[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [BP][FIX] fix: Add temp/cache to Smarty secure directory for webservice templates

Elifeleti Mukisa Dan pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
42b4a3dc by Elifeleti Mukisa Dan at 2026-05-22T21:40:10+00:00
[BP][FIX] fix: Add temp/cache to Smarty secure directory for webservice templates
---
* [BP][FIX] fix: Add temp/cache to Smarty secure directory for webservice templates
---
* [BP][FIX] fix: Add temp/cache to Smarty secure directory for webservice templates
---
* [FIX] fix: Add temp/cache to Smarty secure directory for webservice templates
---
* [FIX] fix: Add temp/cache to Smarty secure directory for webservice templates

(cherry picked from commit 95db18e6d22ab98d485fe82a46887c34c3656631)

4d970035 [FIX] fix: Add temp/cache to Smarty secure_dir for webservice templates
baf42b09 Move webservice templates to more secure directory

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10285

(cherry picked from commit c3b7ec9a257d600e156d633c622d2d261b893819)

6f5cd343 [FIX] fix: Add temp/cache to Smarty secure directory for webservice templates

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10299

(cherry picked from commit 638d4fdb55986a6e00b751203f9df32016cc08d2)

cfc9364a [FIX] fix: Add temp/cache to Smarty secure directory for webservice templates

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10308

See merge request tikiwiki/tiki!10333

- - - - -


5 changed files:

- + lib/TikiWebServiceTemplate.php
- + lib/core/Tiki/Smarty/SecurityPolicy.php
- path_constants.php
- + templates/webservice_templates/.gitignore
- + templates/webservice_templates/index.php


Changes:

=====================================
lib/TikiWebServiceTemplate.php
=====================================
@@ -0,0 +1,86 @@
+<?php
+
+// (c) Copyright by authors of the Tiki Wiki CMS Groupware Project
+//
+// All Rights Reserved. See copyright.txt for details and a complete list of authors.
+// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
+
+/**
+ * TikiWebServiceTemplate
+ */
+
+namespace Tiki\Lib;
+
+use Feedback;
+use Tiki\Lib\OIntegrate\Response;
+
+class TikiWebServiceTemplate
+{
+    public $webservice;
+    public $name;
+    public $engine;
+    public $output;
+    public $content;
+    public $lastModif;
+
+    public function save()
+    {
+        global $tikilib;
+
+        $tikilib->query(
+            "DELETE FROM tiki_webservice_template WHERE service = ? AND template = ?",
+            [ $this->webservice->getName(), $this->name ]
+        );
+
+        $tikilib->query(
+            "INSERT INTO tiki_webservice_template (service, template, engine, output, content, last_modif) VALUES(?,?,?,?,?,?)",
+            [
+                $this->webservice->getName(),
+                $this->name,
+                $this->engine,
+                $this->output,
+                $this->content,
+                time(),
+            ]
+        );
+
+        if ($this->engine === 'index') {
+            if ($this->output === 'mindex') {
+                Feedback::warning(tra('You will need to rebuild the search index to see these changes'));
+            }
+
+            require_once 'lib/search/refresh-functions.php';
+            refresh_index('webservice', $this->name);
+        }
+    }
+
+    /**
+     * @return string
+     */
+    public function getTemplateFile()
+    {
+        $token = sprintf("%s_%s", $this->webservice->getName(), $this->name);
+        $file = WEBSERVICE_TEMPLATES_PATH . '/' . md5($token) . '.tpl';
+
+        // Ensure directory exists
+        if (! is_dir(WEBSERVICE_TEMPLATES_PATH)) {
+            mkdir(WEBSERVICE_TEMPLATES_PATH, 0755, true);
+        }
+
+        if (! file_exists($file) || $this->lastModif > filemtime($file)) {
+            file_put_contents($file, $this->content);
+        }
+
+        return realpath($file);
+    }
+
+    /**
+     * @param Tiki\Lib\OIntegrate\Response $response
+     * @param $outputContext
+     * @return mixed|string
+     */
+    public function render(Response $response, $outputContext)
+    {
+        return $response->render($this->engine, $this->output, $outputContext, $this->getTemplateFile());
+    }
+}


=====================================
lib/core/Tiki/Smarty/SecurityPolicy.php
=====================================
@@ -0,0 +1,142 @@
+<?php
+
+// (c) Copyright by authors of the Tiki Wiki CMS Groupware Project
+//
+// All Rights Reserved. See copyright.txt for details and a complete list of authors.
+// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
+namespace Tiki\Smarty;
+
+use TikiLib;
+
+/**
+ * extends \Smarty\Security
+ * @package TikiWiki\lib\core\Tiki\Smarty
+ */
+class SecurityPolicy extends \Smarty\Security
+{
+    /**
+     * is an array of regular expressions matching URIs that are considered trusted.
+     * See https://smarty-php.github.io/smarty/5.x/api/security/ for more details
+     *
+     * @var array
+     */
+    public $trusted_uri = [];
+
+    /**
+     * This is the list of template directories that are considered secure.
+     * $template_dir is in this list implicitly. A directory configured using $smarty->setTemplateDir() is
+     * considered secure implicitly. The default is an empty array.
+     *
+     * @var array
+     */
+    public $secure_dir = [];
+
+    /**
+     * This is an array of allowed tags. It's the array of (registered / autoloaded) function-, block and filter plugins
+     * that should be accessible to the template. If empty, no restriction by allowed_tags.
+     *
+     * @var array
+     */
+    public $allowed_tags = [];
+
+    /**
+     * This is an array of disabled tags. It's the array of (registered / autoloaded) function-, block and filter plugins
+     * that may not be accessible to the template. If empty, no restriction by disabled_tags.
+     *
+     * @var array
+     */
+    public $disabled_tags = [];
+
+    /**
+     * This is an array of allowed modifier plugins. It's the array of (registered / autoloaded) modifiers that should be accessible to the template.
+     * If this array is non-empty, only the herein listed modifiers may be used. This is a whitelist.
+     * If empty, no restriction by allowed_modifiers.
+     *
+     * @var array
+     */
+    public $allowed_modifiers = [];
+
+    /**
+     * This is an array of disabled modifier plugins. It's the array of (registered / autoloaded) modifiers that may not be accessible to the template.
+     * If empty, no restriction by disabled_modifiers.
+     *
+     * @var array
+     */
+    public $disabled_modifiers = [];
+
+    /**
+     * needs a proper description
+     * @param \Smarty\Smarty $smarty
+     */
+    public function __construct($smarty)
+    {
+        if (class_exists("TikiLib")) {
+            $tikilib = TikiLib::lib('tiki');
+            // modlib defines zone_is_empty which must exist before smarty initializes to fix bug with smarty autoloader after version 3.1.21
+            TikiLib::lib('mod');
+        }
+
+        parent::__construct($smarty);
+
+
+        //With phpunit and command line these don't exist yet for some reason
+        if (isset($tikilib) && method_exists($tikilib, "get_preference")) {
+            global $url_host;
+            $this->trusted_uri[] = '#' . preg_quote("http://$url_host", '$#') . '#';
+            $this->trusted_uri[] = '#' . preg_quote("https://$url_host", '$#') . '#';
+
+            $allowed_tags = array_filter($tikilib->get_preference('smarty_security_allowed_tags', [], true));
+            $disabled_tags = array_filter($tikilib->get_preference('smarty_security_disabled_tags', [], true));
+            $allowed_modifiers = array_filter($tikilib->get_preference('smarty_security_allowed_modifiers', [], true));
+            $disabled_modifiers = array_filter($tikilib->get_preference('smarty_security_disabled_modifiers', [], true));
+            $dirs = array_filter($tikilib->get_preference('smarty_security_dirs', [], true));
+
+            $cdns = preg_split('/\s+/', $tikilib->get_preference('tiki_cdn', ''));
+            $cdns_ssl = preg_split('/\s+/', $tikilib->get_preference('tiki_cdn_ssl', ''));
+            $cdn_uri = array_filter(array_merge($cdns, $cdns_ssl));
+            foreach ($cdn_uri as $uri) {
+                $this->trusted_uri[] = '#' . preg_quote($uri) . '$#';
+            }
+        } else {
+            $allowed_tags = [];
+            $disabled_tags = [];
+            $allowed_modifiers = [];
+            $disabled_modifiers = [];
+            $dirs = [];
+        }
+
+        // Add defaults
+        $this->allowed_tags = $allowed_tags;
+        $this->disabled_tags = $disabled_tags;
+        $this->allowed_modifiers = $allowed_modifiers;
+        $this->disabled_modifiers = $disabled_modifiers;
+        // Add WEBSERVICE_TEMPLATES_PATH to secure_dir for dynamically generated webservice templates
+        $webserviceTemplatesPath = defined('WEBSERVICE_TEMPLATES_PATH') ? WEBSERVICE_TEMPLATES_PATH : null;
+        $this->secure_dir = array_merge(
+            $this->secure_dir,
+            $dirs,
+            $webserviceTemplatesPath ? [$webserviceTemplatesPath] : []
+        );
+    }
+
+    public function isTrustedModifier($modifier_name, $compiler)
+    {
+        if ($tikilib = TikiLib::lib('tiki')) {
+            $allowed_builtin_php_functions = array_filter($tikilib->get_preference('smarty_security_allowed_builtin_php_functions', [], true));
+            if (in_array($modifier_name, $allowed_builtin_php_functions)) {
+                return true;
+            }
+        }
+
+        return parent::isTrustedModifier($modifier_name, $compiler);
+    }
+
+    /**
+     * Work around a bug in smarty where _updateResourceDir doesn't clear the values correctly when
+     * smarty templateDir has been updated
+     */
+    public function clearResourceDir()
+    {
+        $this->_resource_dir = [];
+    }
+}


=====================================
path_constants.php
=====================================
@@ -104,6 +104,7 @@ const WIKIPLUGIN_CACHE_FILES_GLOB = 'temp/cache/wikiplugin_*';
 const SATIS_TEMP_PATH = 'temp/satis';
 const UNIFIED_INDEX_TEMP_PATH = 'temp/unified-index';
 const TEMPLATES_ADMIN_PATH = 'templates/admin';
+const WEBSERVICE_TEMPLATES_PATH = 'templates/webservice_templates';
 const TEMPLATES_MODULES_PATH = 'templates/modules';
 
 /** This it for the old tiki_tests system which may not be functional - benoitg - 2023-11-16 */


=====================================
templates/webservice_templates/.gitignore
=====================================
@@ -0,0 +1,5 @@
+# Ignore dynamically generated webservice template files
+*.tpl
+# Keep the directory structure
+!.gitignore
+!index.php


=====================================
templates/webservice_templates/index.php
=====================================
@@ -0,0 +1,8 @@
+<?php
+
+// (c) Copyright by authors of the Tiki Wiki CMS Groupware Project
+//
+// All Rights Reserved. See copyright.txt for details and a complete list of authors.
+// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
+header("location: ../../index.php");
+die;



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/42b4a3dcd72f0ca6047f0004d75d48138fd6a62f

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/42b4a3dcd72f0ca6047f0004d75d48138fd6a62f
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs