mirror of
https://github.com/smarty-php/smarty.git
synced 2025-08-05 10:54:27 +02:00
- improvement replaced most in_array() calls by more efficient isset() on array_flip()ed haystacks
- added notes on possible performance optimization/problem with Smarty_Security
This commit is contained in:
@@ -1,4 +1,7 @@
|
||||
===== trunk =====
|
||||
01.10.2011
|
||||
- improvement replaced most in_array() calls by more efficient isset() on array_flip()ed haystacks
|
||||
|
||||
29.09.2011
|
||||
- improvement of Smarty_Internal_Config::loadConfigVars() dropped the in_array for index look up
|
||||
|
||||
|
@@ -52,7 +52,7 @@ function smarty_function_cycle($params, $template)
|
||||
$advance = (isset($params['advance'])) ? (bool)$params['advance'] : true;
|
||||
$reset = (isset($params['reset'])) ? (bool)$params['reset'] : false;
|
||||
|
||||
if (!in_array('values', array_keys($params))) {
|
||||
if (!isset($params['values'])) {
|
||||
if(!isset($cycle_vars[$name]['values'])) {
|
||||
trigger_error("cycle: missing 'values' parameter");
|
||||
return;
|
||||
|
@@ -66,7 +66,7 @@ function smarty_function_html_options($params, $template)
|
||||
|
||||
case 'selected':
|
||||
if (is_array($_val)) {
|
||||
$selected = array_map('strval', array_values((array)$_val));
|
||||
$selected = array_flip(array_map('strval', array_values((array)$_val)));
|
||||
} else {
|
||||
$selected = $_val;
|
||||
}
|
||||
@@ -114,7 +114,7 @@ function smarty_function_html_options_optoutput($key, $value, $selected, $id, $c
|
||||
if (!is_array($value)) {
|
||||
$_html_result = '<option value="' . smarty_function_escape_special_chars($key) . '"';
|
||||
if (is_array($selected)) {
|
||||
if (in_array((string)$key, $selected)) {
|
||||
if (isset($selected[(string) $key])) {
|
||||
$_html_result .= ' selected="selected"';
|
||||
}
|
||||
} elseif ($key == $selected) {
|
||||
|
@@ -50,6 +50,7 @@
|
||||
*/
|
||||
function smarty_function_mailto($params, $template)
|
||||
{
|
||||
static $_allowed_encoding = array('javascript' => true, 'javascript_charcode' => true, 'hex' => true, 'none' => true);
|
||||
$extra = '';
|
||||
|
||||
if (empty($params['address'])) {
|
||||
@@ -95,7 +96,7 @@ function smarty_function_mailto($params, $template)
|
||||
$address .= $mail_parm_vals;
|
||||
|
||||
$encode = (empty($params['encode'])) ? 'none' : $params['encode'];
|
||||
if (!in_array($encode, array('javascript', 'javascript_charcode', 'hex', 'none'))) {
|
||||
if (!isset($_allowed_encoding[$encode])) {
|
||||
trigger_error("mailto: 'encode' parameter must be none, javascript, javascript_charcode or hex", E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
|
@@ -23,6 +23,11 @@
|
||||
*/
|
||||
function smarty_function_math($params, $template)
|
||||
{
|
||||
static $_allowed_funcs = array(
|
||||
'int' => true, 'abs' => true, 'ceil' => true, 'cos' => true, 'exp' => true, 'floor' => true,
|
||||
'log' => true, 'log10' => true, 'max' => true, 'min' => true, 'pi' => true, 'pow' => true,
|
||||
'rand' => true, 'round' => true, 'sin' => true, 'sqrt' => true, 'srand' => true ,'tan' => true
|
||||
);
|
||||
// be sure equation parameter is present
|
||||
if (empty($params['equation'])) {
|
||||
trigger_error("math: missing equation parameter",E_USER_WARNING);
|
||||
@@ -39,11 +44,9 @@ function smarty_function_math($params, $template)
|
||||
|
||||
// match all vars in equation, make sure all are passed
|
||||
preg_match_all("!(?:0x[a-fA-F0-9]+)|([a-zA-Z][a-zA-Z0-9_]*)!",$equation, $match);
|
||||
$allowed_funcs = array('int','abs','ceil','cos','exp','floor','log','log10',
|
||||
'max','min','pi','pow','rand','round','sin','sqrt','srand','tan');
|
||||
|
||||
foreach($match[1] as $curr_var) {
|
||||
if ($curr_var && !in_array($curr_var, array_keys($params)) && !in_array($curr_var, $allowed_funcs)) {
|
||||
if ($curr_var && !isset($params[$curr_var]) && !isset($_allowed_funcs[$current_var])) {
|
||||
trigger_error("math: function call $curr_var not allowed",E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
@@ -52,7 +55,7 @@ function smarty_function_math($params, $template)
|
||||
foreach($params as $key => $val) {
|
||||
if ($key != "equation" && $key != "format" && $key != "assign") {
|
||||
// make sure value is not empty
|
||||
if (strlen($val)==0) {
|
||||
if (isset($val[0])) {
|
||||
trigger_error("math: parameter $key is empty",E_USER_WARNING);
|
||||
return;
|
||||
}
|
||||
|
@@ -41,6 +41,7 @@ class Smarty_Internal_Compile_Break extends Smarty_Internal_CompileBase {
|
||||
*/
|
||||
public function compile($args, $compiler, $parameter)
|
||||
{
|
||||
static $_is_loopy = array('for' => true, 'foreach' => true, 'while' => true, 'section' => true);
|
||||
// check and get attributes
|
||||
$_attr = $this->getAttributes($compiler, $args);
|
||||
|
||||
@@ -59,7 +60,7 @@ class Smarty_Internal_Compile_Break extends Smarty_Internal_CompileBase {
|
||||
$level_count = $_levels;
|
||||
$stack_count = count($compiler->_tag_stack) - 1;
|
||||
while ($level_count > 0 && $stack_count >= 0) {
|
||||
if (in_array($compiler->_tag_stack[$stack_count][0], array('for', 'foreach', 'while', 'section'))) {
|
||||
if (isset($_is_loopy[$compiler->_tag_stack[$stack_count][0]])) {
|
||||
$level_count--;
|
||||
}
|
||||
$stack_count--;
|
||||
|
@@ -48,6 +48,7 @@ class Smarty_Internal_Compile_Config_Load extends Smarty_Internal_CompileBase {
|
||||
*/
|
||||
public function compile($args, $compiler)
|
||||
{
|
||||
static $_is_legal_scope = array('local' => true,'parent' => true,'root' => true,'global' => true);
|
||||
// check and get attributes
|
||||
$_attr = $this->getAttributes($compiler, $args);
|
||||
|
||||
@@ -67,7 +68,7 @@ class Smarty_Internal_Compile_Config_Load extends Smarty_Internal_CompileBase {
|
||||
// scope setup
|
||||
if (isset($_attr['scope'])) {
|
||||
$_attr['scope'] = trim($_attr['scope'], "'\"");
|
||||
if (in_array($_attr['scope'],array('local','parent','root','global'))) {
|
||||
if (isset($_is_legal_scope[$_attr['scope']])) {
|
||||
$scope = $_attr['scope'];
|
||||
} else {
|
||||
$compiler->trigger_template_error('illegal value for "scope" attribute', $compiler->lex->taglineno);
|
||||
|
@@ -42,6 +42,7 @@ class Smarty_Internal_Compile_Continue extends Smarty_Internal_CompileBase {
|
||||
*/
|
||||
public function compile($args, $compiler, $parameter)
|
||||
{
|
||||
static $_is_loopy = array('for' => true, 'foreach' => true, 'while' => true, 'section' => true);
|
||||
// check and get attributes
|
||||
$_attr = $this->getAttributes($compiler, $args);
|
||||
|
||||
@@ -60,7 +61,7 @@ class Smarty_Internal_Compile_Continue extends Smarty_Internal_CompileBase {
|
||||
$level_count = $_levels;
|
||||
$stack_count = count($compiler->_tag_stack) - 1;
|
||||
while ($level_count > 0 && $stack_count >= 0) {
|
||||
if (in_array($compiler->_tag_stack[$stack_count][0], array('for', 'foreach', 'while', 'section'))) {
|
||||
if (isset($_is_loopy[$compiler->_tag_stack[$stack_count][0]])) {
|
||||
$level_count--;
|
||||
}
|
||||
$stack_count--;
|
||||
|
@@ -42,6 +42,7 @@ class Smarty_Internal_Compile_Extends extends Smarty_Internal_CompileBase {
|
||||
*/
|
||||
public function compile($args, $compiler)
|
||||
{
|
||||
static $_is_stringy = array('string' => true, 'eval' => true);
|
||||
$this->_rdl = preg_quote($compiler->smarty->right_delimiter);
|
||||
$this->_ldl = preg_quote($compiler->smarty->left_delimiter);
|
||||
$filepath = $compiler->template->source->filepath;
|
||||
@@ -60,7 +61,7 @@ class Smarty_Internal_Compile_Extends extends Smarty_Internal_CompileBase {
|
||||
// create template object
|
||||
$_template = new $compiler->smarty->template_class($include_file, $compiler->smarty, $compiler->template);
|
||||
// save file dependency
|
||||
if (in_array($_template->source->type, array('eval', 'string'))) {
|
||||
if (isset($_is_stringy[$_template->source->type])) {
|
||||
$template_sha1 = sha1($include_file);
|
||||
} else {
|
||||
$template_sha1 = sha1($_template->source->filepath);
|
||||
|
@@ -180,6 +180,7 @@ class Smarty_Internal_Debug extends Smarty_Internal_Data {
|
||||
*/
|
||||
private static function get_key($template)
|
||||
{
|
||||
static $_is_stringy = array('string' => true, 'eval' => true);
|
||||
// calculate Uid if not already done
|
||||
if ($template->source->uid == '') {
|
||||
$template->source->filepath;
|
||||
@@ -188,7 +189,7 @@ class Smarty_Internal_Debug extends Smarty_Internal_Data {
|
||||
if (isset(self::$template_data[$key])) {
|
||||
return $key;
|
||||
} else {
|
||||
if (in_array($template->source->type, array('string','eval'))) {
|
||||
if (isset($_is_stringy[$template->source->type])) {
|
||||
self::$template_data[$key]['name'] = '\''.substr($template->source->name,0,25).'...\'';
|
||||
} else {
|
||||
self::$template_data[$key]['name'] = $template->source->filepath;
|
||||
|
@@ -676,24 +676,44 @@ abstract class Smarty_Internal_TemplateBase extends Smarty_Internal_Data {
|
||||
*/
|
||||
public function __call($name, $args)
|
||||
{
|
||||
// methode of Smarty object?
|
||||
static $_prefixes = array('set' => true, 'get' => true);
|
||||
static $_resolved_property_name = array();
|
||||
static $_resolved_property_source = array();
|
||||
|
||||
// method of Smarty object?
|
||||
if (method_exists($this->smarty, $name)) {
|
||||
return call_user_func_array(array($this->smarty, $name), $args);
|
||||
}
|
||||
// see if this is a set/get for a property
|
||||
$first3 = strtolower(substr($name, 0, 3));
|
||||
if (in_array($first3, array('set', 'get')) && substr($name, 3, 1) !== '_') {
|
||||
// try to keep case correct for future PHP 6.0 case-sensitive class methods
|
||||
// lcfirst() not available < PHP 5.3.0, so improvise
|
||||
$property_name = strtolower(substr($name, 3, 1)) . substr($name, 4);
|
||||
// convert camel case to underscored name
|
||||
$property_name = preg_replace_callback('/([A-Z])/', array($this,'replaceCamelcase'), $property_name);
|
||||
if (property_exists($this, $property_name)) {
|
||||
if (isset($_prefixes[$first3]) && isset($name[3]) && $name[3] !== '_') {
|
||||
if (isset($_resolved_property_name[$name])) {
|
||||
$property_name = $_resolved_property_name[$name];
|
||||
} else {
|
||||
// try to keep case correct for future PHP 6.0 case-sensitive class methods
|
||||
// lcfirst() not available < PHP 5.3.0, so improvise
|
||||
$property_name = strtolower(substr($name, 3, 1)) . substr($name, 4);
|
||||
// convert camel case to underscored name
|
||||
$property_name = preg_replace_callback('/([A-Z])/', array($this,'replaceCamelcase'), $property_name);
|
||||
$_resolved_property_name[$name] = $property_name;
|
||||
}
|
||||
if (isset($_resolved_property_source[$property_name])) {
|
||||
$_is_this = $_resolved_property_source[$property_name];
|
||||
} else {
|
||||
$_is_this = null;
|
||||
if (property_exists($this, $property_name)) {
|
||||
$_is_this = true;
|
||||
} else if (property_exists($this->smarty, $property_name)) {
|
||||
$_is_this = false;
|
||||
}
|
||||
$_resolved_property_source[$property_name] = $_is_this;
|
||||
}
|
||||
if ($_is_this) {
|
||||
if ($first3 == 'get')
|
||||
return $this->$property_name;
|
||||
else
|
||||
return $this->$property_name = $args[0];
|
||||
} else if (property_exists($this->smarty, $property_name)) {
|
||||
} else if ($_is_this === false) {
|
||||
if ($first3 == 'get')
|
||||
return $this->smarty->$property_name;
|
||||
else
|
||||
|
@@ -440,6 +440,7 @@ abstract class Smarty_Resource {
|
||||
*/
|
||||
public static function config(Smarty_Internal_Config $_config)
|
||||
{
|
||||
static $_incompatible_resources = array('eval' => true, 'string' => true, 'extends' => true, 'php' => true);
|
||||
$config_resource = $_config->config_resource;
|
||||
$smarty = $_config->smarty;
|
||||
|
||||
@@ -457,8 +458,8 @@ abstract class Smarty_Resource {
|
||||
$resource_name = $config_resource;
|
||||
}
|
||||
}
|
||||
|
||||
if (in_array($resource_type, array('eval', 'string', 'extends', 'php'))) {
|
||||
|
||||
if (isset($_incompatible_resources[$resource_type])) {
|
||||
throw new SmartyException ("Unable to use resource '{$resource_type}' for config");
|
||||
}
|
||||
|
||||
|
@@ -6,6 +6,15 @@
|
||||
* @subpackage Security
|
||||
* @author Uwe Tews
|
||||
*/
|
||||
|
||||
/*
|
||||
* FIXME: Smarty_Security API
|
||||
* - getter and setter instead of public properties would allow cultivating an internal cache properly
|
||||
* - current implementation of isTrustedResourceDir() assumes that Smarty::$template_dir and Smarty::$config_dir are immutable
|
||||
* the cache is killed every time either of the variables change. That means that two distinct Smarty objects with differing
|
||||
* $template_dir or $config_dir should NOT share the same Smarty_Security instance,
|
||||
* as this would lead to (severe) performance penalty! how should this be handled?
|
||||
*/
|
||||
|
||||
/**
|
||||
* This class does contain the security settings
|
||||
@@ -119,6 +128,38 @@ class Smarty_Security {
|
||||
*/
|
||||
public $allow_super_globals = true;
|
||||
|
||||
/**
|
||||
* Cache for $resource_dir lookups
|
||||
* @var array
|
||||
*/
|
||||
protected $_resource_dir = null;
|
||||
/**
|
||||
* Cache for $template_dir lookups
|
||||
* @var array
|
||||
*/
|
||||
protected $_template_dir = null;
|
||||
/**
|
||||
* Cache for $config_dir lookups
|
||||
* @var array
|
||||
*/
|
||||
protected $_config_dir = null;
|
||||
/**
|
||||
* Cache for $secure_dir lookups
|
||||
* @var array
|
||||
*/
|
||||
protected $_secure_dir = null;
|
||||
/**
|
||||
* Cache for $php_resource_dir lookups
|
||||
* @var array
|
||||
*/
|
||||
protected $_php_resource_dir = null;
|
||||
/**
|
||||
* Cache for $trusted_dir lookups
|
||||
* @var array
|
||||
*/
|
||||
protected $_trusted_dir = null;
|
||||
|
||||
|
||||
/**
|
||||
* @param Smarty $smarty
|
||||
*/
|
||||
@@ -126,32 +167,7 @@ class Smarty_Security {
|
||||
{
|
||||
$this->smarty = $smarty;
|
||||
}
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $_resource_dir = null;
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $_template_dir = null;
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $_config_dir = null;
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $_secure_dir = null;
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $_php_resource_dir = null;
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $_trusted_dir = null;
|
||||
|
||||
|
||||
/**
|
||||
* Check if PHP function is trusted.
|
||||
*
|
||||
|
Reference in New Issue
Block a user