$smarty.const

Hi all.

It occured to me that even with security on we might be leaking data
through $smarty.const (eg: SMARTY_DIR which reveals a system path). I
would like to propose that either $smarty.const is made unavailable
when security is on (my ideal) or that somehow only white-listed keys
can be retrieved through $smarty.const.

If this is acceptable, I'd be happy to prepare a patch.

It may also be desirable to disable the request vars when security is
on, but I won't venture that far for now :)

xo boots