cvs: smarty /libs Smarty_Compiler.class.php

mohrt		Wed Mar 30 11:45:24 2005 EDT

  Modified files:              
    /smarty/libs	Smarty_Compiler.class.php 
  Log:
  disallow variable func calls when security is enabled
  
  
http://cvs.php.net/diff.php/smarty/libs/Smarty_Compiler.class.php?r1=1.365&r2=1.366&ty=u
Index: smarty/libs/Smarty_Compiler.class.php
diff -u smarty/libs/Smarty_Compiler.class.php:1.365 smarty/libs/Smarty_Compiler.class.php:1.366
--- smarty/libs/Smarty_Compiler.class.php:1.365	Tue Mar 22 03:45:07 2005
+++ smarty/libs/Smarty_Compiler.class.php	Wed Mar 30 11:45:24 2005
@@ -26,7 +26,7 @@
  * @package Smarty
  */
 
-/* $Id: Smarty_Compiler.class.php,v 1.365 2005/03/22 08:45:07 messju Exp $ */
+/* $Id: Smarty_Compiler.class.php,v 1.366 2005/03/30 16:45:24 mohrt Exp $ */
 
 /**
  * Template compiling class
@@ -1372,6 +1372,9 @@
                                !in_array($token, $this->security_settings['IF_FUNCS'])) {
                                 $this->_syntax_error("(secure mode) '$token' not allowed in if statement", E_USER_ERROR, __FILE__, __LINE__);
                             }
+                    } elseif($this->security && preg_match('~^' . $this->_var_regexp . '$~', $token) && isset($tokens[$i+1]) && $tokens[$i+1] == '(') {
+                        // variable function call
+                        $this->_syntax_error("(secure mode) variable function call '$token' not allowed in if statement", E_USER_ERROR, __FILE__, __LINE__);                      
                     } elseif(preg_match('~^' . $this->_obj_call_regexp . '|' . $this->_var_regexp . '(?:' . $this->_mod_regexp . '*)$~', $token)) {
                         // object or variable
                         $token = $this->_parse_var_props($token);

-- 
Smarty CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php