smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-04 18:34:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

- optimize security isTrustedResourceDir()

Browse Source
This commit is contained in:
Uwe Tews
2015-06-28 02:37:41 +02:00
parent 5377fd5926
commit aee07f7bba
4 changed files with 37 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
change_log.txt
View File

@@ -1,6 +1,7 @@
 ===== 3.1.28-dev===== (xx.xx.2015)  ===== 3.1.28-dev===== (xx.xx.2015)
28.06.2015 28.06.2015
- move $smarty->enableSecurity() into Smarty_Security class - move $smarty->enableSecurity() into Smarty_Security class
- optimize security isTrustedResourceDir()
27.06.2015 27.06.2015
- bugfix resolve naming conflict between custom Smarty delimiter '<%' and PHP ASP tags https://github.com/smarty-php/smarty/issues/64 - bugfix resolve naming conflict between custom Smarty delimiter '<%' and PHP ASP tags https://github.com/smarty-php/smarty/issues/64

2
libs/Smarty.class.php
View File

@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
/** /**
* smarty version * smarty version
*/ */
const SMARTY_VERSION = '3.1.28-dev/12'; const SMARTY_VERSION = '3.1.28-dev/13';
/** /**
* define variable scopes * define variable scopes

2
libs/sysplugins/smarty_internal_resource_file.php
View File

@@ -164,7 +164,7 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
if ($source->filepath !== false) { if ($source->filepath !== false) {
if (is_object($source->smarty->security_policy)) { if (is_object($source->smarty->security_policy)) {
$source->smarty->security_policy->isTrustedResourceDir($source->filepath); $source->smarty->security_policy->isTrustedResourceDir($source->filepath, $source->isConfig);
} }
$source->exists = true; $source->exists = true;
$source->uid = sha1($source->filepath); $source->uid = sha1($source->filepath);

72
libs/sysplugins/smarty_security.php
View File

@@ -201,28 +201,28 @@ class Smarty_Security
* *
* @var array * @var array
*/ */
protected $_resource_dir = null; protected $_resource_dir = array();
/** /**
* Cache for $template_dir lookup * Cache for $template_dir lookup
* *
* @var array * @var array
*/ */
protected $_template_dir = null; protected $_template_dir = array();
/** /**
* Cache for $config_dir lookup * Cache for $config_dir lookup
* *
* @var array * @var array
*/ */
protected $_config_dir = null; protected $_config_dir = array();
/** /**
* Cache for $secure_dir lookup * Cache for $secure_dir lookup
* *
* @var array * @var array
*/ */
protected $_secure_dir = null; protected $_secure_dir = array();
/** /**
* Cache for $php_resource_dir lookup * Cache for $php_resource_dir lookup
@@ -475,51 +475,47 @@ class Smarty_Security
/** /**
* Check if directory of file resource is trusted. * Check if directory of file resource is trusted.
* *
* @param string $filepath * @param string $filepath
* @param null|bool $isConfig
* *
* @return boolean true if directory is trusted * @return bool true if directory is trusted
* @throws SmartyException if directory is not trusted * @throws \SmartyException if directory is not trusted
*/ */
public function isTrustedResourceDir($filepath) public function isTrustedResourceDir($filepath, $isConfig = null)
{ {
$_template = false; if ($isConfig !== true) {
$_config = false; $_dir = $this->smarty->getTemplateDir();
$_secure = false; if ($this->_template_dir !== $_dir) {
foreach ($this->_template_dir as $directory) {
$_template_dir = $this->smarty->getTemplateDir(); unset($this->_resource_dir[$directory]);
$_config_dir = $this->smarty->getConfigDir(); }
foreach ($_dir as $directory) {
// check if index is outdated $this->_resource_dir[$directory] = true;
if ((!$this->_template_dir || $this->_template_dir !== $_template_dir) || (!$this->_config_dir || $this->_config_dir !== $_config_dir) || (!empty($this->secure_dir) && (!$this->_secure_dir || $this->_secure_dir !== $this->secure_dir))) { }
$this->_resource_dir = array(); $this->_template_dir = $_dir;
$_template = true;
$_config = true;
$_secure = !empty($this->secure_dir);
}
// rebuild template dir index
if ($_template) {
$this->_template_dir = $_template_dir;
foreach ($_template_dir as $directory) {
$this->_resource_dir[$directory] = true;
} }
} }
if ($isConfig !== false) {
// rebuild config dir index $_dir = $this->smarty->getConfigDir();
if ($_config) { if ($this->_config_dir !== $_dir) {
$this->_config_dir = $_config_dir; foreach ($this->_config_dir as $directory) {
foreach ($_config_dir as $directory) { unset($this->_resource_dir[$directory]);
$this->_resource_dir[$directory] = true; }
foreach ($_dir as $directory) {
$this->_resource_dir[$directory] = true;
}
$this->_config_dir = $_dir;
} }
} }
if ($this->_secure_dir !== (array) $this->secure_dir) {
// rebuild secure dir index foreach ($this->_secure_dir as $directory) {
if ($_secure) { unset($this->_resource_dir[$directory]);
$this->_secure_dir = $this->secure_dir; }
foreach ((array) $this->secure_dir as $directory) { foreach ((array) $this->secure_dir as $directory) {
$directory = $this->smarty->_realpath($directory . DS); $directory = $this->smarty->_realpath($directory . DS);
$this->_resource_dir[$directory] = true; $this->_resource_dir[$directory] = true;
} }
$this->_secure_dir = (array) $this->secure_dir;
} }
$_filepath = $filepath; $_filepath = $filepath;