cvs: smarty / NEWS /libs/core core.is_secure.php

messju		Mon Apr 12 08:20:43 2004 EDT

  Modified files:              
    /smarty	NEWS 
    /smarty/libs/core	core.is_secure.php 
  Log:
  smarty_core_is_secure() only checks the file for readability now, not
  the directory where is in.
  
  
  
http://cvs.php.net/diff.php/smarty/NEWS?r1=1.443&r2=1.444&ty=u
Index: smarty/NEWS
diff -u smarty/NEWS:1.443 smarty/NEWS:1.444
--- smarty/NEWS:1.443	Tue Mar 30 09:36:56 2004
+++ smarty/NEWS	Mon Apr 12 08:20:42 2004
@@ -1,3 +1,5 @@
+  - fix is_secure() should only check if a file is_readable, not if
+    the directory where it is in is readable (sagi, messju)
   - fix problem displaying debug console when $default_resource_type
     is not "file:" (c960657, Monte)
   - fix permission handling with security and config_load (messju)
http://cvs.php.net/diff.php/smarty/libs/core/core.is_secure.php?r1=1.8&r2=1.9&ty=u
Index: smarty/libs/core/core.is_secure.php
diff -u smarty/libs/core/core.is_secure.php:1.8 smarty/libs/core/core.is_secure.php:1.9
--- smarty/libs/core/core.is_secure.php:1.8	Thu Mar 18 14:36:36 2004
+++ smarty/libs/core/core.is_secure.php	Mon Apr 12 08:20:43 2004
@@ -25,24 +25,20 @@
         $_rp = realpath($params['resource_name']);
         if (isset($params['resource_base_path'])) {
             foreach ((array)$params['resource_base_path'] as $curr_dir) {
-                if ( !empty($curr_dir) && is_readable ($curr_dir)) {
-                    $_cd = realpath($curr_dir);
-                    if (strncmp($_rp, $_cd, strlen($_cd)) == 0
-                        && $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
-                        return true;
-                    }
+                if ( ($_cd = realpath($curr_dir)) !== false &&
+                     strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
+                     $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
+                    return true;
                 }
             }
         }
         if (!empty($smarty->secure_dir)) {
             foreach ((array)$smarty->secure_dir as $curr_dir) {
-                if ( !empty($curr_dir) && is_readable ($curr_dir)) {
-                    $_cd = realpath($curr_dir);
-                    if (strncmp($_rp, $_cd, strlen($_cd)) == 0
-                        && $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
-                        return true;
-                    }
-                }
+                if ( ($_cd = realpath($curr_dir)) !== false &&
+                     strncmp($_rp, $_cd, strlen($_cd)) == 0 &&
+                     $_rp{strlen($_cd)} == DIRECTORY_SEPARATOR ) {
+                    return true;
+                }            
             }
         }
     } else {

-- 
Smarty CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php