Public/IP
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Update Smarty und RedBean

Browse source 
Smarty: 3.1.30 - Redbean: 5.0.0
This commit is contained in:
Robin Kloppe 2018-01-28 19:29:49 +01:00
parent eb0835ff74
commit 0795a87ecd
193 changed files with 22035 additions and 14455 deletions
Download patch file Download diff file Expand all files Collapse all files

47
libs/plugins/function.math.php
View file

@ -24,19 +24,18 @@
*/
function smarty_function_math($params, $template)
{
static $_allowed_funcs = array(
'int' => true, 'abs' => true, 'ceil' => true, 'cos' => true, 'exp' => true, 'floor' => true,
'log' => true, 'log10' => true, 'max' => true, 'min' => true, 'pi' => true, 'pow' => true,
'rand' => true, 'round' => true, 'sin' => true, 'sqrt' => true, 'srand' => true, 'tan' => true
);
static $_allowed_funcs =
array('int' => true, 'abs' => true, 'ceil' => true, 'cos' => true, 'exp' => true, 'floor' => true,
'log' => true, 'log10' => true, 'max' => true, 'min' => true, 'pi' => true, 'pow' => true, 'rand' => true,
'round' => true, 'sin' => true, 'sqrt' => true, 'srand' => true, 'tan' => true);
// be sure equation parameter is present
if (empty($params['equation'])) {
if (empty($params[ 'equation' ])) {
trigger_error("math: missing equation parameter", E_USER_WARNING);
return;
}
$equation = $params['equation'];
$equation = $params[ 'equation' ];
// make sure parenthesis are balanced
if (substr_count($equation, "(") != substr_count($equation, ")")) {
@ -45,11 +44,25 @@ function smarty_function_math($params, $template)
return;
}
// match all vars in equation, make sure all are passed
preg_match_all("!(?:0x[a-fA-F0-9]+)|([a-zA-Z][a-zA-Z0-9_]*)!", $equation, $match);
// disallow backticks
if (strpos($equation, '`') !== false) {
trigger_error("math: backtick character not allowed in equation", E_USER_WARNING);
foreach ($match[1] as $curr_var) {
if ($curr_var && !isset($params[$curr_var]) && !isset($_allowed_funcs[$curr_var])) {
return;
}
// also disallow dollar signs
if (strpos($equation, '$') !== false) {
trigger_error("math: dollar signs not allowed in equation", E_USER_WARNING);
return;
}
// match all vars in equation, make sure all are passed
preg_match_all('!(?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*)!', $equation, $match);
foreach ($match[ 1 ] as $curr_var) {
if ($curr_var && !isset($params[ $curr_var ]) && !isset($_allowed_funcs[ $curr_var ])) {
trigger_error("math: function call $curr_var not allowed", E_USER_WARNING);
return;
@ -75,17 +88,17 @@ function smarty_function_math($params, $template)
$smarty_math_result = null;
eval("\$smarty_math_result = " . $equation . ";");
if (empty($params['format'])) {
if (empty($params['assign'])) {
if (empty($params[ 'format' ])) {
if (empty($params[ 'assign' ])) {
return $smarty_math_result;
} else {
$template->assign($params['assign'], $smarty_math_result);
$template->assign($params[ 'assign' ], $smarty_math_result);
}
} else {
if (empty($params['assign'])) {
printf($params['format'], $smarty_math_result);
if (empty($params[ 'assign' ])) {
printf($params[ 'format' ], $smarty_math_result);
} else {
$template->assign($params['assign'], sprintf($params['format'], $smarty_math_result));
$template->assign($params[ 'assign' ], sprintf($params[ 'format' ], $smarty_math_result));
}
}
}