added $enable_eval

git-svn-id: svn://svn.lighttpd.net/xcache/trunk@591 c26eb9a1-5813-0410-bd6c-c2e55f420ca7

admin/config.php.example

@@ -16,6 +16,10 @@ $usage_graph_width = 120;
 // do not define both with
 // $free_graph_width = 120;
 
+// only enable if you have password protection for admin page
+// enabling this option will cause user to eval() whatever code they want
+$enable_eval = false;
+
 // this function is detected by xcache.tpl.php, and enabled if function_exists
 // this ob filter is applied for the cache list, not the whole page
 function ob_filter_path_nicer($o)

admin/edit.php

@@ -11,12 +11,24 @@ $name = $_GET['name'];
 $vcnt = xcache_count(XC_TYPE_VAR);
 
 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
-	eval('$value = ' . $_POST['value']);
+	if ($enable_eval) {
+		eval('$value = ' . $_POST['value']);
+	}
+	else {
+		$value = $_POST['value'];
+	}
 	xcache_set($name, $value);
 	header("Location: xcache.php?type=" . XC_TYPE_VAR);
 	exit;
 }
-$value = var_export(xcache_get($name), true);
+$value = xcache_get($name);
+if ($enable_eval) {
+	$value = var_export($value, true);
+	$editable = true;
+}
+else {
+	$editable = is_string($value);
+}
 
 $xcache_version = XCACHE_VERSION;
 $xcache_modules = XCACHE_MODULES;

admin/edit.tpl.php

@@ -6,7 +6,7 @@ $h_value = htmlspecialchars($value);
 <form method="post" action="">
 	<fieldset>
 		<legend><?php echo sprintf(_T("Editing Variable %s"), $h_name); ?></legend>
-		<textarea name="value" style="width: 100%; height: 200px; overflow-y: auto"><?php echo $h_value; ?></textarea><br>
+		<textarea name="value" style="width: 100%; height: 200px; overflow-y: auto" <?php echo $editable ? "" : "disabled=disabled"; ?>><?php echo $h_value; ?></textarea><br>
 		<input type="submit">
 	</fieldset>
 </form>