[Resolved] Toolset using eval() flagged as security issue by WP Defender plugin

[Author]

Posts

[Clifford]

When using the WP Defender Pro plugin (hidden link), it reports a security concern due to Toolset's code using eval()

hidden link
> Caution: The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.

So why does eval() exist in your code? If it's absolutely necessary, I will "Ignore" it in the report's action items but thought I'd confirm with you first.

[Nigel]

Hi Clifford

It's effectively a false-positive in this case, and eval is required.

You can read more here: https://toolset.com/toolset-requirements/#eval-usage

[Clifford]

tyvm