bug while loading included template defined by relative path {file include='../../path/to/somewhere/template.tpl'}

[GoogleCodeExporter]

Dear all,
I've found bug described bellow:

What steps will reproduce the problem?
1. template path is defined with trailing '/' character
2. {file include='../../path/to/somewhere/template.tpl'} is used
3. Smarty_Resource::buildFilepath() produces relative full path 
/project_path/subdir//templates/../../path/to/somewhere/template.tpl
which is interpreted by Smarty_Resource::normalizePath() as
/project_path/subdir/path/to/somewhere/template.tpl band should be 
/project_path/path/to/somewhere/template.tpl. The problem is double slash 
occuring in the template full relative path.

What is the expected output? What do you see instead?
Exception (partial) output:
Unable to load template file '../../path/to/somewhere/template.tpl' in 
'parent_template.tpl'
#0 
/var/www/smartytest/lib/Smarty-3.1.16/libs/sysplugins/smarty_internal_template.p
hp(284): Smarty_Internal_TemplateBase->fetch(NULL, NULL, NULL, NULL, false, 
false, true)
...

What version of the product are you using? On what operating system?
last stable - 3.1.16, linux

Please provide any additional information below.

Please let me suggest to fix it in a similar way:

--- a/lib/Smarty-3.1.16/libs/sysplugins/smarty_resource.php
+++ b/lib/Smarty-3.1.16/libs/sysplugins/smarty_resource.php
@@ -228,6 +228,11 @@ abstract class Smarty_Resource
                 $file = getcwd() . DS . $file;
             }
         }
+        
+        $doubleSlash = strpos($file, '//');
+        if ($doubleSlash) {
+            $file = str_replace('//', '/', $file); // perhaps it can be used 
without if
+        }

         // resolve relative path
         if (!preg_match('/^([\/\\\\]|[a-zA-Z]:[\/\\\\])/', $file)) {
@@ -243,7 +248,7 @@ abstract class Smarty_Resource
         if (DS != '/') {
             // don't we all just love windows?
             $_path = str_replace('/', '\\', $_path);
         }

Thanks

Regards

David

Original issue reported on code.google.com by david.bu...@gmail.com on 12 Feb 2014 at 4:32

[GoogleCodeExporter]

How did you setup your template dir?
The setTemplateDir() and addTemplateDir() methods do sanitize trailing slashes.

Original comment by Uwe.Tews@googlemail.com on 12 Feb 2014 at 10:55

[GoogleCodeExporter]

It's relatively old project, thus property settings are used for class public 
variables directly such as $smarty->template_dir = '<template_path>'. It was 
originaly based on Smarty version 2.x, then upgraded to 3.0.8 - fully 
functional. Now I've tried to to upgrade to version 3.1.16 but I had to switch 
it back - it dit not work in many cases. Ok, we need need to refactor and 
rewrite that old code, but it is easier to use older version now, stable in 
these conditions.
addTemplateDir() method was used there, but setTemplateDir() not. Let me ask - 
wouldn't be better to completely turn off backwards compatibility with 2.x 
version and change public variables such as template_dir, compile_dir, 
plugin_dir to protected ?

Original comment by david.bu...@gmail.com on 13 Feb 2014 at 5:41

[GoogleCodeExporter]

The directory variables are declared private. If you use $smarty->template_dir 
= $foo;
the setter setTemplateDir is called automatically. Looking at your example it 
seems that you had no trailing / but a // in the middle of the path used  to 
set up template_dir, right?

Original comment by Uwe.Tews@googlemail.com on 16 Feb 2014 at 4:25

[GoogleCodeExporter]

The __call() method for handling setTemplateDir() setter is implemented there - 
ok, I didn't notice before, sorry for that. We're using smarty template engine 
as a black box - it was working, nobody didn't care about the code inside. Yes, 
you're right, what I remember, template path is composed from project dir path 
(with trailing '/') + '/template/' string. I agree with you, it's not precise 
at all, but it is not problem in many cases, because /path/to//somewhere is 
interpreted as /path/to/somewhere. Problematic is only the template include 
defined by relative path starting with '../..', that is interpreted in the way 
described above (3. step reproducing the problem). Maybe somebody else has 
similar problem - it's the reason why I decided to give you feedback.

Best Regards

David

Original comment by david.bu...@gmail.com on 16 Feb 2014 at 7:48

[GoogleCodeExporter]

I agree that it is a potential problem. At first I looked for a problem with a 
trailing slash in in the template path and could not see where there should be 
a problem. Now I see that it does popup when there is a // somewhere in the 
path.
I will see that we sanitize the template_dir path in a better way.

So thanks for bringing it up.

Original comment by Uwe.Tews@googlemail.com on 16 Feb 2014 at 6:07

• Changed state: Accepted

[GoogleCodeExporter]

The fix is now in the SVN trunk and will later be included 3.1.17

Original comment by Uwe.Tews@googlemail.com on 16 Feb 2014 at 6:41

• Changed state: Fixed