Hi Nate, Jen, team and fellow developers -
I have a media publishing website on D7 - https://www.truthunity.net - where I am the only authenticated user. My question is how difficult it would be to have PHP Filter available for Backdrop.
I have no idea how complicated this would be to do, just asking if it's a big hurdle. I'm also aware of all the warnings about allowing PHP scripts in the body field and I'm open to alternative techniques, but porting from D7 will require something because a few short, utility like PHP scripts are all over hundreds of nodes. Here's an example:
/**
* Function called from node to obtain the path to the Amazon Content Delivery Network
*
* Usage:
*
* <?php bizmark_cdnpath(); ?>
*
*/
function bizmark_cdnpath() {
echo 'https://s3.amazonaws.com/truthunity/';
}
I've got similar utility scripts that embed menus in nodes, embed JW Player in nodes, etc. They are all short and used repeatedly in similar nodes.
I'm open to funding the request and am shooting for $500 or less.
Let me know your thoughts. Thanks so much
The PHP filter is a swiss army knife that enables site builders to satisfy a few unique requirements quickly and easily. There's an argument to be had about whether it makes sense to compartmentalize functionality (ie. a page shouldn't perform logic, it should be a module), and there is another important argument about how the PHP filter is clearly a security concern.
However, in practice it often makes business sense to simply put 3 lines of PHP code in a node to meet objectives. Perhaps the goal here should be to create an enhanced version of the PHP filter that defaults to a more secure configuration.
I have working code of a safer version of the PHP filter that works by allowing users to create functions in a custom PHP file, and then they are able to call only those functions from the body of content. This way malicious attacks can't execute PHP code from the database, and also all custom functions are compartmentalized into a file.
It looks like this:
In the content of a node you add a token, something like: [custom_php render_adjusted_date 'm-Y']
Then in a custom PHP file you have this function: custom_functions_render_adjusted_date($format)
The PHP filter inserts that function into your node and performs a php_eval. The result is the equivalent of inserting your desired PHP code into the node, except that you keep the actual PHP code in a separate file, and the plugin can only trigger functions found in that file.
If this sounds like it would be helpful, I'd be happy to contribute the module.