- renamed function names of autoloaded Smarty methods to Smarty_Method_....

- new security_class property (default is Smarty_Security)
2026-04-28 18:02:07 +02:00 · 2009-11-03 20:38:38 +00:00
parent 05c64b7748
commit 94b80e892b
90 changed files with 162 additions and 171 deletions
@@ -0,0 +1,84 @@
+<?php
+/**
+* Smarty plugin
+* 
+* @package Smarty
+* @subpackage Security
+* @author Uwe Tews 
+*/ 
+
+/**
+* This class does contain the security settings
+*/
+class Smarty_Security {
+    /**
+    * This determines how Smarty handles "<?php ... ?>" tags in templates.
+    * possible values:
+    * <ul>
+    *   <li>SMARTY_PHP_PASSTHRU -> echo PHP tags as they are</li>
+    *   <li>SMARTY_PHP_QUOTE    -> escape tags as entities</li>
+    *   <li>SMARTY_PHP_REMOVE   -> remove php tags</li>
+    *   <li>SMARTY_PHP_ALLOW    -> execute php tags</li>
+    * </ul>
+    * 
+    * @var integer 
+    */
+    public $php_handling = SMARTY_PHP_PASSTHRU;
+
+    /**
+    * This is the list of template directories that are considered secure.
+    * One directory per array element. 
+    * $template_dir is in this list implicitly.
+    * 
+    * @var array 
+    */
+    public $secure_dir = array();
+
+
+    /**
+    * This is an array of directories where trusted php scripts reside.
+    * {@link $security} is disabled during their inclusion/execution.
+    * 
+    * @var array 
+    */
+    public $trusted_dir = array();
+
+
+    /**
+    * This is an array of trusted PHP functions.
+    *
+    * If empty all functions are allowed.
+    * If set to 'none' none is allowed.
+    * @var array 
+    */
+    public $php_functions = array('isset', 'empty',
+            'count', 'sizeof','in_array', 'is_array','time','nl2br');
+
+    /**
+    * This is an array of trusted modifers.
+    *
+    * If empty all modifiers are allowed.
+    * If set to 'none' none is allowed.
+    * @var array 
+    */
+    public $modifiers = array('escape','count');
+
+    /**
+    * This is an array of trusted streams.
+    *
+    * If empty all streams are allowed.
+    * If set to 'none' none is allowed.
+    * @var array 
+    */
+    public $streams = array('file');
+    /**
+    + flag if constants can be accessed from template
+    */
+    public $allow_constants = true;
+    /**
+    + flag if {php} tag can be executed
+    */
+    public $allow_php_tag = false;
+} 
+
+?>