$smarty.const
| From: | boots | Date: | Thu, 09 Sep 2004 22:49:57 +0000 |
| Subject: | $smarty.const | ||
| References: | 1 | Groups: | php.smarty.dev |
| Request: | Send a blank email to php-smarty-dev+get-2557@lists.php.net to get a copy of this message | ||
Hi all.
It occured to me that even with security on we might be leaking data
through $smarty.const (eg: SMARTY_DIR which reveals a system path). I
would like to propose that either $smarty.const is made unavailable
when security is on (my ideal) or that somehow only white-listed keys
can be retrieved through $smarty.const.
If this is acceptable, I'd be happy to prepare a patch.
It may also be desirable to disable the request vars when security is
on, but I won't venture that far for now :)
xo boots