Added a new plugin handler system that is both faster and more secure.

docs/changelog/7.x.x.txt

@@ -13,6 +13,7 @@
  - Fixed inheritence problems with File/Image assets
  - Added ability for upgrade scripts to contain packages to deploy
  - Fixed chdir problem in Storage -- more remain though
+ - Added a new plugin handler system that is both faster and more secure.
 
 7.4.19
  - fix: Import Package does nothing when re-importing trashed package

lib/WebGUI.pm

@@ -1,6 +1,5 @@
 package WebGUI;
 
-use strict;# qw(vars subs);
 
 our $VERSION = "7.5.0";
 our $STATUS = "beta";
@@ -20,10 +19,12 @@ our $STATUS = "beta";
 
 =cut
 
+use strict;
 use Apache2::Const -compile => qw(OK DECLINED);
 use Apache2::Request;
 use Apache2::ServerUtil ();
 use WebGUI::Config;
+use WebGUI::Pluggable;
 
 =head1 NAME
 
@@ -65,20 +66,14 @@ sub handler {
     foreach my $handler (@{$config->get("urlHandlers")}) {
         my ($regex) = keys %{$handler};
         if ($request->uri =~ m{$regex}i) {
-            my $module = $handler->{$regex};
+            my $output = eval { WebGUI::Pluggable::run($handler->{$regex}, "handler", [$request, $server, $config]) };
-            my $modulePath = $module.".pm";
-            $modulePath =~ s{::}{/}g;
-            eval { require $modulePath };
             if ($@) {
-                $error .= $@;
+                # bad
+                return Apache2::Const::DECLINED;
             }
             else {
-                my $command = $module."::handler";
+                return $output;
-                no strict qw(refs);
+            }                
-                my $out = &$command($request, $server, $config);
-                use strict;
-                return $out;
-            }
         }
 	}
     $request->push_handlers(PerlResponseHandler => sub { 

lib/WebGUI/Operation/Auth.pm

@@ -16,6 +16,7 @@ package WebGUI::Operation::Auth;
 use strict qw(vars subs);
 use URI;
 use WebGUI::Operation::Shared;
+use WebGUI::Pluggable;
 use WebGUI::SQL;
 use WebGUI::User;
 use WebGUI::Utility;
@@ -37,13 +38,13 @@ sub getInstance {
 	$authMethod = $_[0] if($_[0] && isIn($_[0], @{$session->config->get("authMethods")}));
 	my $userId = $_[1];
 	#Create Auth Object
-	my $cmd = "WebGUI::Auth::".$authMethod;
+    my $auth = eval { WebGUI::Pluggable::instanciate("WebGUI::Auth::".$authMethod, "new", [ $session, $authMethod, $userId ] ) };
-	my $load = "use ".$cmd;
+    if ($@) {
-	eval($load);
+        $session->errorHandler->fatal($@);
-	$session->errorHandler->fatal("Authentication module failed to compile: $cmd.".$@) if($@);
+    }
-	my $auth = eval{$cmd->new($session, $authMethod,$userId)};
+    else {
-	$session->errorHandler->fatal("Couldn't instantiate authentication module: $authMethod. Root cause: ".$@) if($@);
+        return $auth;
-	return $auth;
+    };
 }
 
 #-------------------------------------------------------------------

lib/WebGUI/URL/Content.pm

@@ -17,6 +17,7 @@ package WebGUI::URL::Content;
 use strict;
 use Apache2::Const -compile => qw(OK DECLINED);
 use WebGUI::Affiliate;
+use WebGUI::Pluggable;
 use WebGUI::Session;
 
 =head1 NAME
@@ -51,17 +52,11 @@ sub handler {
     $request->push_handlers(PerlResponseHandler => sub {
         my $session = WebGUI::Session->open($server->dir_config('WebguiRoot'), $config->getFilename, $request, $server);
         foreach my $handler (@{$config->get("contentHandlers")}) {
-            my $handlerPath = $handler.".pm";
+            my $output = eval { WebGUI::Pluggable::run($handler, "handler", [ $session ] ) };
-            $handlerPath =~ s{::}{/}g;
-            eval { require $handlerPath };
             if ( $@ ) {
-                $session->errorHandler->error("Couldn't load content handler $handler.");
+                $session->errorHandler->error($@);
             }
             else {
-                my $command = $handler."::handler";
-                no strict qw(refs);
-                my $output = &$command($session);
-                use strict;
                 if ($output) {
                     if ($output eq "cached") {
                         return Apache2::Const::OK;