comfy/comfortable-mexican-sofa — Issue #140: Running ruby code inside eval helper (and maybe others)
Author: holli
Created: 2012-01-26 13:00:36+00:00
State: open

I created a layout with code

```
{{ cms:helper:puts:"hello world" }}
{{ cms:helper:eval:"User.first.inspect" }}
{{ cms:helper:eval:"User.where(\'id > 10\').first.inspect" }}
```

First user will be fetched from db and displayed in page.

Looking for the helper tag it looks like everything is outputted directly as given.
https://github.com/comfy/comfortable-mexican-sofa/blob/master/lib/comfortable_mexican_sofa/tags/helper.rb#L10

Is there some solution to forbid others from using eval (and others) inside helpers? Is there way to limit helpers to some specific ones?