diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent parameters from overwriting the template filename.

Browse Source 
Fixes a potential arbitrary file execution exploit.
This commit is contained in:
Matt Robinson 2012-01-09 11:40:00 +00:00
parent 5106810803
commit 0507840b67
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Symfony/Component/Templating/PhpEngine.php
View File

@ -150,15 +150,20 @@ class PhpEngine implements EngineInterface, \ArrayAccess
protected function evaluate(Storage $template, array $parameters = array())
{
$__template__ = $template;
if (isset($parameters['__template__'])) {
throw new \InvalidArgumentException('Invalid parameter (__template__)');
}
if ($__template__ instanceof FileStorage) {
extract($parameters);
extract($parameters, EXTR_SKIP);
$view = $this;
ob_start();
require $__template__;
return ob_get_clean();
} elseif ($__template__ instanceof StringStorage) {
extract($parameters);
extract($parameters, EXTR_SKIP);
$view = $this;
ob_start();
eval('; ?>'.$__template__.'<?php ;');