smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-04 18:34:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

smarty_core_is_secure() only checks the file for readability now, not

Browse Source 
the directory where is in.
This commit is contained in:
messju
2004-04-12 12:20:43 +00:00
parent f75615d03c
commit a93fc7a1bc
2 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -1,3 +1,5 @@
- fix is_secure() should only check if a file is_readable, not if
the directory where it is in is readable (sagi, messju)
- fix problem displaying debug console when $default_resource_type - fix problem displaying debug console when $default_resource_type
is not "file:" (c960657, Monte) is not "file:" (c960657, Monte)
- fix permission handling with security and config_load (messju) - fix permission handling with security and config_load (messju)

16
libs/core/core.is_secure.php
View File

@@ -25,26 +25,22 @@ function smarty_core_is_secure($params, &$smarty)
$_rp = realpath($params['resource_name']); $_rp = realpath($params['resource_name']);
if (isset($params['resource_base_path'])) { if (isset($params['resource_base_path'])) {
foreach ((array)$params['resource_base_path'] as $curr_dir) { foreach ((array)$params['resource_base_path'] as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) { if ( ($_cd = realpath($curr_dir)) !== false &&
$_cd = realpath($curr_dir); strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
if (strncmp($_rp, $_cd, strlen($_cd)) == 0 $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
&& $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true; return true;
} }
} }
} }
}
if (!empty($smarty->secure_dir)) { if (!empty($smarty->secure_dir)) {
foreach ((array)$smarty->secure_dir as $curr_dir) { foreach ((array)$smarty->secure_dir as $curr_dir) {
if ( !empty($curr_dir) && is_readable ($curr_dir)) { if ( ($_cd = realpath($curr_dir)) !== false &&
$_cd = realpath($curr_dir); strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
if (strncmp($_rp, $_cd, strlen($_cd)) == 0 $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
&& $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
return true; return true;
} }
} }
} }
}
} else { } else {
// resource is not on local file system // resource is not on local file system
return call_user_func_array( return call_user_func_array(