Use an env var to toggle sandboxing

Author: mrjoelkemp

README.md

@@ -33,7 +33,6 @@ You can then point your web server to serve files from the `phpepl/` root folder
 * Namely, you should be able to visit the index page (`phpepl/index.html`) from `http://localhost` (include a custom port if necessary)
  * Ex: `http://localhost:8000/index.html` or simply `http://localhost:8000`, assuming your server is configured to listen to port 8000.
 
-**You then need to disable sandboxing** by toggling the `$sandbox_me` var in `src/eval/index.php` to disable the sandbox locally.
 You'll then have free reign to execute any commands.
 
 #### Vagrant
@@ -64,8 +63,9 @@ If you'd like to tinker around with the code, you can do the following:
 `src/phpepl.js` is the main script for the website. This gets built into `dist/phpepl.js`
 which is referenced by `phpepl/index.html`.
 
-The php evaluation code is in `src/eval/index.php`. That endpoint is sandboxed by default,
-so toggle the `$sandbox_me` var in `src/eval/index.php` to disable the sandbox locally.
+The php evaluation code is in `src/eval/index.php`. That endpoint checks for the existence of a
+`PHPEPL_PROD` environment variable (which is set on the production hosts) for sandboxing. Locally, you won't
+have that set, so you'll have the unsandboxed version by default.
 
 * With grunt running, that change should rebuild the app and you can just refresh the page.
 

src/eval/index.php

@@ -1,7 +1,7 @@
 <?php
-	// set me to false to turn off sandboxing
-	$sandbox_me = true;
-
+	// Only production environments will have this set – turning on sandboxing
+	// DEP_VERSION is for cloud control
+	$sandbox_me = isset($_ENV['PHPEPL_PROD']) || isset($_ENV['DEP_VERSION']);
 	require_once('../../vendor/autoload.php');
 
 	// Turn off errors since eval will throw them on invalid syntax
@@ -85,7 +85,7 @@ function php_execute_sandboxed($code) {
 		    	foreach($pattern as $_pattern){
 			    if(strtolower(substr($_pattern, -1)) == 'e'){
 			        throw new Exception("Can not use PREG_REPLACE_EVAL!");
-			    }	
+			    }
 		    	}
 		    } else if(strtolower(substr($pattern, -1)) == 'e'){
 		        throw new Exception("Can not use PREG_REPLACE_EVAL!");