Merge pull request #2426 from elcreator/ref-remove-eval-from-browser

ref(manager): Removed eval from browser.php

Author: Seiger

manager/media/browser/mcpuk/core/browser.php

@@ -1224,15 +1224,10 @@ protected function output($data = null, $template = null)
 
         if (file_exists("tpl/tpl_$template.php")) {
             ob_start();
-            $eval = "unset(\$data);unset(\$template);unset(\$eval);";
-            $_ = $data;
-            foreach (array_keys($data) as $key) {
-                if (preg_match('/^[a-z\d_]+$/i', $key)) {
-                    $eval .= "\$$key=\$_['$key'];";
-                }
-            }
-            $eval .= "unset(\$_);require \"tpl/tpl_$template.php\";";
-            eval($eval);
+            // EXTR_SKIP keeps $data/$template/$this from being clobbered by a data key.
+            extract($data, EXTR_SKIP);
+            unset($data);
+            require "tpl/tpl_$template.php";
 
             return ob_get_clean();
         }