Merge pull request #67 from andywer/master

Replaced nasty eval() code

program/include/rcmail_output_html.php

@@ -731,14 +731,13 @@ class rcmail_output_html extends rcmail_output
     /**
      * Determines if a given condition is met
      *
-     * @todo   Get rid off eval() once I understand what this does.
      * @todo   Extend this to allow real conditions, not just "set"
      * @param  string Condition statement
      * @return boolean True if condition is met, False if not
      */
     protected function check_condition($condition)
     {
-        return eval("return (".$this->parse_expression($condition).");");
+        return $this->eval_expression($condition);
     }
 
 
@@ -760,14 +759,11 @@ class rcmail_output_html extends rcmail_output
 
 
     /**
-     * Parses expression and replaces variables
-     *
+     * Parse & evaluate a given expression and return its result.
      * @param  string Expression statement
-     * @return string Expression value
      */
-    protected function parse_expression($expression)
-    {
-        return preg_replace(
+    protected function eval_expression ($expression) {
+        $expression = preg_replace(
             array(
                 '/session:([a-z0-9_]+)/i',
                 '/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i',
@@ -779,14 +775,27 @@ class rcmail_output_html extends rcmail_output
             ),
             array(
                 "\$_SESSION['\\1']",
-                "\$this->app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
-                "\$this->env['\\1']",
+                "\$app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
+                "\$env['\\1']",
                 "rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)",
                 "\$_COOKIE['\\1']",
-                "\$this->browser->{'\\1'}",
+                "\$browser->{'\\1'}",
                 $this->template_name,
             ),
-            $expression);
+            $expression
+        );
+        
+        $fn = create_function('$app,$browser,$env', "return ($expression);");
+        if(!$fn) {
+            rcube::raise_error(array(
+                'code' => 505,
+                'type' => 'php',
+                'file' => __FILE__,
+                'line' => __LINE__,
+                'message' => "Expression parse error on: ($expression)"), true, false);
+        }
+        
+        return $fn($this->app, $this->browser, $this->env);
     }
 
 
@@ -839,7 +848,7 @@ class rcmail_output_html extends rcmail_output
             // show a label
             case 'label':
                 if ($attrib['expression'])
-                    $attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";");
+                    $attrib['name'] = $this->eval_expression($attrib['expression']);
 
                 if ($attrib['name'] || $attrib['command']) {
                     // @FIXME: 'noshow' is useless, remove?
@@ -971,8 +980,7 @@ class rcmail_output_html extends rcmail_output
 
             // return code for a specified eval expression
             case 'exp':
-                $value = $this->parse_expression($attrib['expression']);
-                return eval("return html::quote($value);");
+                return html::quote( $this->eval_expression($attrib['expression']) );
 
             // return variable
             case 'var':