XOOPS /
XoopsCore25
| Conditions | 22 |
| Paths | 81 |
| Total Lines | 85 |
| Code Lines | 46 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 25 | function smarty_function_math($params, &$smarty) |
||
| 26 | { |
||
| 27 | static $_allowed_funcs = |
||
| 28 | array('int' => true, 'abs' => true, 'ceil' => true, 'cos' => true, 'exp' => true, 'floor' => true, |
||
| 29 | 'log' => true, 'log10' => true, 'max' => true, 'min' => true, 'pi' => true, 'pow' => true, 'rand' => true, |
||
| 30 | 'round' => true, 'sin' => true, 'sqrt' => true, 'srand' => true, 'tan' => true); |
||
| 31 | // be sure equation parameter is present |
||
| 32 | if (empty($params[ 'equation' ])) { |
||
| 33 | trigger_error("math: missing equation parameter", E_USER_WARNING); |
||
| 34 | |||
| 35 | return; |
||
| 36 | } |
||
| 37 | |||
| 38 | $equation = $params[ 'equation' ]; |
||
| 39 | |||
| 40 | // make sure parenthesis are balanced |
||
| 41 | if (substr_count($equation, "(") != substr_count($equation, ")")) { |
||
| 42 | trigger_error("math: unbalanced parenthesis", E_USER_WARNING); |
||
| 43 | |||
| 44 | return; |
||
| 45 | } |
||
| 46 | |||
| 47 | // disallow backticks |
||
| 48 | if (strpos($equation, '`') !== false) { |
||
| 49 | trigger_error("math: backtick character not allowed in equation", E_USER_WARNING); |
||
| 50 | |||
| 51 | return; |
||
| 52 | } |
||
| 53 | |||
| 54 | // also disallow dollar signs |
||
| 55 | if (strpos($equation, '$') !== false) { |
||
| 56 | trigger_error("math: dollar signs not allowed in equation", E_USER_WARNING); |
||
| 57 | |||
| 58 | return; |
||
| 59 | } |
||
| 60 | |||
| 61 | foreach ($params as $key => $val) { |
||
| 62 | if ($key != "equation" && $key != "format" && $key != "assign") { |
||
| 63 | // make sure value is not empty |
||
| 64 | if (strlen($val) == 0) { |
||
| 65 | trigger_error("math: parameter '{$key}' is empty", E_USER_WARNING); |
||
| 66 | |||
| 67 | return; |
||
| 68 | } |
||
| 69 | if (!is_numeric($val)) { |
||
| 70 | trigger_error("math: parameter '{$key}' is not numeric", E_USER_WARNING); |
||
| 71 | |||
| 72 | return; |
||
| 73 | } |
||
| 74 | } |
||
| 75 | } |
||
| 76 | |||
| 77 | // match all vars in equation, make sure all are passed |
||
| 78 | preg_match_all('!(?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*)!', $equation, $match); |
||
| 79 | |||
| 80 | foreach ($match[ 1 ] as $curr_var) { |
||
| 81 | if ($curr_var && !isset($params[ $curr_var ]) && !isset($_allowed_funcs[ $curr_var ])) { |
||
| 82 | trigger_error("math: function call '{$curr_var}' not allowed, or missing parameter '{$curr_var}'", E_USER_WARNING); |
||
| 83 | |||
| 84 | return; |
||
| 85 | } |
||
| 86 | } |
||
| 87 | |||
| 88 | foreach ($params as $key => $val) { |
||
| 89 | if ($key != "equation" && $key != "format" && $key != "assign") { |
||
| 90 | $equation = preg_replace("/\b$key\b/", " \$params['$key'] ", $equation); |
||
| 91 | } |
||
| 92 | } |
||
| 93 | $smarty_math_result = null; |
||
| 94 | eval("\$smarty_math_result = " . $equation . ";"); |
||
|
|
|||
| 95 | |||
| 96 | if (empty($params[ 'format' ])) { |
||
| 97 | if (empty($params[ 'assign' ])) { |
||
| 98 | return $smarty_math_result; |
||
| 99 | } else { |
||
| 100 | $smarty->assign($params[ 'assign' ], $smarty_math_result); |
||
| 101 | } |
||
| 102 | } else { |
||
| 103 | if (empty($params[ 'assign' ])) { |
||
| 104 | printf($params[ 'format' ], $smarty_math_result); |
||
| 105 | } else { |
||
| 106 | $smarty->assign($params[ 'assign' ], sprintf($params[ 'format' ], $smarty_math_result)); |
||
| 107 | } |
||
| 108 | } |
||
| 109 | } |
||
| 110 |
On one hand,
evalmight be exploited by malicious users if they somehow manage to inject dynamic content. On the other hand, with the emergence of faster PHP runtimes like the HHVM,evalprevents some optimization that they perform.