geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-09-16 04:16:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed C extension sandbox behavior

Browse Source
This commit is contained in:
Tugdual Saunier
2013-10-31 11:13:00 +00:00
committed by Fabien Potencier
parent 8fcde6a091
commit 40bba0e447
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG
+1 -1
View File
@@ -1,6 +1,6 @@
* 1.14.3 (2013-XX-XX) * 1.14.3 (2013-XX-XX)
* n/a * fixed the C extension sandbox behavior when get or set is prepend to method name
* 1.14.2 (2013-10-30) * 1.14.2 (2013-10-30)
ext/twig/twig.c
+6 -1
View File
@@ -961,6 +961,7 @@ PHP_FUNCTION(twig_template_get_attributes)
char *method = NULL; char *method = NULL;
char *tmp_method_name_get; char *tmp_method_name_get;
char *tmp_method_name_is; char *tmp_method_name_is;
zval *zmethod;
zval *tmp_methods; zval *tmp_methods;
lcItem_length = strlen(lcItem); lcItem_length = strlen(lcItem);
@@ -1023,13 +1024,16 @@ PHP_FUNCTION(twig_template_get_attributes)
$this->env->getExtension('sandbox')->checkMethodAllowed($object, $method); $this->env->getExtension('sandbox')->checkMethodAllowed($object, $method);
} }
*/ */
MAKE_STD_ZVAL(zmethod);
ZVAL_STRING(zmethod, method, 1);
if (TWIG_CALL_SB(TWIG_PROPERTY_CHAR(template, "env" TSRMLS_CC), "hasExtension", "sandbox" TSRMLS_CC)) { if (TWIG_CALL_SB(TWIG_PROPERTY_CHAR(template, "env" TSRMLS_CC), "hasExtension", "sandbox" TSRMLS_CC)) {
TWIG_CALL_ZZ(TWIG_CALL_S(TWIG_PROPERTY_CHAR(template, "env" TSRMLS_CC), "getExtension", "sandbox" TSRMLS_CC), "checkMethodAllowed", object, zitem TSRMLS_CC); TWIG_CALL_ZZ(TWIG_CALL_S(TWIG_PROPERTY_CHAR(template, "env" TSRMLS_CC), "getExtension", "sandbox" TSRMLS_CC), "checkMethodAllowed", object, zmethod TSRMLS_CC);
} }
if (EG(exception)) { if (EG(exception)) {
efree(tmp_method_name_get); efree(tmp_method_name_get);
efree(tmp_method_name_is); efree(tmp_method_name_is);
efree(lcItem); efree(lcItem);
zval_ptr_dtor(&zmethod);
return; return;
} }
/* /*
@@ -1040,6 +1044,7 @@ PHP_FUNCTION(twig_template_get_attributes)
efree(tmp_method_name_get); efree(tmp_method_name_get);
efree(tmp_method_name_is); efree(tmp_method_name_is);
efree(lcItem); efree(lcItem);
zval_ptr_dtor(&zmethod);
} }
/* /*
// useful when calling a template method from a template // useful when calling a template method from a template
test/Twig/Tests/Extension/SandboxTest.php
+3
View File
@@ -30,6 +30,7 @@ class Twig_Tests_Extension_SandboxTest extends PHPUnit_Framework_TestCase
'1_basic6' => '{{ arr.obj }}', '1_basic6' => '{{ arr.obj }}',
'1_basic7' => '{{ cycle(["foo","bar"], 1) }}', '1_basic7' => '{{ cycle(["foo","bar"], 1) }}',
'1_basic8' => '{{ obj.getfoobar }}{{ obj.getFooBar }}', '1_basic8' => '{{ obj.getfoobar }}{{ obj.getFooBar }}',
'1_basic9' => '{{ obj.foobar }}{{ obj.fooBar }}',
'1_basic' => '{% if obj.foo %}{{ obj.foo|upper }}{% endif %}', '1_basic' => '{% if obj.foo %}{{ obj.foo|upper }}{% endif %}',
'1_layout' => '{% block content %}{% endblock %}', '1_layout' => '{% block content %}{% endblock %}',
'1_child' => '{% extends "1_layout" %}{% block content %}{{ "a"|json_encode }}{% endblock %}', '1_child' => '{% extends "1_layout" %}{% block content %}{{ "a"|json_encode }}{% endblock %}',
@@ -127,6 +128,8 @@ class Twig_Tests_Extension_SandboxTest extends PHPUnit_Framework_TestCase
FooObject::reset(); FooObject::reset();
$this->assertEquals('foobarfoobar', $twig->loadTemplate('1_basic8')->render(self::$params), 'Sandbox allow methods in a case-insensitive way'); $this->assertEquals('foobarfoobar', $twig->loadTemplate('1_basic8')->render(self::$params), 'Sandbox allow methods in a case-insensitive way');
$this->assertEquals(2, FooObject::$called['getFooBar'], 'Sandbox only calls method once'); $this->assertEquals(2, FooObject::$called['getFooBar'], 'Sandbox only calls method once');
$this->assertEquals('foobarfoobar', $twig->loadTemplate('1_basic9')->render(self::$params), 'Sandbox allow methods via shortcut names (ie. without get/set)');
} }
} }