security issue : ALLOW_CONSTANTS

in security mode, security_settings["ALLOW_CONSTANTS"] of Smarty class is
set to false. Then constants shouldn't be accessibles.
But in Smarty_Compliler.class.php, line 2018, we got :

case 'const':
    array_shift($indexes);
    $_val = $this->_parse_var_props(substr($indexes[0],1));
    $compiled_ref = '@constant(' . $_val . ')';
    $_max_index = 1;
    break;

What means to me that the constant is compiled with caring if it is allowed
or not...

Tarik

-- 
http://perso.efrei.fr/~ansari/

-- 
Smarty Development Mailing List (http://smarty.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php