smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-04 10:24:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

update file fetching logic

Browse Source
This commit is contained in:
mohrt
2001-12-11 23:06:38 +00:00
parent c81d1eb839
commit 8ba71c6f86
4 changed files with 138 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
Smarty.class.php
View File

@@ -131,7 +131,7 @@ class Smarty
'PHP_TAGS' => false, 'PHP_TAGS' => false,
'MODIFIER_FUNCS' => array('count') 'MODIFIER_FUNCS' => array('count')
); );
var $trusted_dir = ''; // directory where trusted templates var $trusted_dir = array(); // directories where trusted templates
// reside ($security is disabled during their // reside ($security is disabled during their
// execution). // execution).
@@ -729,9 +729,14 @@ function _is_trusted($resource_type, $resource_name)
// disable security during the execution of the template. // disable security during the execution of the template.
if ($resource_type == 'file') { if ($resource_type == 'file') {
if (is_readable ($this->trusted_dir)) { if (!empty($this->trusted_dir)) {
if (substr(realpath($resource_name), 0, strlen(realpath($this->trusted_dir))) == realpath($this->trusted_dir)) { foreach ((array)$this->trusted_dir as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) {
if (substr(realpath($resource_name),0, strlen(realpath($curr_dir))) == realpath($curr_dir)) {
$_smarty_trusted = true; $_smarty_trusted = true;
break;
}
}
} }
} }
} else { } else {
@@ -858,7 +863,7 @@ function _is_trusted($resource_type, $resource_name)
Function: _parse_file_path Function: _parse_file_path
Purpose: parse out the type and name from the template resource Purpose: parse out the type and name from the template resource
\*======================================================================*/ \*======================================================================*/
function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resource_name) { function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resource_name) {
// split tpl_path by the first colon // split tpl_path by the first colon
$file_path_parts = explode(':', $file_path, 2); $file_path_parts = explode(':', $file_path, 2);
@@ -875,10 +880,21 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
if ($resource_type == 'file') { if ($resource_type == 'file') {
if (!preg_match("/^([\/\\\\]|[a-zA-Z]:[\/\\\\])/", $resource_name)) { if (!preg_match("/^([\/\\\\]|[a-zA-Z]:[\/\\\\])/", $resource_name)) {
// relative pathname to $file_base_path // relative pathname to $file_base_path
$resource_name = $file_base_path.'/'.$resource_name; // use the first directory where the file is found
foreach((array)$file_base_path as $curr_path) {
if(@is_file($curr_path.'/'.$resource_name)) {
$resource_name = $curr_path.'/'.$resource_name;
return true;
} }
} }
} // didn't find the file
return false;
}
}
// resource type != file
return true;
}
/*======================================================================*\ /*======================================================================*\
@@ -889,44 +905,16 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
function _fetch_template_info($tpl_path, &$template_source, &$template_timestamp, $get_source=true) function _fetch_template_info($tpl_path, &$template_source, &$template_timestamp, $get_source=true)
{ {
$this->_parse_file_path($this->template_dir, $tpl_path, $resource_type, $resource_name); $_return = false;
if($this->_parse_file_path($this->template_dir, $tpl_path, $resource_type, $resource_name)) {
if ($this->security && !$this->_is_secure($resource_type, $resource_name) && !$this->_is_trusted($resource_type, $resource_name)) {
$this->_trigger_error_msg("(secure mode) accessing \"$tpl_path\" is not allowed");
return false;
}
switch ($resource_type) { switch ($resource_type) {
case 'file': case 'file':
if (@is_file($resource_name)) {
$_is_file = false;
if (!@is_file($resource_name)) {
if(!empty($this->default_template_handler_func)) {
if(!function_exists($this->default_template_handler_func)) {
$this->_trigger_error_msg("default template handler function \"$this->default_template_handler_func\" doesn't exist.");
return false;
}
// call default template handler function
$funcname = $this->default_template_handler_func;
if($funcname($resource_type, $resource_name)) {
// test for file once more
if(@is_file($resource_name)) {
$_is_file = true;
}
}
}
} else {
$_is_file = true;
}
if ($_is_file) {
if ($get_source) { if ($get_source) {
$template_source = $this->_read_file($resource_name); $template_source = $this->_read_file($resource_name);
} }
$template_timestamp = filemtime($resource_name); $template_timestamp = filemtime($resource_name);
} else { $_return = true;
$this->_trigger_error_msg("unable to read template resource: \"$tpl_path\"");
return false;
} }
break; break;
default: default:
@@ -934,19 +922,33 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
$funcname = $this->resource_funcs[$resource_type]; $funcname = $this->resource_funcs[$resource_type];
if (function_exists($funcname)) { if (function_exists($funcname)) {
// call the function to fetch the template // call the function to fetch the template
$funcname($resource_name, $template_source, $template_timestamp, $get_source); $_return = $funcname($resource_name, $template_source, $template_timestamp, $get_source, $this);
return true;
} else {
$this->_trigger_error_msg("resource function: \"$funcname\" does not exist for resource type: \"$resource_type\".");
return false;
} }
} else {
$this->_trigger_error_msg("unknown resource type: \"$resource_type\". Register this resource first.");
return false;
} }
break; break;
} }
return true; }
if(!$_return) {
// see if we can get a template with the default template handler
if(!empty($this->default_template_handler_func)) {
if(!function_exists($this->default_template_handler_func)) {
$this->_trigger_error_msg("default template handler function \"$this->default_template_handler_func\" doesn't exist.");
$_return = false;
}
$funcname = $this->default_template_handler_func;
$_return = $funcname($resource_type, $resource_name, $template_source, $template_timestamp, $this);
}
}
if(!$_return) {
$this->_trigger_error_msg("unable to read template resource: \"$tpl_path\"");
} elseif ($_return && $this->security && !$this->_is_secure($resource_type, $resource_name) && !$this->_is_trusted($resource_type, $resource_name)) {
$this->_trigger_error_msg("(secure mode) accessing \"$tpl_path\" is not allowed");
$template_source = null;
$template_timestamp = null;
return false;
}
return $_return;
} }
@@ -1042,7 +1044,6 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
} }
} }
/*======================================================================*\ /*======================================================================*\
Function: _config_load Function: _config_load
Purpose: load configuration values Purpose: load configuration values

1
Smarty_Compiler.class.php
View File

@@ -475,6 +475,7 @@ class Smarty_Compiler extends Smarty {
} }
$this->_parse_file_path($this->trusted_dir, $this->_dequote($attrs['file']), $resource_type, $resource_name); $this->_parse_file_path($this->trusted_dir, $this->_dequote($attrs['file']), $resource_type, $resource_name);
if ($this->security) { if ($this->security) {
if( $resource_type != 'file' || !@is_file($resource_name)) { if( $resource_type != 'file' || !@is_file($resource_name)) {
$this->_syntax_error("include_php: $resource_type: $resource_name is not readable"); $this->_syntax_error("include_php: $resource_type: $resource_name is not readable");

97
libs/Smarty.class.php
View File

@@ -131,7 +131,7 @@ class Smarty
'PHP_TAGS' => false, 'PHP_TAGS' => false,
'MODIFIER_FUNCS' => array('count') 'MODIFIER_FUNCS' => array('count')
); );
var $trusted_dir = ''; // directory where trusted templates var $trusted_dir = array(); // directories where trusted templates
// reside ($security is disabled during their // reside ($security is disabled during their
// execution). // execution).
@@ -729,9 +729,14 @@ function _is_trusted($resource_type, $resource_name)
// disable security during the execution of the template. // disable security during the execution of the template.
if ($resource_type == 'file') { if ($resource_type == 'file') {
if (is_readable ($this->trusted_dir)) { if (!empty($this->trusted_dir)) {
if (substr(realpath($resource_name), 0, strlen(realpath($this->trusted_dir))) == realpath($this->trusted_dir)) { foreach ((array)$this->trusted_dir as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) {
if (substr(realpath($resource_name),0, strlen(realpath($curr_dir))) == realpath($curr_dir)) {
$_smarty_trusted = true; $_smarty_trusted = true;
break;
}
}
} }
} }
} else { } else {
@@ -858,7 +863,7 @@ function _is_trusted($resource_type, $resource_name)
Function: _parse_file_path Function: _parse_file_path
Purpose: parse out the type and name from the template resource Purpose: parse out the type and name from the template resource
\*======================================================================*/ \*======================================================================*/
function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resource_name) { function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resource_name) {
// split tpl_path by the first colon // split tpl_path by the first colon
$file_path_parts = explode(':', $file_path, 2); $file_path_parts = explode(':', $file_path, 2);
@@ -875,10 +880,21 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
if ($resource_type == 'file') { if ($resource_type == 'file') {
if (!preg_match("/^([\/\\\\]|[a-zA-Z]:[\/\\\\])/", $resource_name)) { if (!preg_match("/^([\/\\\\]|[a-zA-Z]:[\/\\\\])/", $resource_name)) {
// relative pathname to $file_base_path // relative pathname to $file_base_path
$resource_name = $file_base_path.'/'.$resource_name; // use the first directory where the file is found
foreach((array)$file_base_path as $curr_path) {
if(@is_file($curr_path.'/'.$resource_name)) {
$resource_name = $curr_path.'/'.$resource_name;
return true;
} }
} }
} // didn't find the file
return false;
}
}
// resource type != file
return true;
}
/*======================================================================*\ /*======================================================================*\
@@ -889,44 +905,16 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
function _fetch_template_info($tpl_path, &$template_source, &$template_timestamp, $get_source=true) function _fetch_template_info($tpl_path, &$template_source, &$template_timestamp, $get_source=true)
{ {
$this->_parse_file_path($this->template_dir, $tpl_path, $resource_type, $resource_name); $_return = false;
if($this->_parse_file_path($this->template_dir, $tpl_path, $resource_type, $resource_name)) {
if ($this->security && !$this->_is_secure($resource_type, $resource_name) && !$this->_is_trusted($resource_type, $resource_name)) {
$this->_trigger_error_msg("(secure mode) accessing \"$tpl_path\" is not allowed");
return false;
}
switch ($resource_type) { switch ($resource_type) {
case 'file': case 'file':
if (@is_file($resource_name)) {
$_is_file = false;
if (!@is_file($resource_name)) {
if(!empty($this->default_template_handler_func)) {
if(!function_exists($this->default_template_handler_func)) {
$this->_trigger_error_msg("default template handler function \"$this->default_template_handler_func\" doesn't exist.");
return false;
}
// call default template handler function
$funcname = $this->default_template_handler_func;
if($funcname($resource_type, $resource_name)) {
// test for file once more
if(@is_file($resource_name)) {
$_is_file = true;
}
}
}
} else {
$_is_file = true;
}
if ($_is_file) {
if ($get_source) { if ($get_source) {
$template_source = $this->_read_file($resource_name); $template_source = $this->_read_file($resource_name);
} }
$template_timestamp = filemtime($resource_name); $template_timestamp = filemtime($resource_name);
} else { $_return = true;
$this->_trigger_error_msg("unable to read template resource: \"$tpl_path\"");
return false;
} }
break; break;
default: default:
@@ -934,19 +922,33 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
$funcname = $this->resource_funcs[$resource_type]; $funcname = $this->resource_funcs[$resource_type];
if (function_exists($funcname)) { if (function_exists($funcname)) {
// call the function to fetch the template // call the function to fetch the template
$funcname($resource_name, $template_source, $template_timestamp, $get_source); $_return = $funcname($resource_name, $template_source, $template_timestamp, $get_source, $this);
return true;
} else {
$this->_trigger_error_msg("resource function: \"$funcname\" does not exist for resource type: \"$resource_type\".");
return false;
} }
} else {
$this->_trigger_error_msg("unknown resource type: \"$resource_type\". Register this resource first.");
return false;
} }
break; break;
} }
return true; }
if(!$_return) {
// see if we can get a template with the default template handler
if(!empty($this->default_template_handler_func)) {
if(!function_exists($this->default_template_handler_func)) {
$this->_trigger_error_msg("default template handler function \"$this->default_template_handler_func\" doesn't exist.");
$_return = false;
}
$funcname = $this->default_template_handler_func;
$_return = $funcname($resource_type, $resource_name, $template_source, $template_timestamp, $this);
}
}
if(!$_return) {
$this->_trigger_error_msg("unable to read template resource: \"$tpl_path\"");
} elseif ($_return && $this->security && !$this->_is_secure($resource_type, $resource_name) && !$this->_is_trusted($resource_type, $resource_name)) {
$this->_trigger_error_msg("(secure mode) accessing \"$tpl_path\" is not allowed");
$template_source = null;
$template_timestamp = null;
return false;
}
return $_return;
} }
@@ -1042,7 +1044,6 @@ function _parse_file_path($file_base_path, $file_path, &$resource_type, &$resour
} }
} }
/*======================================================================*\ /*======================================================================*\
Function: _config_load Function: _config_load
Purpose: load configuration values Purpose: load configuration values

1
libs/Smarty_Compiler.class.php
View File

@@ -475,6 +475,7 @@ class Smarty_Compiler extends Smarty {
} }
$this->_parse_file_path($this->trusted_dir, $this->_dequote($attrs['file']), $resource_type, $resource_name); $this->_parse_file_path($this->trusted_dir, $this->_dequote($attrs['file']), $resource_type, $resource_name);
if ($this->security) { if ($this->security) {
if( $resource_type != 'file' || !@is_file($resource_name)) { if( $resource_type != 'file' || !@is_file($resource_name)) {
$this->_syntax_error("include_php: $resource_type: $resource_name is not readable"); $this->_syntax_error("include_php: $resource_type: $resource_name is not readable");