0

I have a tpl.php page for login form in my drupal site in which have 4 images.

I need to display only one of these 4 images randomly on each page load.

I can easily do this in less than 10 lines of code using the php rand() function.

But is it advisable to directly use such functions in tpl files. Could this have some sort of security risk?

UPDATE:

The 4 images that I talked about. I have just uploaded them to sites/default/files/images folder and have included them in tpl file using following code:

<img src="http://mysite.com/sites/default/files/images/image.jpg"/>

I have a feeling that this is unsafe too. Please advise.

  • 1
    Security risk, not so much. But you will have problems with caching. Templates should be used for display only; all business logic should go elsewhere, namely in a template preprocess function – Clive Nov 12 '13 at 11:02
  • @Clive: Thanks. Also, Please see the updated question. – kmdhrm Nov 12 '13 at 11:13
  • Your update falls under "not best practice", but why do you consider it to be unsafe? What attack vector do you feel you're introducing, or opening up? – Clive Nov 12 '13 at 11:18
  • I have read that when uploading a file file_save_upload may be used which gives the file a temporary status and these files are periodically cleaned. If I directly upload a file, could there be a similar issue? – kmdhrm Nov 12 '13 at 11:25
  • 1
    If someone has told you that showing the full path to an image located on a website is a security risk - stop listening to them :) Then get them to read this – Clive Nov 12 '13 at 11:31
1

For the first part of question:

You may output as form item the output of your custom function, where contain logic to get random image:

function MY_MODULE_form_alter(&$form, &$form_state, $form_id) {
    if ($form_id == 'user_login') {
        $form['img_item'] = array(
          '#type' => 'markup',
          '#markup' => my_random_image_output(),
          '#weight' => -50
        );
    }
}

function my_random_image_output() {
    $output = '';

    // your custom logic to output one image $output = '<img src=".... />'

    return $output;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.