cvs: smarty / NEWS /libs Smarty.class.php Smarty_Compiler.class.php /unit_test test_cases.php

messju		Fri Sep 10 15:15:02 2004 EDT

  Modified files:              
    /smarty	NEWS 
    /smarty/libs	Smarty.class.php Smarty_Compiler.class.php 
    /smarty/unit_test	test_cases.php 
  Log:
  added $smarty->security_settings['ALLOW_CONSTANTS']
  including test-cases for them
  
  
  
http://cvs.php.net/diff.php/smarty/NEWS?r1=1.472&r2=1.473&ty=u
Index: smarty/NEWS
diff -u smarty/NEWS:1.472 smarty/NEWS:1.473
--- smarty/NEWS:1.472	Tue Sep  7 10:24:52 2004
+++ smarty/NEWS	Fri Sep 10 15:15:01 2004
@@ -1,3 +1,7 @@
+  - add $smarty->security_settings['ALLOW_CONSTANTS']. note: this
+    defaults to false which means you have to allow them explicitely
+    in your secured templates from now on! (messju)
+
 Version 2.6.4 (Sept 7, 2004)
 ----------------------------
 
http://cvs.php.net/diff.php/smarty/libs/Smarty.class.php?r1=1.497&r2=1.498&ty=u
Index: smarty/libs/Smarty.class.php
diff -u smarty/libs/Smarty.class.php:1.497 smarty/libs/Smarty.class.php:1.498
--- smarty/libs/Smarty.class.php:1.497	Tue Sep  7 10:48:55 2004
+++ smarty/libs/Smarty.class.php	Fri Sep 10 15:15:01 2004
@@ -30,7 +30,7 @@
  * @version 2.6.5-dev
  */
 
-/* $Id: Smarty.class.php,v 1.497 2004/09/07 14:48:55 mohrt Exp $ */
+/* $Id: Smarty.class.php,v 1.498 2004/09/10 19:15:01 messju Exp $ */
 
 /**
  * DIR_SEP isn't used anymore, but third party apps might
@@ -231,7 +231,8 @@
                                                                'true','false'),
                                     'INCLUDE_ANY'     => false,
                                     'PHP_TAGS'        => false,
-                                    'MODIFIER_FUNCS'  => array('count')
+                                    'MODIFIER_FUNCS'  => array('count'),
+                                    'ALLOW_CONSTANTS'  => false
                                    );
 
     /**
http://cvs.php.net/diff.php/smarty/libs/Smarty_Compiler.class.php?r1=1.341&r2=1.342&ty=u
Index: smarty/libs/Smarty_Compiler.class.php
diff -u smarty/libs/Smarty_Compiler.class.php:1.341 smarty/libs/Smarty_Compiler.class.php:1.342
--- smarty/libs/Smarty_Compiler.class.php:1.341	Thu Sep  9 18:01:33 2004
+++ smarty/libs/Smarty_Compiler.class.php	Fri Sep 10 15:15:01 2004
@@ -26,7 +26,7 @@
  * @package Smarty
  */
 
-/* $Id: Smarty_Compiler.class.php,v 1.341 2004/09/09 22:01:33 mohrt Exp $ */
+/* $Id: Smarty_Compiler.class.php,v 1.342 2004/09/10 19:15:01 messju Exp $ */
 
 /**
  * Template compiling class
@@ -2030,6 +2030,11 @@
                 break;
 
             case 'const':
+                if ($this->security && !$this->security_settings['ALLOW_CONSTANTS']) {
+                    $this->_syntax_error("(secure mode) constants not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
                 array_shift($indexes);
                 $_val = $this->_parse_var_props(substr($indexes[0],1));
                 $compiled_ref = '@constant(' . $_val . ')';
http://cvs.php.net/diff.php/smarty/unit_test/test_cases.php?r1=1.8&r2=1.9&ty=u
Index: smarty/unit_test/test_cases.php
diff -u smarty/unit_test/test_cases.php:1.8 smarty/unit_test/test_cases.php:1.9
--- smarty/unit_test/test_cases.php:1.8	Thu Sep  9 18:01:33 2004
+++ smarty/unit_test/test_cases.php	Fri Sep 10 15:15:01 2004
@@ -14,13 +14,17 @@
 }
 
     
-class SmartyTest extends PHPUnit_TestCase {
+class SmartyTest extends PHPUnit_TestCase {   
     // contains the object handle of the string class
     var $abc;
+    // contains the last triggered error's errorlevel
+    var $errorlevel;
+
     // constructor of the test suite
     function SmartyTest($name) {
        $this->PHPUnit_TestCase($name);
     }
+
     // called before the test functions will be executed    
     // this function is defined in PHPUnit_TestCase and overwritten 
     // here
@@ -37,6 +41,11 @@
         unset($this->smarty);
     }
     
+    // dummy errorhandler for functions that are supposed to call trigger_error()
+    function error_handler($errorlevel) {
+        if ($errorlevel) $this->errorlevel = $errorlevel;
+    }
+
     /* DIRECTORY TESTS */
     
     // test that template_dir exists
@@ -214,6 +223,11 @@
     function test_get_plugin_filepath() {
         $this->assertTrue(method_exists($this->smarty, '_get_plugin_filepath'));
     }
+
+    
+    function test_clear_compiled_tpl() {
+        $this->assertTrue($this->smarty->clear_compiled_tpl());
+    }
     
     /* DISPLAY TESTS */
     
@@ -371,7 +385,39 @@
         $this->smarty->security = $security;
 
     }
-    
-  }
+
+    // test constants and security
+    function test_core_is_secure_function_smarty_var_const() {
+        define('TEST_CONSTANT', 'test constant');
+        $this->assertEquals('test constant', $this->smarty->fetch('constant.tpl',
+                                                             null, 'var_const'));
+    }
+
+    function test_core_is_secure_function_smarty_var_const_allowed() {
+        $security = $this->smarty->security;
+        $security_settings = $this->smarty->security_settings;
+        $this->smarty->security_settings['ALLOW_CONSTANTS'] = true;
+        $this->smarty->security = true;
+        $this->assertEquals('test constant', $this->smarty->fetch('constant.tpl',
+                                                     null, 'var_const_allowed'));
+        $this->smarty->security_settings = $security_settings;
+        $this->smarty->security = $security;   
+    }
+
+    function test_core_is_secure_function_smarty_var_const_not_allowed() {
+        $security = $this->smarty->security;
+        $this->smarty->security = true;
+        /* save old error_handler */
+        $this->errorlevel = null;
+        $error_handler = set_error_handler(array(&$this, 'error_handler'));
+        $this->smarty->fetch('constant.tpl', null, 'var_const_not_allowed');
+        /* restore old error_handler */
+        if ($error_handler) set_error_handler($error_handler);
+
+        $this->assertEquals( $this->errorlevel, E_USER_WARNING);
+        $this->smarty->security = $security;
+    }
+
+}
 
 ?>

-- 
Smarty CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php