smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-05 10:54:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

- bugfix escape Smarty exception messages to avoid possible script execution

Browse Source
This commit is contained in:
uwe.tews@googlemail.com
2012-09-11 16:23:30 +00:00
parent 81a6d0869b
commit 4305a8931c
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
change_log.txt
View File

@@ -1,4 +1,7 @@
===== trunk ===== ===== trunk =====
11.09.2012
- bugfix escape Smarty exception messages to avoid possible script execution
10.09.2012 10.09.2012
- bugfix tag option flags and shorttag attributes did not work when rdel started with '=' (Forum Topic 22979) - bugfix tag option flags and shorttag attributes did not work when rdel started with '=' (Forum Topic 22979)

11
libs/Smarty.class.php
View File

@@ -189,12 +189,12 @@ class Smarty extends Smarty_Internal_TemplateBase {
* Flag denoting if PCRE should run in UTF-8 mode * Flag denoting if PCRE should run in UTF-8 mode
*/ */
public static $_UTF8_MODIFIER = 'u'; public static $_UTF8_MODIFIER = 'u';
/** /**
* Flag denoting if operating system is windows * Flag denoting if operating system is windows
*/ */
public static $_IS_WINDOWS = false; public static $_IS_WINDOWS = false;
/**#@+ /**#@+
* variables * variables
*/ */
@@ -1281,7 +1281,7 @@ class Smarty extends Smarty_Internal_TemplateBase {
} }
// plugin filename is expected to be: [type].[name].php // plugin filename is expected to be: [type].[name].php
$_plugin_filename = "{$_name_parts[1]}.{$_name_parts[2]}.php"; $_plugin_filename = "{$_name_parts[1]}.{$_name_parts[2]}.php";
$_stream_resolve_include_path = function_exists('stream_resolve_include_path'); $_stream_resolve_include_path = function_exists('stream_resolve_include_path');
// loop through plugin dirs and find the plugin // loop through plugin dirs and find the plugin
@@ -1302,7 +1302,7 @@ class Smarty extends Smarty_Internal_TemplateBase {
} else { } else {
$file = Smarty_Internal_Get_Include_Path::getIncludePath($file); $file = Smarty_Internal_Get_Include_Path::getIncludePath($file);
} }
if ($file !== false) { if ($file !== false) {
require_once($file); require_once($file);
return $file; return $file;
@@ -1481,6 +1481,9 @@ if (Smarty::$_CHARSET !== 'UTF-8') {
* @package Smarty * @package Smarty
*/ */
class SmartyException extends Exception { class SmartyException extends Exception {
public function __construct($message) {
$this->message = htmlentities($message);
}
} }
/** /**