makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 14:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fixed: bug #3352 (function token_get_all() is missing)

Browse source 
git-svn-id: file:///svn/phpbb/trunk@6206 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Ludovic Arnaud 2006-07-23 22:16:05 +00:00
parent afad755f93
commit ed69875649
1 changed files with 33 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
phpBB/includes/functions_template.php
View file

@ -82,6 +82,39 @@ class template_compile
*/
function remove_php_tags(&$code)
{
if (!function_exists('token_get_all'))
{
/**
* If the tokenizer extension is not available, try to load it and if
* it's still not available we fall back to some pattern replacement.
*
* Note that the pattern replacement may affect the well-formedness
* of the HTML if a PHP tag is found because even if we escape PHP
* opening tags we do NOT escape PHP closing tags and cannot do so
* reliably without the use of a full-blown tokenizer.
*
* The bottom line is, a template should NEVER contain PHP because it
* would comprise the security of the installation, that's why we
* prevent it from being executed. Our job is to secure the installation,
* not fix unsecure templates. if a template contains some PHP then it
* should not be used at all.
*/
@dl('tokenizer');
if (!function_exists('token_get_all'))
{
$match = array(
'\\?php[\n\r\s\t]+',
'\\?=',
'\\?[\n\r\s\t]',
'script[\n\r\s\t]+language[\n\r\s\t]*=[\n\r\s\t]*[\'"]php[\'"]'
);
$code = preg_replace('#<(' . implode('|', $match) . ')#is', '&lt;$1', $code);
return;
}
}
do
{
$tokens = token_get_all('<?php ?>' . $code);