diff --git a/gulliver/system/class.bootstrap.php b/gulliver/system/class.bootstrap.php index 65a737522..c07ffdac8 100644 --- a/gulliver/system/class.bootstrap.php +++ b/gulliver/system/class.bootstrap.php @@ -827,6 +827,11 @@ class Bootstrap $typeName = trim($typeName); $fileConst = ($typeName == 'translation') ? 'translation.' . $locale : 'translation.' . $typeName . '.' . $locale; + if (!preg_match('/^[a-zA-Z0-9_]+$/', $typeName)) { + error_log("Attempted to stream invalid translation type: " . $typeName); + return ''; + } + if ($typeName == 'translation') { $defaultTranslations = array(); $foreignTranslations = array(); @@ -863,11 +868,16 @@ class Bootstrap $newName = implode('.', $typearray); if (file_exists(PATH_LANGUAGECONT . $newName)) { require_once(PATH_LANGUAGECONT . $newName); - $return = ''; - eval('$return = "var TRANSLATIONS_" . strtoupper($typeName) . " = " . Bootstrap::json_encode($translation' . $typeName . ') . ";";'); - return $return; + $dynamicTranslationVarName = 'translation' . $typeName; + if (isset($$dynamicTranslationVarName) && is_array($$dynamicTranslationVarName)) { + $translationToEncode = $$dynamicTranslationVarName; + return 'var TRANSLATIONS_' . strtoupper($typeName) . ' = ' . Bootstrap::json_encode($translationToEncode) . ';'; + } else { + error_log("Missing or invalid translation array for type: " . $typeName); + return ''; + } } - return; + return ''; } }