|
Smarty
WARNING: All discussion is moving to https://reddit.com/r/smarty, please go there! This forum will be closing soon. |
|
View previous topic :: View next topic |
Author |
Message |
ziege Smarty Rookie
Joined: 16 Aug 2005 Posts: 13
|
Posted: Sun Jan 23, 2011 1:10 pm Post subject: Bug with "open_basedir" set and missing templates |
|
|
Hi,
if you have activated "open_basedir" in your php.ini (or in your script from PHP 5.3), an security error will occur when you define one or more template directories (with in the "open_basedir") but the template with the given name does not exist.
Example:
open_basedir = "/xyz"
template_dir = array("/xyz/abc", "/xyz/def");
template_name = "foo.tpl"
"Smarty_Internal_Template::buildTemplateFilepath" will check the following paths:
1) "/xyz/abc/foo.tpl" -> not found, no error
2) "/xyz/def/foo.tpl" -> not found, no error
And now, because the template does not exist in any of the given template directories:
3) "/foo.tpl" -> open_basedir error
So you get an open_basedir error instead of the expected and (catchable) Smarty exception.
Fix:
Replace
Code: |
if (file_exists($file)) return $file;
|
on line 606 with
Code: |
if (@file_exists($file)) return $file;
|
BTW:
If you use an absolute template path as template_name and the default template_dir is defined (that's done in the Smarty constructor, so this is always the case if you don't set it explicitly to an empty value), this will also result in an error with open_basedir in line 603.
So also replace
Code: |
if (file_exists($_filepath))
|
with
Code: |
if (@file_exists($_filepath))
|
|
|
Back to top |
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|