Embedded Perl Code

Short description

This will allow any editor (means anyone for unprotected Wikis) to insert Perl code into Wiki sites. You simply place <perl>-tags into your page and write a nameless sub inside them. UseMod then replaces the tag bit with the return value of the code reference.

I.e.:

  <perl>

  sub {

    return "\n= Hello world! =\n";
  }

  </perl>

will give a "Hello world!"-heading 1 as the output is parsed in the usual way (almost) by UseMod. This is highly dangerous!!! Unless the wiki is protected and public to a very limited set of persons of high trust I would not recommend applying this patch.

How to apply

After line 1574:

  my ($pageText) = @_;

insert:

  my ($PerlCode?, $ReturnValue?);

and after line 1590:

  $pageText = &RemoveFS?($pageText);

insert:

    # To be able to EMBED PERL CODE...
  if ( $AllowEval? ) {
    while ( $pageText =~ m!<perl>((.|\n)*?)</perl>!mig ) {
        $PerlCode? = eval( $1 );
        $ReturnValue? = &{$PerlCode?}() if ( ref $PerlCode? );
        $pageText =~
            s!<perl>((.|\n)*?)</perl>!&StoreRaw(&ParseParagraph?($ReturnValue?))!mie;
    }
  }
    # MIGHT BE A SECURITY HAZARD!!!

You have to change

  use strict;

into

  use strict 'vars';

and you will like to insert $AllowEval? into the list of variables declared at the top of UseMod.

After that, you can put $AllowEval? into your config file and set it to 1. Happy coding ;) --Udo Güngerich, 2005-08-22

• How about # EXTREME SECURITY HAZARD!!!

• Well, you wanna make sure that nobody will be able to hijack sessions or differently gains ability to edit your pages, that's a definite. On the other hand, this could be an easy alternative to develop intranet web applications without Mason, Embperl, Zope or TWiki and that sort of stuff. Then again, maybe I just did it because I liked to play around with possibilities a bit. --UdoGüngerich, 2005-08-24

This patch can be useful even for public wikis. You can combine with this other patch [Banned Content], including "<perl>" and "</perl>" as banned text (if user is not admin). --JuanmaMP (2009.12.15)