vBulletinHook::fetch_hook('template_safe_functions ')) ? eval($hook) : false;

What's a hook? do I need to create a new plugin for my function? insert some code into my custom php file to allow vB to accept it? or insert more code into my custom template? or create a new template with proper allowed custom functions? - I'm confused...

I'll explain, this should be easier you know :D

Got a custom php file, it's being included, here's the code

Code:

<?

function paginateRecords($dataFile,$page,$numRecs=10){



    $output='';



    // validate data file



    (file_exists($dataFile))?$data=(file



    ($dataFile)):die('Data file not valid.');



    // validate number of records per page



    (is_int($numRecs)&&$numRecs>0)?$numRecs=$numRecs:die



    ('Invalid number of records '.$numRecs);



    // calculate total of records



    $numPages=ceil(count($data)/$numRecs);



    // validate page pointer



    if(!preg_match("/^\d{1,2}$/",$page)



    ||$page<1||$page>$numPages){



    $page=1;



    }



    // retrieve records from flat file



    $data=array_slice($data,($page-1)*$numRecs,$numRecs);



    // append records to output



    foreach($data as $row){



    $columns=explode('_',$row);



    foreach($columns as $column){



    $output.=$column.'&nbsp;';



    }



    $output.='<br />';



    }



    // create previous link



    $output.='<div class="cheatpagenation">';



    if($page>1){



    $output.='<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page-1).'">&lt;&lt; Previous</a>&nbsp;';



    }



    // create intermediate links



    for($i=1;$i<=$numPages;$i++){



    ($i!=$page)?$output.='<a href="'.$_SERVER



    ['PHP_SELF'].'?page='.$i.'">'.$i.'</a>&nbsp;':$output.=$i.'&nbsp;';



    }



    // create next link



    if($page<$numPages){



    $output.='&nbsp;<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page+1).'">Next &gt;&gt;</a></div>';



    }



    // return final output



    return $output;



    }

?>

So in my custom template I have this line:

Code:

//  //    require_once('top10pagenation.php');

//    $page=$_GET['page'];

//    echo paginateRecords('top10.txt',$page);

It's all commented out at the moment as I can't save it without that error

Thanks ever so for the help, I just can't seem to understand what's what with this, cheers

--------------- Added [DATE]1406330921[/DATE] at [TIME]1406330921[/TIME] ---------------

I placed in the admin_functions template near those lines you mentioned

'$safe_functions = array(
'paginateRecords', // test
);

so it's like this now:

Code:

        static $safe_functions;

        if (!is_array($safe_functions))

        {

                $safe_functions = array(

                        // logical stuff

                        0 => 'and',              // logical and

                        1 => 'or',               // logical or

                        2 => 'xor',              // logical xor



                        // built-in variable checking functions

                        'in_array',              // used for checking

                        'is_array',              // used for checking

                        'is_numeric',            // used for checking

                        'isset',                 // used for checking

                        'empty',                 // used for checking

                        'defined',               // used for checking

                        'array',                 // used for checking



                        // vBulletin-defined functions

                        'can_moderate',          // obvious one

                        'can_moderate_calendar', // another obvious one

                        'exec_switch_bg',        // harmless function that we use sometimes

                        'is_browser',            // function to detect browser and versions

                        'is_member_of',          // function to check if $user is member of $usergroupid

                        'paginateRecords',          // test

                );

just to add my function at the end, still can't save my template.. same error

Quote:

Originally Posted by b6gm6n (Post 2508283)

What's a hook? do I need to create a new plugin for my function? insert some code into my custom php file to allow vB to accept it? or insert more code into my custom template? or create a new template with proper allowed custom functions? - I'm confused...

Other than using variables to build the output html, in general you cannot put php in a template. The exception is in a conditon (i.e <if condition="....), and then you can only put what would go in a php 'if' statement, and you can only use the "safe" functions.

But I don't think that's what you want. It looks to me like you are trying to call your custom function to do some formatting, in which case you would want to use a plugin. Your code would then create one or more variables and you'd use them in a template.

So, which hook location should you use? It depends on what you're trying to do. Hooks are just places in the vbulletin scripts where addon code can be called, so you need to find one in a location that's allows you to do what you want to do.

Quote:

Originally Posted by kh99 (Post 2508285)

Got ya... might need a little help, I'm getting there, I've created a plugin with that function, see below:

Code:

<?xml version="1.0" encoding="ISO-8859-1"?>



<plugins>

        <plugin active="1" executionorder="9" product="vbulletin">

                <title>paginateRecords</title>

                <hookname>template_safe_functions</hookname>

                <phpcode><![CDATA[function paginateRecords($dataFile,$page,$numRecs=10){







    $output='';







    // validate data file







    (file_exists($dataFile))?$data=(file



    ($dataFile)):die('Data file not valid.');







    // validate number of records per page







    (is_int($numRecs)&&$numRecs>0)?$numRecs=$numRecs:die



    ('Invalid number of records '.$numRecs);







    // calculate total of records







    $numPages=ceil(count($data)/$numRecs);







    // validate page pointer







    if(!preg_match("/^\d{1,2}$/",$page)



    ||$page<1||$page>$numPages){







    $page=1;







    }







    // retrieve records from flat file







    $data=array_slice($data,($page-1)*$numRecs,$numRecs);







    // append records to output







    foreach($data as $row){







    $columns=explode('_',$row);







    foreach($columns as $column){







    $output.=$column.'&nbsp;';







    }







    $output.='<br />';







    }







    // create previous link



    $output.='<div class="cheatpagenation">';



    if($page>1){



    $output.='<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page-1).'">&lt;&lt; Previous</a>&nbsp;';







    }







    // create intermediate links







    for($i=1;$i<=$numPages;$i++){







    ($i!=$page)?$output.='<a href="'.$_SERVER



    ['PHP_SELF'].'?page='.$i.'">'.$i.'</a>&nbsp;':$output.=$i.'&nbsp;';







    }







    // create next link







    if($page<$numPages){







    $output.='&nbsp;<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page+1).'">Next &gt;&gt;</a></div>';



    }







    // return final output







    return $output;







    }]]></phpcode>

        </plugin>

</plugins>

no errors, in my template which I can save now shows nothing on the page itself, just a white screen...

My template (incidentally I have php plugin which allows me to use php in templates, so for the 'echo' statement I'm hoping is all ok)

Code:

//    require_once('top10pagenation.php');

    $page=$_GET['page'];

    echo paginateRecords('top10.txt',$page);

So I'm getting there, do I need to call the hook/function in a different way within my custom template? please advise, thank you

Couple questions:
What modification are you using to include PHP in templates?
What template are you inserting this into?

You do not need "$safe_functions" for what you are doing, since you are circumventing the template system.

Give me a few minutes to get my bearing on this with VB3. :)

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (7)bbcode_code_printable (4)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01285 seconds Memory Usage 1,795KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (7)bbcode_code_printable (4)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: