Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Direct access to php constants breaking smarty #554

Open
grapestech opened this issue Oct 11, 2019 · 4 comments · May be fixed by #585
Open

Direct access to php constants breaking smarty #554

grapestech opened this issue Oct 11, 2019 · 4 comments · May be fixed by #585

Comments

@grapestech
Copy link

Hi,

We upgraded from Smarty 3.1.21 to 3.1.33

Apparently, if you have a php variable defined as follows :

define("myvar", "My var value");

It can be accessed in the template as {myvar}

Can we stop this behavior ?

In our app we have a php constant defined named "assign" which breaks the smarty template when the assign tag is used.

There should be a way to not directly "see" these keywords as constants since anyone can break smarty by defining a php variable having the same smarty tag name. And btw the generated exception doesn't say much, it was hard to find.

Thanks !

@artcs
Copy link

artcs commented Oct 11, 2019

A similar issue with inline constant support regarding array access ( #149) was fixed some years ago. In your case you can hack around this issue similarly by editing the file sysplugins/smarty_internal_templateparser.php. In function yy_r13() (line 2257) change

if (defined($tag)) {

to

if (0) {

Then the tagnames don't get replaced by defined values.
This does the trick only for tagnames and is a hack only, of course. It should be changed in the template lexer, from which the file is generated. Cleanest solution would be to introduce a variable like $Smarty->useInlineConstants and adjust the lexer accordingly. So one could turn off inline constant support alltogether ($smarty.const.foo syntax would still work).

@grapestech
Copy link
Author

grapestech commented Oct 11, 2019

Thanks for your reply.

Indeed this should be controlled via a setting specially that we're using smarty with composer so it doesn't make sense to hack a specific file in the smarty lib. Would appreciate adding this fix to the upcoming release.

@ophian
Copy link

ophian commented Oct 12, 2019

I also noticed a different parser behaviour for constants with PHP 7.3 early this year, see #534 .
But I would think your usage of defining PHP variables via CONSTANT define() instead of VARIABLE assign() is just wrong, as far as I got you right. And taking the keyword assign as "constant" is bad too since that is build/prone to produce errors/false behaviours. You should keep things clear out of way, so that PHP evolution changes (like for constants) don't do that bad.

@AnrDaemon
Copy link
Contributor

anyone can break smarty by defining a php variable having the same smarty tag name

That's simply untrue. Please don't spread misinformation. Not to mention, this has nothing to do with PHP variables.

@artcs artcs linked a pull request Apr 14, 2020 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants