condition.rb in openwferu-0.9.7

- old
+ new

@@ -37,11 +37,13 @@
 # "made in Japan"
 #
 # John Mettraux at openwfe.org
 #
 
+require 'openwfe/util/safe'
 
+
 module OpenWFE
 
     #
     # A ConditionMixin is a mixin for flow expressions like 'if' and 'break' for
     # example.
@@ -63,11 +65,12 @@
 
             conditional = lookup_attribute(attname, workitem)
             rconditional = lookup_attribute("r"+attname.to_s, workitem)
 
             if rconditional and not conditional
-                return instance_eval(rconditional)
+                #return instance_eval(rconditional)
+                return do_eval(rconditional)
             end
 
             return nil unless conditional
 
             #ldebug { "eval_condition() 0 for  '#{conditional}'" }
@@ -78,11 +81,12 @@
 
             conditional = do_quote(conditional)
 
             ldebug { "eval_condition() 2 for  '#{conditional}'" }
 
-            result = instance_eval(conditional)
+            #result = instance_eval(conditional)
+            result = do_eval(conditional)
 
             ldebug { "eval_condition() 3 result is  '#{result}'" }
 
             return (result == "true" or result == true)
         end
@@ -111,9 +115,17 @@
                 '" ' +
                 string[i..i+2] +
                 ' "' +
                 string[i+2..-1].strip +
                 '"'
+            end
+
+            #
+            # Runs the given given within an instance_eval() at a $SAFE
+            # level of 3.
+            #
+            def do_eval (s)
+                OpenWFE::instance_eval_safely(self, s, 3)
             end
     end
 
 end
 