smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-04 18:34:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

smarty_core_is_secure() only checks the file for readability now, not

Browse Source 
the directory where is in.
This commit is contained in:
messju
2004-04-12 12:20:43 +00:00
parent f75615d03c
commit a93fc7a1bc
2 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -1,3 +1,5 @@
- fix is_secure() should only check if a file is_readable, not if
the directory where it is in is readable (sagi, messju)
- fix problem displaying debug console when $default_resource_type
is not "file:" (c960657, Monte)
- fix permission handling with security and config_load (messju)

22
libs/core/core.is_secure.php
View File

@@ -25,24 +25,20 @@ function smarty_core_is_secure($params, &$smarty)
$_rp = realpath($params['resource_name']);
if (isset($params['resource_base_path'])) {
foreach ((array)$params['resource_base_path'] as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) {
$_cd = realpath($curr_dir);
if (strncmp($_rp, $_cd, strlen($_cd)) == 0
&& $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
if ( ($_cd = realpath($curr_dir)) !== false &&
strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
$_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
}
}
if (!empty($smarty->secure_dir)) {
foreach ((array)$smarty->secure_dir as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) {
$_cd = realpath($curr_dir);
if (strncmp($_rp, $_cd, strlen($_cd)) == 0
&& $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
}
if ( ($_cd = realpath($curr_dir)) !== false &&
strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
$_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
}
}
} else {