security's ALLOW_CONSTANTS

Hello,

someone on IRC came up with this: There is an element in the
$security_settings-array "ALLOW_CONSTANTS" (defaulting to false). This
one is neither documented nor could I find a Smarty version supporting
this setting.

I think prohibiting constants in secured templates is useful. AFAIR
ez_sql relies on the database-connection-parameters (including
username and password) defined as constants. There may be other libs
or apps that need constants defined you don't want to expose to an
untrusted party that is allowd to edit templates.

Enabling this setting is easy:

Index: Smarty_Compiler.class.php
===================================================================
RCS file: /repository/smarty/libs/Smarty_Compiler.class.php,v
retrieving revision 1.315
diff -u -r1.315 Smarty_Compiler.class.php
--- Smarty_Compiler.class.php   23 Feb 2004 23:14:40 -0000      1.315
+++ Smarty_Compiler.class.php   25 Feb 2004 00:08:39 -0000
@@ -2016,6 +2016,10 @@
                 break;

             case 'const':
+                if ($this->security && !$this->security_settings['ALLOW_CONSTANTS']) {
+                    $this->_syntax_error("(secure mode) constants not permitted", E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
                 array_shift($indexes);
                 $_val = $this->_parse_var_props(substr($indexes[0],1));
                 $compiled_ref = '@constant(' . $_val . ')';


If there are no objections, I'd like to add this to the Smarty-Compiler.


greetings
messju

-- 
Smarty Development Mailing List (http://smarty.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php