Re: [SMARTY-DEV] BUG: Config_File can leak section data (includes hidden sections)

I fixed it, but in a different way... I modified the logic to check for '[' at the beginning of the file when loading globals. Monte On Thu, 2003-06-05 at 23:36, boots wrote: > Since it probably went unnoticed, I'm posting this bug (and solution) > first reported on the user forums at > http://www.phpinsider.com/smarty-forum/viewtopic.php?t=436. > > Issue: > Config_File class incorrectly loads the first section as the global > section if the configuration file begins immediately with a section > block. Further, if the configuration block begins with a hidden > section, the hidden section is loaded as the global section exposing > restricted data. > > Solution: > The quick fix is to append a "\n" to the loaded configuration file > prior to it being parsed in Config_File::load_file(). > > Index: libs/Config_File.class.php > =================================================================== > RCS file: /repository/smarty/libs/Config_File.class.php,v > retrieving revision 1.48 > diff -u -r1.48 Config_File.class.php > --- libs/Config_File.class.php 8 May 2003 14:29:44 -0000 1.48 > +++ libs/Config_File.class.php 6 Jun 2003 04:32:54 -0000 > @@ -259,6 +259,7 @@ > $contents = preg_replace('!\r\n?!',"\n",$contents); > } > > + $contents = "\n$contents"; > $config_data = array(); > > /* Get global variables first. */ > > > __________________________________ > Do you Yahoo!? > Yahoo! Calendar - Free online calendar with sync to Outlook(TM). > http://calendar.yahoo.com -- Monte Ohrt <monte@ispi.net>