diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

merged branch inanimatt/2.0 (PR #3068)

Browse Source 
Commits
-------

0507840 Prevent parameters from overwriting the template filename.

Discussion
----------

Prevent parameters from overwriting the template filename.

Fixes a potential arbitrary file execution exploit.
This commit is contained in:
Fabien Potencier 2012-01-09 14:01:32 +01:00
commit caec56fbe3
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Symfony/Component/Templating/PhpEngine.php
View File

@ -150,15 +150,20 @@ class PhpEngine implements EngineInterface, \ArrayAccess
protected function evaluate(Storage $template, array $parameters = array())
{
$__template__ = $template;
if (isset($parameters['__template__'])) {
throw new \InvalidArgumentException('Invalid parameter (__template__)');
}
if ($__template__ instanceof FileStorage) {
extract($parameters);
extract($parameters, EXTR_SKIP);
$view = $this;
ob_start();
require $__template__;
return ob_get_clean();
} elseif ($__template__ instanceof StringStorage) {
extract($parameters);
extract($parameters, EXTR_SKIP);
$view = $this;
ob_start();
eval('; ?>'.$__template__.'<?php ;');