BUG: Config_File can leak section data (includes hidden sections)

Since it probably went unnoticed, I'm posting this bug (and solution) first reported on the user forums at http://www.phpinsider.com/smarty-forum/viewtopic.php?t=436. Issue: Config_File class incorrectly loads the first section as the global section if the configuration file begins immediately with a section block. Further, if the configuration block begins with a hidden section, the hidden section is loaded as the global section exposing restricted data. Solution: The quick fix is to append a "\n" to the loaded configuration file prior to it being parsed in Config_File::load_file(). Index: libs/Config_File.class.php =================================================================== RCS file: /repository/smarty/libs/Config_File.class.php,v retrieving revision 1.48 diff -u -r1.48 Config_File.class.php --- libs/Config_File.class.php 8 May 2003 14:29:44 -0000 1.48 +++ libs/Config_File.class.php 6 Jun 2003 04:32:54 -0000 @@ -259,6 +259,7 @@ $contents = preg_replace('!\r\n?!',"\n",$contents); } + $contents = "\n$contents"; $config_data = array(); /* Get global variables first. */ __________________________________ Do you Yahoo!? Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com