Hi junxiong,
Am I missing something, or you suffer for an extreme lack of troubles and asking yourself for a really big problem? :] You want to… [b]allow your user to upload PHP file that you would then parse /b inside your own application? OMG! I wouldn’t be able to figure out a better way to ask someone to destroy your application! :]
How you would like to check if particular piece of PHP file truly contains only layout, not some dangerous code? That could not only burn your whole application but also can be a potential problem to the whole server. And I’m not talking about serious security breaches here. Simple endless loop, that will starve to death your application resources (or maybe whole server, if it is badly configured) is the first thing on a really long list of problems someone may cause, when allowed to upload and run PHP code in your website.
Not mentioning that, if server is badly secured - your PHP application will be open to use file-related functions to open some protocols and streams like HTTP. There isn’t an easier way to attack another website using code uploaded to your website, making it therefore responsible for the whole attack!
Second problem - access rights. I’m a total Linux newbie, but since PHP files are executable ones under Linux server, you have to give them (and folder you will be holding them) and execute right. Changing access rights to newly created folders is a piece of hard job in PHP (if it is allowed by server configuration) and it is also a practice that most administrators and developers wouldn’t find to good. And I can’t even imagine about idea of uploading user PHP files to protected/views folder, that is - allowing them to inject any PHP code directly into your application. That is a total madness. If you would agree on that, the only thing left to do would be to write a long, good visible message saying Hi, I’m the application ready to be destroyed - please upload any PHP code to this field. Forgive me for sarcasm! :]
Not mentioning, aesthetic problem! Badly coded CSS may make your page look like a s**t. You sure, you want it?
Are you really sure, you want to allow your users to upload own layouts? I’m trying to see this not as developer, but as regular user. Who the hell have time playing with understanding Yii’s (your’s) way of organising and implementing layouts? Who will want to play with it. Defining own layouts, themes or styles - a fixed group of fixed looks for your application - and allowing to your users to select one of closed, not user-editable of them instead of allowing to upload one - is far, far enough in my opinion.
If you really, really need to allow your users to upload own layouts, you have to design and develop your own so-called language for describing them and own engine for parsing them. Do not allow your user to upload a pure PHP code or you’re going to get yourself into a real problems!
At the end of this, probably my longest post in this forum I just want to summarise that I hope that I miss-understood you, that you don’t want to do, what I think, you want to do and that my whole talking about is just a piece of useless bulls**t! :]
Cheers,
Trejder