cvs: smarty / NEWS /libs/plugins function.html_image.php

messju		Thu Jan 15 10:00:09 2004 EDT

  Modified files:              
    /smarty	NEWS 
    /smarty/libs/plugins	function.html_image.php 
  Log:
  fix: $smarty->security is now correctly handled
  
  minor optimizations:
     core/core.is_secure.php is only included when needed
     $dpi_default is only determined when needed
  
  
  
Index: smarty/NEWS
diff -u smarty/NEWS:1.424 smarty/NEWS:1.425
--- smarty/NEWS:1.424	Thu Jan  8 08:12:51 2004
+++ smarty/NEWS	Thu Jan 15 10:00:07 2004
@@ -1,3 +1,4 @@
+  - fix interpretation of $smarty->security in {html_image} (messju)
   - add caching of requested paths to _assemble_plugin_filepath() (messju)
   - fix handling of comments inside {php}- and {literal}-blocks (messju)
   - fix bug handling triple-quotes in config-files (BRDude, messju)
Index: smarty/libs/plugins/function.html_image.php
diff -u smarty/libs/plugins/function.html_image.php:1.24 smarty/libs/plugins/function.html_image.php:1.25
--- smarty/libs/plugins/function.html_image.php:1.24	Thu Dec  4 06:37:27 2003
+++ smarty/libs/plugins/function.html_image.php	Thu Jan 15 10:00:09 2004
@@ -48,12 +48,6 @@
     $suffix = '';
     $server_vars = ($smarty->request_use_auto_globals) ? $_SERVER : $GLOBALS['HTTP_SERVER_VARS'];
     $basedir = isset($server_vars['DOCUMENT_ROOT']) ? $server_vars['DOCUMENT_ROOT'] : '';
-    if(strstr($server_vars['HTTP_USER_AGENT'], 'Mac')) {
-        $dpi_default = 72;
-    } else {
-        $dpi_default = 96;
-    }
-
     foreach($params as $_key => $_val) {
         switch($_key) {
             case 'file':
@@ -101,7 +95,13 @@
     }
 
     if(!isset($params['width']) || !isset($params['height'])) {
-        if(!$_image_data = @getimagesize($_image_path)) {
+        if ($smarty->security &&
+            ($_params = array('resource_type' => 'file', 'resource_name' => $_image_path)) &&
+            (require_once(SMARTY_DIR . 'core' . DIRECTORY_SEPARATOR . 'core.is_secure.php')) &&
+            (!smarty_core_is_secure($_params, $smarty)) ) {
+            $smarty->trigger_error("html_image: (secure) '$_image_path' not in secure directory", E_USER_NOTICE);
+
+        } elseif (!$_image_data = @getimagesize($_image_path)) {
             if(!file_exists($_image_path)) {
                 $smarty->trigger_error("html_image: unable to find '$_image_path'", E_USER_NOTICE);
                 return;
@@ -130,6 +130,11 @@
     }
 
     if(isset($params['dpi'])) {
+        if(strstr($server_vars['HTTP_USER_AGENT'], 'Mac')) {
+            $dpi_default = 72;
+        } else {
+            $dpi_default = 96;
+        }
         $_resize = $dpi_default/$params['dpi'];
         $width = round($width * $_resize);
         $height = round($height * $_resize);

-- 
Smarty CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php