MyBB Community Forums

I have a question for MyBB Developers.

Why do you use eval() to parse php variables in the templates? And how can you protect the software from malicious code run via eval()?
I took a look at the output_page() and parse_page() functions but I didn't find my answer.

I'm curious.

The templates are scanned upon insertion/revision for malicious code.

Also, templates can only be edited by someone who can access the Admin CP and has the can edit templates permission. If you think someone is going to put undesirable code in your templates, don't give them permission to that module.

(2014-05-23, 11:48 PM)Paul H. Wrote: [ -> ]The templates are scanned upon insertion/revision for malicious code.

But where is this scanning located?

mybb root > admin > inc > functions.php and the check_template function