diff --git a/change_log.txt b/change_log.txt index d8ec7157..5e04cb45 100644 --- a/change_log.txt +++ b/change_log.txt @@ -1,4 +1,7 @@  ===== 3.1.30-dev ===== (xx.xx.xx) + 25.02.2016 + - bugfix wrong _realpath with 4 or more parent-directories https://github.com/smarty-php/smarty/issues/190 + 20.02.2016 - bugfix {strip} must keep space between hmtl tags. Broken by changes of 10.2.2016 https://github.com/smarty-php/smarty/issues/184 - new feature/bugfix {foreach}{section} add 'properties' attribute to force compilation of loop properties diff --git a/libs/Smarty.class.php b/libs/Smarty.class.php index 72e441c6..04d6a451 100644 --- a/libs/Smarty.class.php +++ b/libs/Smarty.class.php @@ -121,7 +121,7 @@ class Smarty extends Smarty_Internal_TemplateBase /** * smarty version */ - const SMARTY_VERSION = '3.1.30-dev/47'; + const SMARTY_VERSION = '3.1.30-dev/48'; /** * define variable scopes @@ -1108,7 +1108,8 @@ class Smarty extends Smarty_Internal_TemplateBase */ public function _getTemplateId($template_name, $cache_id = null, $compile_id = null, $caching = null) { - $template_name = (strpos($template_name, ':') === false) ? "{$this->default_resource_type}:{$template_name}" : $template_name; + $template_name = (strpos($template_name, ':') === false) ? "{$this->default_resource_type}:{$template_name}" : + $template_name; $cache_id = $cache_id === null ? $this->cache_id : $cache_id; $compile_id = $compile_id === null ? $this->compile_id : $compile_id; $caching = (int) ($caching === null ? $this->caching : $caching); @@ -1158,11 +1159,18 @@ class Smarty extends Smarty_Internal_TemplateBase } } $count = 1; - while ($count && ((strpos($path, '.' . DS) != false) || (strpos($path, DS . DS) != false))) { - $path = - preg_replace('#([\\\\/][^\\\\/]+[\\\\/]([.]?[\\\\/])*[.][.][\\\\/]([.]?[\\\\/])*)+|([\\\\/]([.]?[\\\\/])+)#', - DS, $path, - 1, $count); + if (strpos($path, '..' . DS) != false) { + preg_match('#(([.]?[\\\\/])*([.][.])[\\\\/]([.]?[\\\\/])*)+#', $path, $match); + if (!$count = substr_count($match[ 0 ], '..')) { + $count = 1; + } } + while ($count && ((strpos($path, '.' . DS) != false) || (strpos($path, DS . DS) != false))) { + $path = preg_replace('#([\\\\/]([.]?[\\\\/])*[^\\\\/.]+){' . $count . + '}[\\\\/]([.]?[\\\\/])*([.][.][\\\\/]([.]?[\\\\/])*){' . $count . + '}|([\\\\/]([.]?[\\\\/])+)#', DS, $path, - 1, $count); + } + return $parts[ 'root' ] . $path; }