From a93fc7a1bc72d0c9352efe1ca62fa99975e8250e Mon Sep 17 00:00:00 2001
From: messju <messju@localhost>
Date: Mon, 12 Apr 2004 12:20:43 +0000
Subject: [PATCH] smarty_core_is_secure() only checks the file for readability
 now, not the directory where is in.

---
 NEWS                         |  2 ++
 libs/core/core.is_secure.php | 22 +++++++++-------------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/NEWS b/NEWS
index 0301112e..6640a6ca 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,5 @@
+  - fix is_secure() should only check if a file is_readable, not if
+    the directory where it is in is readable (sagi, messju)
   - fix problem displaying debug console when $default_resource_type
     is not "file:" (c960657, Monte)
   - fix permission handling with security and config_load (messju)
diff --git a/libs/core/core.is_secure.php b/libs/core/core.is_secure.php
index 089306a3..342f3aff 100644
--- a/libs/core/core.is_secure.php
+++ b/libs/core/core.is_secure.php
@@ -25,24 +25,20 @@ function smarty_core_is_secure($params, &$smarty)
         $_rp = realpath($params['resource_name']);
         if (isset($params['resource_base_path'])) {
             foreach ((array)$params['resource_base_path'] as $curr_dir) {
-                if ( !empty($curr_dir) && is_readable ($curr_dir)) {
-                    $_cd = realpath($curr_dir);
-                    if (strncmp($_rp, $_cd, strlen($_cd)) == 0
-                        && $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
-                        return true;
-                    }
+                if ( ($_cd = realpath($curr_dir)) !== false &&
+                     strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
+                     $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
+                    return true;
                 }
             }
         }
         if (!empty($smarty->secure_dir)) {
             foreach ((array)$smarty->secure_dir as $curr_dir) {
-                if ( !empty($curr_dir) && is_readable ($curr_dir)) {
-                    $_cd = realpath($curr_dir);
-                    if (strncmp($_rp, $_cd, strlen($_cd)) == 0
-                        && $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
-                        return true;
-                    }
-                }
+                if ( ($_cd = realpath($curr_dir)) !== false &&
+                     strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
+                     $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
+                    return true;
+                }            
             }
         }
     } else {