yiisoft/yii2 — pull request #471 by bwoester (2013-06-01 15:03:35+00:00)
Title: mod: convert bizRules into callables, avoiding eval()

This changes the implementation of bizRules. They are no longer strings containing PHP code to be evaluated. Instead they are now callables to be invoked. Related issues are #24 and #42.

Of course Manager-implementations need to be able to (de)serialize the callables, so the usage is most likely limited to defining callbacks in the form of `array($classOrInstance,$methodName)`. PhpManager already used var_export, which works nicely with such callback definitions. DbManager now uses (de)serialize for bizRules just like it does for data.

Since some people were concerned about loosing flexibility if they couldn't pass php code as bizRules, I included an example of an evaluating bizRule callback in the tests. I still don't think this is a commonly required use case, but if someone really requires users being able to write their own bizRule code, they can use such an approach. So we won't loose anything, only difference is it's now in the responsibility of the developer to provide the bizRule callback that does the evaluation.