security's ALLOW_CONSTANTS

Hello, someone on IRC came up with this: There is an element in the $security_settings-array "ALLOW_CONSTANTS" (defaulting to false). This one is neither documented nor could I find a Smarty version supporting this setting. I think prohibiting constants in secured templates is useful. AFAIR ez_sql relies on the database-connection-parameters (including username and password) defined as constants. There may be other libs or apps that need constants defined you don't want to expose to an untrusted party that is allowd to edit templates. Enabling this setting is easy: Index: Smarty_Compiler.class.php =================================================================== RCS file: /repository/smarty/libs/Smarty_Compiler.class.php,v retrieving revision 1.315 diff -u -r1.315 Smarty_Compiler.class.php --- Smarty_Compiler.class.php 23 Feb 2004 23:14:40 -0000 1.315 +++ Smarty_Compiler.class.php 25 Feb 2004 00:08:39 -0000 @@ -2016,6 +2016,10 @@ break; case 'const': + if ($this->security && !$this->security_settings['ALLOW_CONSTANTS']) { + $this->_syntax_error("(secure mode) constants not permitted", E_USER_WARNING, __FILE__, __LINE__); + return; + } array_shift($indexes); $_val = $this->_parse_var_props(substr($indexes[0],1)); $compiled_ref = '@constant(' . $_val . ')'; If there are no objections, I'd like to add this to the Smarty-Compiler. greetings messju