Till Wehowski - 2018-01-23 03:31:04
I did not check your package on security aspects but I think this part
header("Content-Type: $type");
if(is_string($header)) eval($header);
echo $lob;
you have to overthink, not just because eval is often called ever beeing evil what is in my opionion unjustifiably, but your eval in this case is completly unnecessary!
You are already using the header function for your content-type header, why that "eval($header)"?
You could and should add some possibillities to implement checks on userinput, (maybe it is out of the scope of your package)?
I suggest to "echo" metadata in an serialized format and let the implemetation render the file contents.
...
But however, keep it up coding you will get better!