smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-11-02 21:31:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

smarty_core_is_secure() only checks the file for readability now, not

Browse Source 
the directory where is in.
This commit is contained in:
messju
2004-04-12 12:20:43 +00:00
parent f75615d03c
commit a93fc7a1bc
2 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
libs/core/core.is_secure.php
View File

@@ -25,24 +25,20 @@ function smarty_core_is_secure($params, &$smarty)
$_rp = realpath($params['resource_name']);
if (isset($params['resource_base_path'])) {
foreach ((array)$params['resource_base_path'] as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) {
$_cd = realpath($curr_dir);
if (strncmp($_rp, $_cd, strlen($_cd)) == 0
&& $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
if ( ($_cd = realpath($curr_dir)) !== false &&
strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
$_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
}
}
if (!empty($smarty->secure_dir)) {
foreach ((array)$smarty->secure_dir as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) {
$_cd = realpath($curr_dir);
if (strncmp($_rp, $_cd, strlen($_cd)) == 0
&& $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
}
if ( ($_cd = realpath($curr_dir)) !== false &&
strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
$_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true;
}
}
}
} else {