security issue : ALLOW_CONSTANTS
| From: | Tarik ANSARI | Date: | Thu, 04 Mar 2004 16:05:22 +0000 |
| Subject: | security issue : ALLOW_CONSTANTS | ||
| Groups: | php.smarty.dev | ||
| Request: | Send a blank email to php-smarty-dev+get-2191@lists.php.net to get a copy of this message | ||
in security mode, security_settings["ALLOW_CONSTANTS"] of Smarty class is
set to false. Then constants shouldn't be accessibles.
But in Smarty_Compliler.class.php, line 2018, we got :
case 'const':
array_shift($indexes);
$_val = $this->_parse_var_props(substr($indexes[0],1));
$compiled_ref = '@constant(' . $_val . ')';
$_max_index = 1;
break;
What means to me that the constant is compiled with caring if it is allowed
or not...
Tarik
--
http://perso.efrei.fr/~ansari/