Re: Providing sandboxed versions of include and require language constructs

Hi!

Thoughts?

This is a fine idea, however actually doing it is not that easy. Note that knowing which function is "safe" is pretty hard, but that's only a start. Plugin code, for example, can call functions outside plugin context, while passing all kinds of arguments - is it safe or not? It depends on the context - e.g. plugin may need access to the database - directly or through some API - but that opens the door to various SQL injections and other mischief, etc. etc. So while the idea is fine, designing a working sandbox is a very complicated task. That said, if you have any ideas - you're welcome to propose. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227