base_path = $base_path; } /** * Render a view file. This will be used to render a whole page. * If a layout is defined, then we will render layout + view. * * @param string $view The name of the view file to render. * @param array $params An optional array of parameters to pass to the view file. * * @return string */ public function render( $view, $params = array() ) { $view_file = $this->base_path . DIRECTORY_SEPARATOR . $view . '.php'; $real_base = realpath( $this->base_path ); $real_file = realpath( $view_file ); if ( false !== $real_base && false !== $real_file && str_starts_with( $real_file, rtrim( $real_base, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR ) && is_file( $real_file ) ) { return $this->render_php_file( $real_file, $params ); } return ''; } /** * Renders a PHP file and returns its output. * * @param string $_view_file_path_ The path to the PHP file to render. * @param array $params An optional array of parameters to pass to the PHP file. * * @return string The output of the rendered PHP file. */ private function render_php_file( $_view_file_path_, $params = array() ) { ob_start(); ob_implicit_flush( false ); $reserved_names = array( '_view_file_path_', 'params', 'param_name', 'param_value', 'reserved_names', 'GLOBALS', 'this', ); foreach ( $params as $param_name => $param_value ) { if ( is_string( $param_name ) && preg_match( '/^[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*$/', $param_name ) && ! in_array( $param_name, $reserved_names, true ) ) { ${$param_name} = $param_value; } } unset( $param_name, $param_value, $reserved_names ); require $_view_file_path_; return ob_get_clean(); } }