smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-12-16 02:28:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

security can now disable special $smarty variables

Browse Source 
see also NEW_FEATURES.txt
This commit is contained in:
Uwe Tews
2014-12-29 21:59:23 +01:00
parent 49a3427515
commit 1da50aa61d
4 changed files with 107 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
libs/sysplugins/smarty_security.php
View File

@@ -115,6 +115,12 @@ class Smarty_Security
* @var array
*/
public $disabled_modifiers = array();
/**
* This is an array of disabled special $smarty variables.
*
* @var array
*/
public $disabled_special_smarty_vars = array();
/**
* This is an array of trusted streams.
* If empty all streams are allowed.
@@ -273,6 +279,25 @@ class Smarty_Security
return false; // should not, but who knows what happens to the compiler in the future?
}
/**
* Check if special $smarty variable is trusted.
*
* @param string $var_name
* @param object $compiler compiler object
*
* @return boolean true if tag is trusted
* @throws SmartyCompilerException if modifier is not trusted
*/
public function isTrustedSpecialSmartyVar($var_name, $compiler)
{
if (!in_array($var_name, $this->disabled_special_smarty_vars)) {
return true;
} else {
$compiler->trigger_template_error("special variable '\$smarty.{$var_name}' not allowed by security setting", $compiler->lex->taglineno);
}
return false; // should not, but who knows what happens to the compiler in the future?
}
/**
* Check if modifier plugin is trusted.