smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-05 10:54:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

- bugfix security mode of "<script language=php>" must be controlled by $php_handling property (Thue Kristensen)

Browse Source
This commit is contained in:
Uwe.Tews@googlemail.com
2014-10-07 22:07:15 +00:00
parent 795c3af692
commit 6af4441f0e
3 changed files with 2004 additions and 1971 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
change_log.txt
View File

@@ -1,4 +1,7 @@
===== 3.1.20-dev ===== (xx.xx.2014) ===== 3.1.20-dev ===== (xx.xx.2014)
08.10.2014
- bugfix security mode of "<script language=php>" must be controlled by $php_handling property (Thue Kristensen)
01.10.2014 01.10.2014
- bugfix template resource of inheritance blocks could get invalid if the default resource type is not 'file'(Issue 202) - bugfix template resource of inheritance blocks could get invalid if the default resource type is not 'file'(Issue 202)
- bugfix existing child {block} tag must override parent {block} tag append / prepend setting (topic 25259) - bugfix existing child {block} tag must override parent {block} tag append / prepend setting (topic 25259)

199
libs/sysplugins/smarty_internal_templatelexer.php
View File

@@ -20,61 +20,63 @@ class Smarty_Internal_Templatelexer
public $node; public $node;
public $line; public $line;
public $taglineno; public $taglineno;
public $is_phpScript = false;
public $state = 1; public $state = 1;
public $smarty;
private $heredoc_id_stack = Array(); private $heredoc_id_stack = Array();
public $yyTraceFILE; public $yyTraceFILE;
public $yyTracePrompt; public $yyTracePrompt;
public $state_name = array(1 => 'TEXT', 2 => 'SMARTY', 3 => 'LITERAL', 4 => 'DOUBLEQUOTEDSTRING', 5 => 'CHILDBODY'); public $state_name = array(1 => 'TEXT', 2 => 'SMARTY', 3 => 'LITERAL', 4 => 'DOUBLEQUOTEDSTRING', 5 => 'CHILDBODY');
public $smarty_token_names = array( // Text for parser error messages public $smarty_token_names = array( // Text for parser error messages
'IDENTITY' => '===', 'IDENTITY' => '===',
'NONEIDENTITY' => '!==', 'NONEIDENTITY' => '!==',
'EQUALS' => '==', 'EQUALS' => '==',
'NOTEQUALS' => '!=', 'NOTEQUALS' => '!=',
'GREATEREQUAL' => '(>=,ge)', 'GREATEREQUAL' => '(>=,ge)',
'LESSEQUAL' => '(<=,le)', 'LESSEQUAL' => '(<=,le)',
'GREATERTHAN' => '(>,gt)', 'GREATERTHAN' => '(>,gt)',
'LESSTHAN' => '(<,lt)', 'LESSTHAN' => '(<,lt)',
'MOD' => '(%,mod)', 'MOD' => '(%,mod)',
'NOT' => '(!,not)', 'NOT' => '(!,not)',
'LAND' => '(&&,and)', 'LAND' => '(&&,and)',
'LOR' => '(||,or)', 'LOR' => '(||,or)',
'LXOR' => 'xor', 'LXOR' => 'xor',
'OPENP' => '(', 'OPENP' => '(',
'CLOSEP' => ')', 'CLOSEP' => ')',
'OPENB' => '[', 'OPENB' => '[',
'CLOSEB' => ']', 'CLOSEB' => ']',
'PTR' => '->', 'PTR' => '->',
'APTR' => '=>', 'APTR' => '=>',
'EQUAL' => '=', 'EQUAL' => '=',
'NUMBER' => 'number', 'NUMBER' => 'number',
'UNIMATH' => '+" , "-', 'UNIMATH' => '+" , "-',
'MATH' => '*" , "/" , "%', 'MATH' => '*" , "/" , "%',
'INCDEC' => '++" , "--', 'INCDEC' => '++" , "--',
'SPACE' => ' ', 'SPACE' => ' ',
'DOLLAR' => '$', 'DOLLAR' => '$',
'SEMICOLON' => ';', 'SEMICOLON' => ';',
'COLON' => ':', 'COLON' => ':',
'DOUBLECOLON' => '::', 'DOUBLECOLON' => '::',
'AT' => '@', 'AT' => '@',
'HATCH' => '#', 'HATCH' => '#',
'QUOTE' => '"', 'QUOTE' => '"',
'BACKTICK' => '`', 'BACKTICK' => '`',
'VERT' => '|', 'VERT' => '|',
'DOT' => '.', 'DOT' => '.',
'COMMA' => '","', 'COMMA' => '","',
'ANDSYM' => '"&"', 'ANDSYM' => '"&"',
'QMARK' => '"?"', 'QMARK' => '"?"',
'ID' => 'identifier', 'ID' => 'identifier',
'TEXT' => 'text', 'TEXT' => 'text',
'FAKEPHPSTARTTAG' => 'Fake PHP start tag', 'FAKEPHPSTARTTAG' => 'Fake PHP start tag',
'PHPSTARTTAG' => 'PHP start tag', 'PHPSTARTTAG' => 'PHP start tag',
'PHPENDTAG' => 'PHP end tag', 'PHPENDTAG' => 'PHP end tag',
'LITERALSTART' => 'Literal start', 'LITERALSTART' => 'Literal start',
'LITERALEND' => 'Literal end', 'LITERALEND' => 'Literal end',
'LDELSLASH' => 'closing tag', 'LDELSLASH' => 'closing tag',
'COMMENT' => 'comment', 'COMMENT' => 'comment',
'AS' => 'as', 'AS' => 'as',
'TO' => 'to', 'TO' => 'to',
); );
function __construct($data, $compiler) function __construct($data, $compiler)
@@ -155,17 +157,19 @@ class Smarty_Internal_Templatelexer
11 => 0, 11 => 0,
12 => 0, 12 => 0,
13 => 0, 13 => 0,
14 => 0, 14 => 2,
15 => 0,
16 => 0,
17 => 0, 17 => 0,
18 => 0, 18 => 0,
19 => 0, 19 => 0,
20 => 0,
21 => 0,
22 => 0,
23 => 0,
); );
if ($this->counter >= strlen($this->data)) { if ($this->counter >= strlen($this->data)) {
return false; // end of input return false; // end of input
} }
$yy_global_pattern = "/\G(\\{\\})|\G(" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*setfilter\\s+)|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G(<\\?(?:php\\w+|=|[a-zA-Z]+)?)|\G(\\?>)|\G(\\s*" . $this->rdel . ")|\G(<%)|\G(%>)|\G([\S\s])/iS"; $yy_global_pattern = "/\G(\\{\\})|\G(" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*setfilter\\s+)|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(<\/script>)|\G(\\s*" . $this->rdel . ")|\G(<%)|\G(%>)|\G([\S\s])/iS";
do { do {
if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) { if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -333,7 +337,10 @@ class Smarty_Internal_Templatelexer
function yy_r1_14($yy_subpatterns) function yy_r1_14($yy_subpatterns)
{ {
if (in_array($this->value, Array('<?', '<?=', '<?php'))) { if (in_array($this->value, Array('<?', '<?=', '<?php')) || $script = strpos($this->value, '<s') === 0) {
if ($script) {
$this->is_phpScript = true;
}
$this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG; $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
} elseif ($this->value == '<?xml') { } elseif ($this->value == '<?xml') {
$this->token = Smarty_Internal_Templateparser::TP_XMLTAG; $this->token = Smarty_Internal_Templateparser::TP_XMLTAG;
@@ -343,35 +350,48 @@ class Smarty_Internal_Templatelexer
} }
} }
function yy_r1_15($yy_subpatterns) function yy_r1_17($yy_subpatterns)
{ {
$this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG; $this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG;
} }
function yy_r1_16($yy_subpatterns)
{
$this->token = Smarty_Internal_Templateparser::TP_TEXT;
}
function yy_r1_17($yy_subpatterns)
{
$this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG;
}
function yy_r1_18($yy_subpatterns) function yy_r1_18($yy_subpatterns)
{ {
$this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG; $this->token = Smarty_Internal_Templateparser::TP_PHPENDSCRIPT;
} }
function yy_r1_19($yy_subpatterns) function yy_r1_19($yy_subpatterns)
{ {
$this->token = Smarty_Internal_Templateparser::TP_PHPENDSCRIPT;
}
function yy_r1_20($yy_subpatterns)
{
$this->token = Smarty_Internal_Templateparser::TP_TEXT;
}
function yy_r1_21($yy_subpatterns)
{
$this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG;
}
function yy_r1_22($yy_subpatterns)
{
$this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG;
}
function yy_r1_23($yy_subpatterns)
{
$phpEndScript = $this->is_phpScript ? '|<\\/script>' : '';
$to = strlen($this->data); $to = strlen($this->data);
preg_match("/{$this->ldel}|<\?|\?>|<%|%>/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter); preg_match("/{$this->ldel}|<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
if (isset($match[0][1])) { if (isset($match[0][1])) {
$to = $match[0][1]; $to = $match[0][1];
} }
@@ -942,18 +962,19 @@ class Smarty_Internal_Templatelexer
public function yylex3() public function yylex3()
{ {
$tokenMap = array( $tokenMap = array(
1 => 0, 1 => 0,
2 => 0, 2 => 0,
3 => 0, 3 => 2,
4 => 0, 6 => 0,
5 => 0, 7 => 0,
6 => 0, 8 => 0,
7 => 0, 9 => 0,
10 => 0,
); );
if ($this->counter >= strlen($this->data)) { if ($this->counter >= strlen($this->data)) {
return false; // end of input return false; // end of input
} }
$yy_global_pattern = "/\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G(<\\?(?:php\\w+|=|[a-zA-Z]+)?)|\G(\\?>)|\G(<%)|\G(%>)|\G([\S\s])/iS"; $yy_global_pattern = "/\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(<%)|\G(%>)|\G([\S\s])/iS";
do { do {
if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) { if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -1028,7 +1049,10 @@ class Smarty_Internal_Templatelexer
function yy_r3_3($yy_subpatterns) function yy_r3_3($yy_subpatterns)
{ {
if (in_array($this->value, Array('<?', '<?=', '<?php'))) { if (in_array($this->value, Array('<?', '<?=', '<?php')) || $script = strpos($this->value, '<s') === 0) {
if ($script) {
$this->is_phpScript = true;
}
$this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG; $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
} else { } else {
$this->token = Smarty_Internal_Templateparser::TP_FAKEPHPSTARTTAG; $this->token = Smarty_Internal_Templateparser::TP_FAKEPHPSTARTTAG;
@@ -1036,29 +1060,36 @@ class Smarty_Internal_Templatelexer
} }
} }
function yy_r3_4($yy_subpatterns) function yy_r3_6($yy_subpatterns)
{ {
$this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG; $this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG;
} }
function yy_r3_5($yy_subpatterns) function yy_r3_7($yy_subpatterns)
{
$this->token = Smarty_Internal_Templateparser::TP_PHPENDSCRIPT;
}
function yy_r3_8($yy_subpatterns)
{ {
$this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG; $this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG;
} }
function yy_r3_6($yy_subpatterns) function yy_r3_9($yy_subpatterns)
{ {
$this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG; $this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG;
} }
function yy_r3_7($yy_subpatterns) function yy_r3_10($yy_subpatterns)
{ {
$phpEndScript = $this->is_phpScript ? '|<\\/script>' : '';
$to = strlen($this->data); $to = strlen($this->data);
preg_match("/{$this->ldel}\/?literal{$this->rdel}|<\?|<%|\?>|%>/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter); preg_match("/{$this->ldel}\/?literal{$this->rdel}|<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
if (isset($match[0][1])) { if (isset($match[0][1])) {
$to = $match[0][1]; $to = $match[0][1];
} else { } else {

3773
libs/sysplugins/smarty_internal_templateparser.php
View File

File diff suppressed because it is too large Load Diff