[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] fix: Add temp/cache to Smarty secure directory for webservice templates

Elifeleti Mukisa Dan pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
c3b7ec9a by Elifeleti Mukisa Dan at 2026-05-22T18:16:54+00:00
[FIX] fix: Add temp/cache to Smarty secure directory for webservice templates
---
* [FIX] fix: Add temp/cache to Smarty secure directory for webservice templates


(cherry picked from commit 95db18e6d22ab98d485fe82a46887c34c3656631)

4d970035 [FIX] fix: Add temp/cache to Smarty secure_dir for webservice templates
baf42b09 Move webservice templates to more secure directory

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10285

- - - - -


5 changed files:

- lib/TikiWebServiceTemplate.php
- lib/core/Tiki/Smarty/SecurityPolicy.php
- path_constants.php
- + templates/webservice_templates/.gitignore
- + templates/webservice_templates/index.php


Changes:

=====================================
lib/TikiWebServiceTemplate.php
=====================================
@@ -60,7 +60,12 @@ class TikiWebServiceTemplate
     public function getTemplateFile()
     {
         $token = sprintf("%s_%s", $this->webservice->getName(), $this->name);
-        $file = "temp/cache/" . md5($token) . '.tpl';
+        $file = WEBSERVICE_TEMPLATES_PATH . '/' . md5($token) . '.tpl';
+
+        // Ensure directory exists
+        if (! is_dir(WEBSERVICE_TEMPLATES_PATH)) {
+            mkdir(WEBSERVICE_TEMPLATES_PATH, 0755, true);
+        }
 
         if (! file_exists($file) || $this->lastModif > filemtime($file)) {
             file_put_contents($file, $this->content);


=====================================
lib/core/Tiki/Smarty/SecurityPolicy.php
=====================================
@@ -110,7 +110,13 @@ class SecurityPolicy extends \Smarty\Security
         $this->disabled_tags = $disabled_tags;
         $this->allowed_modifiers = $allowed_modifiers;
         $this->disabled_modifiers = $disabled_modifiers;
-        $this->secure_dir = array_merge($this->secure_dir, $dirs);
+        // Add WEBSERVICE_TEMPLATES_PATH to secure_dir for dynamically generated webservice templates
+        $webserviceTemplatesPath = defined('WEBSERVICE_TEMPLATES_PATH') ? WEBSERVICE_TEMPLATES_PATH : null;
+        $this->secure_dir = array_merge(
+            $this->secure_dir,
+            $dirs,
+            $webserviceTemplatesPath ? [$webserviceTemplatesPath] : []
+        );
     }
 
     public function isTrustedModifier($modifier_name, $compiler)


=====================================
path_constants.php
=====================================
@@ -108,6 +108,7 @@ const WIKIPLUGIN_CACHE_FILES_GLOB = 'temp/cache/wikiplugin_*';
 const SATIS_TEMP_PATH = 'temp/satis';
 const UNIFIED_INDEX_TEMP_PATH = 'temp/unified-index';
 const TEMPLATES_ADMIN_PATH = 'templates/admin';
+const WEBSERVICE_TEMPLATES_PATH = 'templates/webservice_templates';
 const TEMPLATES_MODULES_PATH = 'templates/modules';
 
 /** This it for the old tiki_tests system which may not be functional - benoitg - 2023-11-16 */


=====================================
templates/webservice_templates/.gitignore
=====================================
@@ -0,0 +1,5 @@
+# Ignore dynamically generated webservice template files
+*.tpl
+# Keep the directory structure
+!.gitignore
+!index.php


=====================================
templates/webservice_templates/index.php
=====================================
@@ -0,0 +1,8 @@
+<?php
+
+// (c) Copyright by authors of the Tiki Wiki CMS Groupware Project
+//
+// All Rights Reserved. See copyright.txt for details and a complete list of authors.
+// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
+header("location: ../../index.php");
+die;



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/c3b7ec9a257d600e156d633c622d2d261b893819

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/c3b7ec9a257d600e156d633c622d2d261b893819
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs