Re: [SMARTY-DEV] security issue : ALLOW_CONSTANTS

On Thu, Mar 04, 2004 at 05:05:22PM +0100, Tarik ANSARI wrote: > in security mode, security_settings["ALLOW_CONSTANTS"] of Smarty class is > set to false. Then constants shouldn't be accessibles. > But in Smarty_Compliler.class.php, line 2018, we got : > > case 'const': > array_shift($indexes); > $_val = $this->_parse_var_props(substr($indexes[0],1)); > $compiled_ref = '@constant(' . $_val . ')'; > $_max_index = 1; > break; > > What means to me that the constant is compiled with caring if it is allowed > or not... I asked for this recently. The point is, ALLOW_CONSTANTS is nowhere documented. You can fix it for the moment by removing the line " 'ALLOW_CONSTANTS' => false" (line 235 in Smarty.class.php of 2.6.2) :) > Tarik > > -- > http://perso.efrei.fr/~ansari/