Re: security issue : ALLOW_CONSTANTS

On Thu, Mar 04, 2004 at 05:05:22PM +0100, Tarik ANSARI wrote:
> in security mode, security_settings["ALLOW_CONSTANTS"] of Smarty class is
> set to false. Then constants shouldn't be accessibles.
> But in Smarty_Compliler.class.php, line 2018, we got :
> 
> case 'const':
>     array_shift($indexes);
>     $_val = $this->_parse_var_props(substr($indexes[0],1));
>     $compiled_ref = '@constant(' . $_val . ')';
>     $_max_index = 1;
>     break;
> 
> What means to me that the constant is compiled with caring if it is allowed
> or not...

I asked for this recently. The point is, ALLOW_CONSTANTS is nowhere
documented. You can fix it for the moment by removing the line

"                                    'ALLOW_CONSTANTS' => false"

(line 235 in Smarty.class.php of 2.6.2) :)


 
> Tarik
> 
> -- 
> http://perso.efrei.fr/~ansari/

-- 
Smarty Development Mailing List (http://smarty.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php