Disable Formula Evaluation due to eval() use

Hi,

thanks for your post, and sorry for the trouble.

TablePress does indeed use a formula evaluation library that uses the PHP eval() function, but only after extensive sanitization and formula parsing.

Unfortunately, there’s no direct way to turn off the formula evaluation. If you really must, you could use a filter hook to override the loading of the PHP class. TablePress a custom class loader, see https://github.com/TobiasBg/TablePress/blob/master/classes/class-render.php#L147-L148 , which you could intercept via the filter hooks https://github.com/TobiasBg/TablePress/blob/master/classes/class-tablepress.php#L204 and https://github.com/TobiasBg/TablePress/blob/master/classes/class-tablepress.php#L178
You would have to replace that with a mock class that has a method https://github.com/TobiasBg/TablePress/blob/master/classes/class-evaluate.php#L70 and that returns the unmodified input data.

By the way, I’ll soon be replacing the formula evaluation library that TablePress uses with a new one in TablePress 2.0. The new one has more features and does not rely on eval(). It would then be necessary to revert your customizations from above again, so that you can then again use formulas.
That said, I’m not sure that you really have to take action here right now. Just deactivate eval() on the server, and in the event that you do get warnings or errors, educate users to not use formulas (if that’s an option).

Regards,
Tobias

Hey Tobias,

Thank you for your response, this is super helpful. You mention that TablePress 2.0 will not depend on the class with eval(), do you have any rough estimate when that version will be available? Basically, so I know if it will be worth going through the process of overriding the class. My need to remove eval is not urgent.

Regards,
Ivan

Hi Ivan,

good to hear that this is helpful!
My current plans for TablePress 2.0 aim at the late second quarter – but no guarantees ??

Regards,
Tobias

Hi,

and here it is, the first beta of TablePress 2.0 is ready for testing, if you are still looking for formula evaluation without eval(): https://tablepress.org/8-million-downloads-tablepress-2-0/

Best wishes,
Tobias

Thanks, amazing improvement and congrats on the 2.0!

Hi,

good to hear that you like it! I hope it will be helpful!

Best wishes,
Tobias
?
P.S.: In case you haven’t, please rate TablePress here in the plugin directory. Thanks!