smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-04 18:34:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

- bugfix string resource could inject code at {block} or inline subtemplates through PHP comments https://github.com/smarty-php/smarty/issues/157

Browse Source
This commit is contained in:
uwetews
2016-01-26 22:22:20 +01:00
parent 867a2f3165
commit 71f71e6262
4 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
change_log.txt
View File

@@ -3,6 +3,7 @@
- revert bugfix compiling {section} did create warning
- bugfix {$smarty.section.customer.loop} did throw compiler error https://github.com/smarty-php/smarty/issues/161
update of yesterdays fix
- bugfix string resource could inject code at {block} or inline subtemplates through PHP comments https://github.com/smarty-php/smarty/issues/157
26.01.2016
- improvement observe Smarty::$_CHARSET in debugging console https://github.com/smarty-php/smarty/issues/169

2
libs/Smarty.class.php
View File

@@ -121,7 +121,7 @@ class Smarty extends Smarty_Internal_TemplateBase
/**
* smarty version
*/
const SMARTY_VERSION = '3.1.30-dev/21';
const SMARTY_VERSION = '3.1.30-dev/22';
/**
* define variable scopes

8
libs/sysplugins/smarty_internal_compile_block.php
View File

@@ -181,9 +181,15 @@ class Smarty_Internal_Compile_Blockclose extends Smarty_Internal_Compile_Shared_
$_functionCode = $compiler->parser->current_buffer;
// setup buffer for template function code
$compiler->parser->current_buffer = new Smarty_Internal_ParseTree_Template();
if ($compiler->template->source->type == 'file') {
$sourceInfo = $compiler->template->source->filepath;
} else {
$basename = $compiler->template->source->handler->getBasename($compiler->template->source);
$sourceInfo = $compiler->template->source->type .':' . ($basename ? $basename : $compiler->template->source->name);
}
$output = "<?php\n";
$output .= "/* {block '{$_name}'} {$compiler->template->source->type}:{$compiler->template->source->name} */\n";
$output .= "/* {block '{$_name}'} {$sourceInfo} */\n";
$output .= "class {$_className} extends Smarty_Internal_Block\n";
$output .= "{\n";
foreach ($_block as $property => $value) {

10
libs/sysplugins/smarty_internal_compile_include.php
View File

@@ -333,16 +333,22 @@ class Smarty_Internal_Compile_Include extends Smarty_Internal_CompileBase
$tpl->mustCompile = true;
$compiler->parent_compiler->mergedSubTemplatesData[$hashResourceName][$t_hash]['nocache_hash'] =
$tpl->compiled->nocache_hash;
if ($compiler->template->source->type == 'file') {
$sourceInfo = $compiler->template->source->filepath;
} else {
$basename = $compiler->template->source->handler->getBasename($compiler->template->source);
$sourceInfo = $compiler->template->source->type .':' . ($basename ? $basename : $compiler->template->source->name);
}
// get compiled code
$compiled_code = "<?php\n\n";
$compiled_code .= "/* Start inline template \"{$tpl->source->type}:{$tpl->source->name}\" =============================*/\n";
$compiled_code .= "/* Start inline template \"{$sourceInfo}\" =============================*/\n";
$compiled_code .= "function {$tpl->compiled->unifunc} (\$_smarty_tpl) {\n";
$compiled_code .= "?>\n" . $tpl->compiler->compileTemplateSource($tpl, null, $compiler->parent_compiler);
$compiled_code .= "<?php\n";
$compiled_code .= "}\n?>\n";
$compiled_code .= $tpl->compiler->postFilter($tpl->compiler->blockOrFunctionCode);
$compiled_code .= "<?php\n\n";
$compiled_code .= "/* End inline template \"{$tpl->source->type}:{$tpl->source->name}\" =============================*/\n";
$compiled_code .= "/* End inline template \"{$sourceInfo}\" =============================*/\n";
$compiled_code .= "?>";
unset($tpl->compiler);
if ($tpl->compiled->has_nocache_code) {