CVE-2018-13982 (published 2018-09-18T21:29Z)

Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/smarty-php/smarty
commit_details: repo_url: https://github.com/smarty-php/smarty
author: Uwe Tews
author_date: 2018-04-26 13:02:51+02:00
msg: - bugfix  regarding Security Vulnerability did not solve the problem under Linux
repository: repo_url: https://github.com/smarty-php/smarty
repo_name: smarty-php/smarty
description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
repo_language: PHP
owner: smarty-php
file_changes: filename: change_log.txt
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,8 @@
-﻿===== 3.1.32 ===== (24.04.2018)
+﻿===== 3.1.33-dev-1 =====
+26.04.2018
+ - bugfix  regarding Security Vulnerability did not solve the problem under Linux.
+
+===== 3.1.32 ===== (24.04.2018)
 24.04.2018
  - bugfix  possible Security Vulnerability in Smarty_Security class.
 

programming_language: Markdown
filename: Smarty.class.php
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@
  * @author    Uwe Tews   <uwe dot tews at gmail dot com>
  * @author    Rodney Rehm
  * @package   Smarty
- * @version   3.1.32
+ * @version   3.1.33-dev
  */
 /**
  * set SMARTY_DIR to absolute path to Smarty library files.
@@ -112,7 +112,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.32';
+    const SMARTY_VERSION = '3.1.33-dev-1';
     /**
      * define variable scopes
      */
@@ -835,7 +835,7 @@ class Smarty extends Smarty_Internal_TemplateBase
                 $this->plugins_dir = (array)$this->plugins_dir;
             }
             foreach ($this->plugins_dir as $k => $v) {
-                $this->plugins_dir[ $k ] = $this->_realpath(rtrim($v, "/\\") . DIRECTORY_SEPARATOR, true);
+                $this->plugins_dir[ $k ] = $this->_realpath(rtrim($v, '/\\') . DIRECTORY_SEPARATOR, true);
             }
             $this->_cache[ 'plugin_files' ] = array();
             $this->_pluginsDirNormalized = true;
@@ -1043,20 +1043,15 @@ class Smarty extends Smarty_Internal_TemplateBase
     public function _realpath($path, $realpath = null)
     {
         static $nds = null;
-        static $sepDotsep = null;
-        static $sepDot = null;
-        static $sepSep =null;
+        static $sepDotSep = null;
+         static $sepSep =null;
         if (!isset($nds)) {
             $nds = array('/' => '\\', '\\' => '/');
-            $sepDotsep = DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR;
-            $sepDot = DIRECTORY_SEPARATOR . '.';
+            $sepDotSep = DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR;
             $sepSep = DIRECTORY_SEPARATOR . DIRECTORY_SEPARATOR;
         }
         // normalize DIRECTORY_SEPARATOR
-        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], $sepDotsep), DIRECTORY_SEPARATOR, $path);
-        if (strpos($path,$sepDot) === false && (($realpath === false && $path[0] === '.') || $realpath === null) && $path[0] !== '\\') {
-            return $path;
-        }
+        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], $sepDotSep), DIRECTORY_SEPARATOR, $path);
         preg_match('%^(?<root>(?:[[:alpha:]]:[\\\\]|/|[\\\\]{2}[[:alpha:]]+|[[:print:]]{2,}:[/]{2}|[\\\\])?)(?<path>(.*))$%u',
                    $path,
                    $parts);
@@ -1069,7 +1064,7 @@ class Smarty extends Smarty_Internal_TemplateBase
             }
         }
        // remove noop 'DIRECTORY_SEPARATOR DIRECTORY_SEPARATOR' and 'DIRECTORY_SEPARATOR.DIRECTORY_SEPARATOR' patterns
-        $path = str_replace(array($sepDotsep,$sepSep), DIRECTORY_SEPARATOR, $path);
+        $path = str_replace(array($sepDotSep,$sepSep), DIRECTORY_SEPARATOR, $path);
         // resolve '..DIRECTORY_SEPARATOR' pattern, smallest first
         if (strpos($path, '..' . DIRECTORY_SEPARATOR) !== false &&
             preg_match_all('#[\\\\/]([.][.][\\\\/])+#u', $path, $match)

programming_language: PHP
filename: smarty_security.php
change_type: ModificationType.MODIFY
diff: @@ -258,8 +258,6 @@ class Smarty_Security
     public function __construct($smarty)
     {
         $this->smarty = $smarty;
-        $this->smarty->_cache[ 'template_dir_new' ] = true;
-        $this->smarty->_cache[ 'config_dir_new' ] = true;
     }
 
     /**
@@ -521,24 +519,23 @@ class Smarty_Security
             }
             $this->_include_path_status = $this->smarty->use_include_path;
         }
-        if ($isConfig !== true) {
+
             $_dir = $this->smarty->getTemplateDir();
             if ($this->_template_dir !== $_dir) {
                 $this->_updateResourceDir($this->_template_dir, $_dir);
                 $this->_template_dir = $_dir;
             }
-        }
-        if ($isConfig !== false) {
+
             $_dir = $this->smarty->getConfigDir();
             if ($this->_config_dir !== $_dir) {
                 $this->_updateResourceDir($this->_config_dir, $_dir);
                 $this->_config_dir = $_dir;
             }
-        }
+
         if ($this->_secure_dir !== $this->secure_dir) {
             $this->secure_dir = (array)$this->secure_dir;
             foreach($this->secure_dir as $k => $d) {
-                $this->secure_dir[$k] = $this->smarty->_realpath($d.DIRECTORY_SEPARATOR,true);
+                $this->secure_dir[$k] = $this->smarty->_realpath($d. DIRECTORY_SEPARATOR,true);
             }
             $this->_updateResourceDir($this->_secure_dir, $this->secure_dir);
             $this->_secure_dir = $this->secure_dir;
@@ -597,7 +594,7 @@ class Smarty_Security
 
             $this->_trusted_dir = $this->trusted_dir;
             foreach ((array) $this->trusted_dir as $directory) {
-                $directory = $this->smarty->_realpath($directory . DIRECTORY_SEPARATOR, true);
+                $directory = $this->smarty->_realpath($directory . '/', true);
                 $this->_php_resource_dir[ $directory ] = true;
             }
         }
@@ -616,7 +613,7 @@ class Smarty_Security
      */
     private function _updateResourceDir($oldDir, $newDir) {
         foreach ($oldDir as $directory) {
-            $directory = $this->smarty->_realpath($directory, true);
+ //           $directory = $this->smarty->_realpath($directory, true);
             $length = strlen($directory);
             foreach ($this->_resource_dir as $dir) {
                 if (substr($dir, 0,$length) === $directory) {
@@ -625,7 +622,7 @@ class Smarty_Security
             }
         }
         foreach ($newDir as $directory) {
-            $directory = $this->smarty->_realpath($directory, true);
+ //           $directory = $this->smarty->_realpath($directory, true);
             $this->_resource_dir[ $directory ] = true;
         }
     }
@@ -640,12 +637,7 @@ class Smarty_Security
      */
     private function _checkDir($filepath, $dirs)
     {
-        $directory = dirname($filepath) . DIRECTORY_SEPARATOR;
-        if (isset($dirs[ $directory ])) {
-            return false;
-        }
-        $filepath = $this->smarty->_realpath($filepath, true);
-        $directory = dirname($filepath) . DIRECTORY_SEPARATOR;
+        $directory = dirname($this->smarty->_realpath($filepath, true)) . DIRECTORY_SEPARATOR;
         $_directory = array();
         while (true) {
              // test if the directory is trusted
@@ -653,17 +645,15 @@ class Smarty_Security
                return $_directory;
             }
             // abort if we've reached root
-            if (!preg_match('#[\\\/][^\\\/]+[\\\/]$#', $directory)) {
-                break;
+            if (!preg_match('#[\\\\/][^\\\\/]+[\\\\/]$#', $directory)) {
+                // give up
+                throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
             }
             // remember the directory to add it to _resource_dir in case we're successful
             $_directory[ $directory ] = true;
            // bubble up one level
-            $directory = preg_replace('#[\\\/][^\\\/]+[\\\/]$#', DIRECTORY_SEPARATOR, $directory);
+            $directory = preg_replace('#[\\\\/][^\\\\/]+[\\\\/]$#', '/', $directory);
         }
-
-        // give up
-        throw new SmartyException("directory '{$filepath}' not allowed by security setting");
     }
 
     /**

programming_language: PHP
repo_url: https://github.com/smarty-php/smarty
commit_details: repo_url: https://github.com/smarty-php/smarty
author: Uwe Tews
author_date: 2018-04-26 21:38:08+02:00
msg: - bugfix  regarding Security Vulnerability did not solve the problem under Linux
repository: repo_url: https://github.com/smarty-php/smarty
repo_name: smarty-php/smarty
description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
repo_language: PHP
owner: smarty-php
file_changes: filename: smarty_security.php
change_type: ModificationType.MODIFY
diff: @@ -639,7 +639,8 @@ class Smarty_Security
     {
         $directory = dirname($this->smarty->_realpath($filepath, true)) . DIRECTORY_SEPARATOR;
         $_directory = array();
-        while (true) {
+        if (!preg_match('#[\\\\/][.][.][\\\\/]#',$directory)) {
+            while (true) {
              // test if the directory is trusted
             if (isset($dirs[ $directory ])) {
                return $_directory;
@@ -647,13 +648,16 @@ class Smarty_Security
             // abort if we've reached root
             if (!preg_match('#[\\\\/][^\\\\/]+[\\\\/]$#', $directory)) {
                 // give up
-                throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
+                break;
             }
             // remember the directory to add it to _resource_dir in case we're successful
             $_directory[ $directory ] = true;
            // bubble up one level
             $directory = preg_replace('#[\\\\/][^\\\\/]+[\\\\/]$#', DIRECTORY_SEPARATOR, $directory);
+            }
         }
+        // give up
+        throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
     }
 
     /**

programming_language: PHP
repo_url: https://github.com/smarty-php/smarty
commit_details: repo_url: https://github.com/smarty-php/smarty
author: Uwe Tews
author_date: 2018-04-24 16:14:10+02:00
msg: Release version 3.1.32
repository: repo_url: https://github.com/smarty-php/smarty
repo_name: smarty-php/smarty
description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
repo_language: PHP
owner: smarty-php
file_changes: filename: change_log.txt
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-﻿===== 3.1.32 - dev ===
+﻿===== 3.1.32 ===== (24.04.2018)
 24.04.2018
  - bugfix  possible Security Vulnerability in Smarty_Security class.
 

programming_language: Markdown
filename: Smarty.class.php
change_type: ModificationType.MODIFY
diff: @@ -21,13 +21,13 @@
  * smarty-discussion-subscribe@googlegroups.com
  *
  * @link      http://www.smarty.net/
- * @copyright 2017 New Digital Group, Inc.
- * @copyright 2017 Uwe Tews
+ * @copyright 2018 New Digital Group, Inc.
+ * @copyright 2018 Uwe Tews
  * @author    Monte Ohrt <monte at ohrt dot com>
- * @author    Uwe Tews
+ * @author    Uwe Tews   <uwe dot tews at gmail dot com>
  * @author    Rodney Rehm
  * @package   Smarty
- * @version   3.1.32-dev
+ * @version   3.1.32
  */
 /**
  * set SMARTY_DIR to absolute path to Smarty library files.
@@ -112,7 +112,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.32-dev-46';
+    const SMARTY_VERSION = '3.1.32';
     /**
      * define variable scopes
      */

programming_language: PHP
repo_url: https://github.com/smarty-php/smarty
commit_details: repo_url: https://github.com/smarty-php/smarty
author: Uwe Tews
author_date: 2018-04-24 10:38:18+02:00
msg: - bugfix  possible Security Vulnerability in Smarty_Security class.
repository: repo_url: https://github.com/smarty-php/smarty
repo_name: smarty-php/smarty
description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
repo_language: PHP
owner: smarty-php
file_changes: filename: change_log.txt
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,7 @@
 ﻿===== 3.1.32 - dev ===
+24.04.2018
+ - bugfix  possible Security Vulnerability in Smarty_Security class.
+
 26.03.2018
  - bugfix plugins may not be loaded if {function} or {block} tags are executed in nocache mode
    https://github.com/smarty-php/smarty/issues/371

programming_language: Markdown
filename: Smarty.class.php
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.32-dev-45';
+    const SMARTY_VERSION = '3.1.32-dev-46';
     /**
      * define variable scopes
      */
@@ -1042,9 +1042,15 @@ class Smarty extends Smarty_Internal_TemplateBase
      */
     public function _realpath($path, $realpath = null)
     {
-        $nds = DIRECTORY_SEPARATOR === '/' ? '\\' : '/';
+        static $nds = array('/' => '\\', '\\' => '/');
+        static $sepDotsep = DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR;
+        static $sepDot = DIRECTORY_SEPARATOR . '.';
+        static $sepSep = DIRECTORY_SEPARATOR . DIRECTORY_SEPARATOR;
         // normalize DIRECTORY_SEPARATOR
-        $path = str_replace($nds, DIRECTORY_SEPARATOR, $path);
+        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], $sepDotsep), DIRECTORY_SEPARATOR, $path);
+        if (strpos($path,$sepDot) === false && (($realpath === false && $path[0] === '.') || $realpath === null) && $path[0] !== '\\') {
+            return $path;
+        }
         preg_match('%^(?<root>(?:[[:alpha:]]:[\\\\]|/|[\\\\]{2}[[:alpha:]]+|[[:print:]]{2,}:[/]{2}|[\\\\])?)(?<path>(.*))$%u',
                    $path,
                    $parts);
@@ -1056,11 +1062,11 @@ class Smarty extends Smarty_Internal_TemplateBase
                 $path = getcwd() . DIRECTORY_SEPARATOR . $path;
             }
         }
-        // remove noop 'DIRECTORY_SEPARATOR DIRECTORY_SEPARATOR' and 'DIRECTORY_SEPARATOR.DIRECTORY_SEPARATOR' patterns
-        $path = preg_replace('#([\\\\/]([.]?[\\\\/])+)#u', DIRECTORY_SEPARATOR, $path);
+       // remove noop 'DIRECTORY_SEPARATOR DIRECTORY_SEPARATOR' and 'DIRECTORY_SEPARATOR.DIRECTORY_SEPARATOR' patterns
+        $path = str_replace(array($sepDotsep,$sepSep), DIRECTORY_SEPARATOR, $path);
         // resolve '..DIRECTORY_SEPARATOR' pattern, smallest first
         if (strpos($path, '..' . DIRECTORY_SEPARATOR) !== false &&
-            preg_match_all('#(([.]?[\\\\/])*([.][.])[\\\\/]([.]?[\\\\/])*)+#u', $path, $match)
+            preg_match_all('#[\\\\/]([.][.][\\\\/])+#u', $path, $match)
         ) {
             $counts = array();
             foreach ($match[ 0 ] as $m) {
@@ -1068,13 +1074,13 @@ class Smarty extends Smarty_Internal_TemplateBase
             }
             sort($counts);
             foreach ($counts as $count) {
-                $path = preg_replace('#(([\\\\/]([.]?[\\\\/])*[^\\\\/.]+){' . $count .
-                                     '}[\\\\/]([.]?[\\\\/])*([.][.][\\\\/]([.]?[\\\\/])*){' . $count . '})(?=[^.])#u',
+                $path = preg_replace('#([\\\\/]+[^\\\\/]+){' . $count .
+                                     '}[\\\\/]+([.][.][\\\\/]+){' . $count . '}#u',
                                      DIRECTORY_SEPARATOR,
                                      $path);
             }
         }
-        return $parts[ 'root' ] . $path;
+        return $realpath !== false ? $parts[ 'root' ] . $path : str_ireplace(getcwd(), '.', $parts[ 'root' ] . $path);
     }
 
     /**

programming_language: PHP
filename: smarty_security.php
change_type: ModificationType.MODIFY
diff: @@ -514,60 +514,39 @@ class Smarty_Security
     public function isTrustedResourceDir($filepath, $isConfig = null)
     {
         if ($this->_include_path_status !== $this->smarty->use_include_path) {
-            foreach ($this->_include_dir as $directory) {
-                unset($this->_resource_dir[ $directory ]);
-            }
-            if ($this->smarty->use_include_path) {
-                $this->_include_dir = array();
-                $_dirs = $this->smarty->ext->_getIncludePath->getIncludePathDirs($this->smarty);
-                foreach ($_dirs as $directory) {
-                    $this->_include_dir[] = $directory;
-                    $this->_resource_dir[ $directory ] = true;
-                }
+            $_dir = $this->smarty->use_include_path ? $this->smarty->ext->_getIncludePath->getIncludePathDirs($this->smarty) : array();
+            if ($this->_include_dir !== $_dir) {
+                $this->_updateResourceDir($this->_include_dir, $_dir);
+                $this->_include_dir = $_dir;
             }
             $this->_include_path_status = $this->smarty->use_include_path;
         }
-        if ($isConfig !== true &&
-            (!isset($this->smarty->_cache[ 'template_dir_new' ]) || $this->smarty->_cache[ 'template_dir_new' ])
-        ) {
+        if ($isConfig !== true) {
             $_dir = $this->smarty->getTemplateDir();
             if ($this->_template_dir !== $_dir) {
-                foreach ($this->_template_dir as $directory) {
-                    unset($this->_resource_dir[ $directory ]);
-                }
-                foreach ($_dir as $directory) {
-                    $this->_resource_dir[ $directory ] = true;
-                }
+                $this->_updateResourceDir($this->_template_dir, $_dir);
                 $this->_template_dir = $_dir;
             }
-            $this->smarty->_cache[ 'template_dir_new' ] = false;
         }
-        if ($isConfig !== false &&
-            (!isset($this->smarty->_cache[ 'config_dir_new' ]) || $this->smarty->_cache[ 'config_dir_new' ])
-        ) {
+        if ($isConfig !== false) {
             $_dir = $this->smarty->getConfigDir();
             if ($this->_config_dir !== $_dir) {
-                foreach ($this->_config_dir as $directory) {
-                    unset($this->_resource_dir[ $directory ]);
-                }
-                foreach ($_dir as $directory) {
-                    $this->_resource_dir[ $directory ] = true;
-                }
+                $this->_updateResourceDir($this->_config_dir, $_dir);
                 $this->_config_dir = $_dir;
             }
-            $this->smarty->_cache[ 'config_dir_new' ] = false;
         }
-        if ($this->_secure_dir !== (array) $this->secure_dir) {
-            foreach ($this->_secure_dir as $directory) {
-                unset($this->_resource_dir[ $directory ]);
+        if ($this->_secure_dir !== $this->secure_dir) {
+            $this->secure_dir = (array)$this->secure_dir;
+            foreach($this->secure_dir as $k => $d) {
+                $this->secure_dir[$k] = $this->smarty->_realpath($d.DIRECTORY_SEPARATOR,true);
             }
-            foreach ((array) $this->secure_dir as $directory) {
-                $directory = $this->smarty->_realpath($directory . DIRECTORY_SEPARATOR, true);
-                $this->_resource_dir[ $directory ] = true;
-            }
-            $this->_secure_dir = (array) $this->secure_dir;
+            $this->_updateResourceDir($this->_secure_dir, $this->secure_dir);
+            $this->_secure_dir = $this->secure_dir;
+        }
+        $addPath =  $this->_checkDir($filepath, $this->_resource_dir);
+        if ($addPath !== false) {
+           $this->_resource_dir = array_merge($this->_resource_dir, $addPath);
         }
-        $this->_resource_dir = $this->_checkDir($filepath, $this->_resource_dir);
         return true;
     }
 
@@ -622,40 +601,64 @@ class Smarty_Security
                 $this->_php_resource_dir[ $directory ] = true;
             }
         }
-
-        $this->_php_resource_dir =
-            $this->_checkDir($this->smarty->_realpath($filepath, true), $this->_php_resource_dir);
-        return true;
+        $addPath =  $this->_checkDir($filepath, $this->_php_resource_dir);
+        if ($addPath !== false) {
+           $this->_php_resource_dir = array_merge($this->_php_resource_dir, $addPath);
+        }
+         return true;
     }
 
+    /**
+     * Remove old directories and its sub folders, add new directories
+     *
+     * @param array $oldDir
+     * @param array $newDir
+     */
+    private function _updateResourceDir($oldDir, $newDir) {
+        foreach ($oldDir as $directory) {
+            $directory = $this->smarty->_realpath($directory, true);
+            $length = strlen($directory);
+            foreach ($this->_resource_dir as $dir) {
+                if (substr($dir, 0,$length) === $directory) {
+                    unset($this->_resource_dir[ $dir ]);
+                }
+            }
+        }
+        foreach ($newDir as $directory) {
+            $directory = $this->smarty->_realpath($directory, true);
+            $this->_resource_dir[ $directory ] = true;
+        }
+    }
     /**
      * Check if file is inside a valid directory
      *
      * @param string $filepath
      * @param array  $dirs valid directories
      *
-     * @return array
+     * @return array|bool
      * @throws \SmartyException
      */
     private function _checkDir($filepath, $dirs)
     {
+        $directory = dirname($filepath) . DIRECTORY_SEPARATOR;
+        if (isset($dirs[ $directory ])) {
+            return false;
+        }
+        $filepath = $this->smarty->_realpath($filepath, true);
         $directory = dirname($filepath) . DIRECTORY_SEPARATOR;
         $_directory = array();
         while (true) {
-            // remember the directory to add it to _resource_dir in case we're successful
-            $_directory[ $directory ] = true;
-            // test if the directory is trusted
+             // test if the directory is trusted
             if (isset($dirs[ $directory ])) {
-                // merge sub directories of current $directory into _resource_dir to speed up subsequent lookup
-                $dirs = array_merge($dirs, $_directory);
-
-                return $dirs;
+               return $_directory;
             }
             // abort if we've reached root
             if (!preg_match('#[\\\/][^\\\/]+[\\\/]$#', $directory)) {
                 break;
             }
-            // bubble up one level
+            // remember the directory to add it to _resource_dir in case we're successful
+            $_directory[ $directory ] = true;
+           // bubble up one level
             $directory = preg_replace('#[\\\/][^\\\/]+[\\\/]$#', DIRECTORY_SEPARATOR, $directory);
         }
 

programming_language: PHP
repo_url: https://github.com/smarty-php/smarty
commit_details: repo_url: https://github.com/smarty-php/smarty
author: Uwe Tews
author_date: 2018-04-26 18:06:45+02:00
msg: - bugfix  regarding Security Vulnerability did not solve the problem under Linux
repository: repo_url: https://github.com/smarty-php/smarty
repo_name: smarty-php/smarty
description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
repo_language: PHP
owner: smarty-php
file_changes: filename: Smarty.class.php
change_type: ModificationType.MODIFY
diff: @@ -1042,16 +1042,9 @@ class Smarty extends Smarty_Internal_TemplateBase
      */
     public function _realpath($path, $realpath = null)
     {
-        static $nds = null;
-        static $sepDotSep = null;
-         static $sepSep =null;
-        if (!isset($nds)) {
-            $nds = array('/' => '\\', '\\' => '/');
-            $sepDotSep = DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR;
-            $sepSep = DIRECTORY_SEPARATOR . DIRECTORY_SEPARATOR;
-        }
+        $nds = array('/' => '\\', '\\' => '/');
         // normalize DIRECTORY_SEPARATOR
-        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], $sepDotSep), DIRECTORY_SEPARATOR, $path);
+        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR), DIRECTORY_SEPARATOR, $path);
         preg_match('%^(?<root>(?:[[:alpha:]]:[\\\\]|/|[\\\\]{2}[[:alpha:]]+|[[:print:]]{2,}:[/]{2}|[\\\\])?)(?<path>(.*))$%u',
                    $path,
                    $parts);
@@ -1063,24 +1056,11 @@ class Smarty extends Smarty_Internal_TemplateBase
                 $path = getcwd() . DIRECTORY_SEPARATOR . $path;
             }
         }
-       // remove noop 'DIRECTORY_SEPARATOR DIRECTORY_SEPARATOR' and 'DIRECTORY_SEPARATOR.DIRECTORY_SEPARATOR' patterns
-        $path = str_replace(array($sepDotSep,$sepSep), DIRECTORY_SEPARATOR, $path);
-        // resolve '..DIRECTORY_SEPARATOR' pattern, smallest first
-        if (strpos($path, '..' . DIRECTORY_SEPARATOR) !== false &&
-            preg_match_all('#[\\\\/]([.][.][\\\\/])+#u', $path, $match)
-        ) {
-            $counts = array();
-            foreach ($match[ 0 ] as $m) {
-                $counts[] = (int)((strlen($m) - 1) / 3);
-            }
-            sort($counts);
-            foreach ($counts as $count) {
-                $path = preg_replace('#([\\\\/]+[^\\\\/]+){' . $count .
-                                     '}[\\\\/]+([.][.][\\\\/]+){' . $count . '}#u',
-                                     DIRECTORY_SEPARATOR,
-                                     $path);
-            }
-        }
+        do {
+            $path = preg_replace(
+            array('#[\\\\/]{2}#', '#[\\\\/][.][\\\\/]#', '#[\\\\/]([^\\\\/.]+)[\\\\/][.][.][\\\\/]#'),
+            DIRECTORY_SEPARATOR, $path, -1, $count);
+        } while($count > 0);
         return $realpath !== false ? $parts[ 'root' ] . $path : str_ireplace(getcwd(), '.', $parts[ 'root' ] . $path);
     }
 
@@ -1284,13 +1264,13 @@ class Smarty extends Smarty_Internal_TemplateBase
         if (isset($this->accessMap[ $name ])) {
             $method = 'get' . $this->accessMap[ $name ];
             return $this->{$method}();
-        } else if (isset($this->_cache[ $name ])) {
+        } else {if (isset($this->_cache[ $name ])) {
             return $this->_cache[ $name ];
-        } else if (in_array($name, $this->obsoleteProperties)) {
+        } else {if (in_array($name, $this->obsoleteProperties)) {
             return null;
         } else {
             trigger_error('Undefined property: ' . get_class($this) . '::$' . $name, E_USER_NOTICE);
-        }
+        }}}
         return null;
     }
 
@@ -1309,7 +1289,7 @@ class Smarty extends Smarty_Internal_TemplateBase
         if (isset($this->accessMap[ $name ])) {
             $method = 'set' . $this->accessMap[ $name ];
             $this->{$method}($value);
-        } else if (in_array($name, $this->obsoleteProperties)) {
+        } else {if (in_array($name, $this->obsoleteProperties)) {
             return;
         } else {
             if (is_object($value) && method_exists($value, $name)) {
@@ -1317,7 +1297,7 @@ class Smarty extends Smarty_Internal_TemplateBase
             } else {
                 trigger_error('Undefined property: ' . get_class($this) . '::$' . $name, E_USER_NOTICE);
             }
-        }
+        }}
     }
 
     /**

programming_language: PHP
filename: smarty_security.php
change_type: ModificationType.MODIFY
diff: @@ -652,7 +652,7 @@ class Smarty_Security
             // remember the directory to add it to _resource_dir in case we're successful
             $_directory[ $directory ] = true;
            // bubble up one level
-            $directory = preg_replace('#[\\\\/][^\\\\/]+[\\\\/]$#', '/', $directory);
+            $directory = preg_replace('#[\\\\/][^\\\\/]+[\\\\/]$#', DIRECTORY_SEPARATOR, $directory);
         }
     }
 

programming_language: PHP