mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-01-17 22:28:46 +01:00
Code Issues Releases Wiki Activity

[ticket/16967] Remove support for INCLUDEPHP and PHP/ENDPHP in templates

Browse Source 
PHPBB3-16967
This commit is contained in:
Marc Alexander 2022-02-21 21:24:25 +01:00
parent 8284dc2c10
commit d868dbe3aa
No known key found for this signature in database
GPG Key ID: 50E0D2423696F995
20 changed files with 36 additions and 441 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
phpBB/docs/coding-guidelines.html
View File

@ -1302,24 +1302,6 @@ parent = prosilver</pre>
<span class="comment">&lt;!-- INCLUDE {$SOME_VAR} --&gt;</span>
</pre></div>
<h4>PHP</h4>
<p><strong class="error">The use of PHP in HTML files has been deprected in phpBB 3.3 and will be removed in phpBB 4.0.</strong></p>
<p>A contentious decision has seen the ability to include PHP within the template introduced. This is achieved by enclosing the PHP within relevant tags:</p>
<div class="codebox"><pre>
<span class="comment">&lt;!-- PHP --&gt;</span>
echo &quot;hello!&quot;;
<span class="comment">&lt;!-- ENDPHP --&gt;</span>
</pre></div>
<p>You may also include PHP from an external file using:</p>
<div class="codebox"><pre>
<span class="comment">&lt;!-- INCLUDEPHP somefile&#46;php --&gt;</span>
</pre></div>
<p>it will be included and executed inline.<br /><br />A note, it is very much encouraged that template designers do not include PHP. The ability to include raw PHP was introduced primarily to allow end users to include banner code, etc. without modifying multiple files (as with 2.0.x). It was not intended for general use ... hence <!-- w --><a href="https://www.phpbb.com">www.phpbb.com</a><!-- w --> will <strong>not</strong> make available template sets which include PHP. And by default templates will have PHP disabled (the admin will need to specifically activate PHP for a template).</p>
<h4>Conditionals/Control structures</h4>
<p>The most significant addition to 3.x are conditions or control structures, &quot;if something then do this else do that&quot;. The system deployed is very similar to Smarty. This may confuse some people at first but it offers great potential and great flexibility with a little imagination. In their most simple form these constructs take the form:</p>

1
phpBB/includes/acp/acp_board.php
View File

@ -428,7 +428,6 @@ class acp_board
'ip_login_limit_max' => array('lang' => 'IP_LOGIN_LIMIT_MAX', 'validate' => 'int:0:999', 'type' => 'number:0:999', 'explain' => true),
'ip_login_limit_time' => array('lang' => 'IP_LOGIN_LIMIT_TIME', 'validate' => 'int:0:99999', 'type' => 'number:0:99999', 'explain' => true, 'append' => ' ' . $user->lang['SECONDS']),
'ip_login_limit_use_forwarded' => array('lang' => 'IP_LOGIN_LIMIT_USE_FORWARDED', 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => true),
'tpl_allow_php' => array('lang' => 'TPL_ALLOW_PHP', 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => true),
'form_token_lifetime' => array('lang' => 'FORM_TIME_MAX', 'validate' => 'int:-1:99999', 'type' => 'number:-1:99999', 'explain' => true, 'append' => ' ' . $user->lang['SECONDS']),
'form_token_sid_guests' => array('lang' => 'FORM_SID_GUESTS', 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => true),

1
phpBB/includes/questionnaire/questionnaire.php
View File

@ -442,7 +442,6 @@ class phpbb_questionnaire_phpbb_data_provider
'smtp_auth_method' => true,
'smtp_delivery' => true,
'topics_per_page' => true,
'tpl_allow_php' => true,
'version' => true,
'warnings_expire_days' => true,
'warnings_gc' => true,

1
phpBB/install/schemas/schema_data.sql
View File

@ -305,7 +305,6 @@ INSERT INTO phpbb_config (config_name, config_value) VALUES ('text_reparser.post
INSERT INTO phpbb_config (config_name, config_value) VALUES ('text_reparser.user_signature_cron_interval', '10');
INSERT INTO phpbb_config (config_name, config_value) VALUES ('text_reparser.user_signature_last_cron', '0');
INSERT INTO phpbb_config (config_name, config_value) VALUES ('topics_per_page', '25');
INSERT INTO phpbb_config (config_name, config_value) VALUES ('tpl_allow_php', '0');
INSERT INTO phpbb_config (config_name, config_value) VALUES ('update_hashes_last_cron', '0');
INSERT INTO phpbb_config (config_name, config_value) VALUES ('update_hashes_lock', '0');
INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_icons_path', 'images/upload_icons');

2
phpBB/language/en/acp/board.php
View File

@ -538,8 +538,6 @@ $lang = array_merge($lang, array(
'REF_PATH' => 'Also validate path',
'REFERRER_VALID' => 'Validate Referrer',
'REFERRER_VALID_EXPLAIN' => 'If enabled, the referrer of POST requests will be checked against the host/script path settings. This may cause issues with boards using several domains and or external logins.',
'TPL_ALLOW_PHP' => 'Allow php in templates',
'TPL_ALLOW_PHP_EXPLAIN' => 'If this option is enabled, <code>PHP</code> and <code>INCLUDEPHP</code> statements will be recognised and parsed in templates.',
));
// Email Settings

36
phpBB/phpbb/db/migration/data/v400/remove_template_php.php Normal file
View File

@ -0,0 +1,36 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\db\migration\data\v400;
use phpbb\db\migration\migration;
class remove_template_php extends migration
{
public function effectively_installed(): bool
{
return !$this->config->offsetExists('tpl_allow_php');
}
public static function depends_on(): array
{
return [
'\phpbb\db\migration\data\v400\dev',
];
}
public function update_data(): array
{
return [['config.remove', ['tpl_allow_php']]];
}
}

2
phpBB/phpbb/template/twig/extension.php
View File

@ -63,8 +63,6 @@ class extension extends \Twig\Extension\AbstractExtension
new \phpbb\template\twig\tokenparser\includejs,
new \phpbb\template\twig\tokenparser\includecss,
new \phpbb\template\twig\tokenparser\event($this->environment),
new \phpbb\template\twig\tokenparser\includephp($this->environment),
new \phpbb\template\twig\tokenparser\php($this->environment),
);
}

6
phpBB/phpbb/template/twig/lexer.php
View File

@ -34,11 +34,8 @@ class lexer extends \Twig\Lexer
'UNDEFINE',*/
'ENDDEFINE',
'INCLUDE',
'INCLUDEPHP',
'INCLUDEJS',
'INCLUDECSS',
'PHP',
'ENDPHP',
'EVENT',
);
@ -79,20 +76,17 @@ class lexer extends \Twig\Lexer
// Fix tokens that may have inline variables (e.g. <!-- DEFINE $TEST = '{FOO}')
$code = $this->strip_surrounding_quotes(array(
'INCLUDE',
'INCLUDEPHP',
'INCLUDEJS',
'INCLUDECSS',
), $code);
$code = $this->fix_inline_variable_tokens(array(
'DEFINE \$[a-zA-Z0-9_]+ =',
'INCLUDE',
'INCLUDEPHP',
'INCLUDEJS',
'INCLUDECSS',
), $code);
$code = $this->add_surrounding_quotes(array(
'INCLUDE',
'INCLUDEPHP',
'INCLUDEJS',
'INCLUDECSS',
), $code);

91
phpBB/phpbb/template/twig/node/includephp.php
View File

@ -1,91 +0,0 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* Sections (c) 2009 Fabien Potencier, Armin Ronacher
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\template\twig\node;
class includephp extends \Twig\Node\Node
{
/** @var \Twig\Environment */
protected $environment;
public function __construct(\Twig\Node\Expression\AbstractExpression $expr, \phpbb\template\twig\environment $environment, $lineno, $ignoreMissing = false, $tag = null)
{
$this->environment = $environment;
parent::__construct(array('expr' => $expr), array('ignore_missing' => (Boolean) $ignoreMissing), $lineno, $tag);
}
/**
* Compiles the node to PHP.
*
* @param \Twig\Compiler A Twig\Compiler instance
*/
public function compile(\Twig\Compiler $compiler)
{
$compiler->addDebugInfo($this);
$config = $this->environment->get_phpbb_config();
if (!$config['tpl_allow_php'])
{
$compiler
->write("// INCLUDEPHP Disabled\n")
;
return;
}
if ($this->getAttribute('ignore_missing'))
{
$compiler
->write("try {\n")
->indent()
;
}
$compiler
->write("\$location = ")
->subcompile($this->getNode('expr'))
->raw(";\n")
->write("if (phpbb_is_absolute(\$location)) {\n")
->indent()
// Absolute path specified
->write("require(\$location);\n")
->outdent()
->write("} else if (file_exists(\$this->env->get_phpbb_root_path() . \$location)) {\n")
->indent()
// PHP file relative to phpbb_root_path
->write("require(\$this->env->get_phpbb_root_path() . \$location);\n")
->outdent()
->write("} else {\n")
->indent()
// Local path (behaves like INCLUDE)
->write("require(\$this->env->getLoader()->getCacheKey(\$location));\n")
->outdent()
->write("}\n")
;
if ($this->getAttribute('ignore_missing'))
{
$compiler
->outdent()
->write("} catch (\Twig\Error\LoaderError \$e) {\n")
->indent()
->write("// ignore missing template\n")
->outdent()
->write("}\n\n")
;
}
}
}

52
phpBB/phpbb/template/twig/node/php.php
View File

@ -1,52 +0,0 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\template\twig\node;
class php extends \Twig\Node\Node
{
/** @var \Twig\Environment */
protected $environment;
public function __construct(\Twig\Node\TextNode $text, \phpbb\template\twig\environment $environment, $lineno, $tag = null)
{
$this->environment = $environment;
parent::__construct(array('text' => $text), array(), $lineno, $tag);
}
/**
* Compiles the node to PHP.
*
* @param \Twig\Compiler A Twig\Compiler instance
*/
public function compile(\Twig\Compiler $compiler)
{
$compiler->addDebugInfo($this);
$config = $this->environment->get_phpbb_config();
if (!$config['tpl_allow_php'])
{
$compiler
->write("// PHP Disabled\n")
;
return;
}
$compiler
->raw($this->getNode('text')->getAttribute('data'))
;
}
}

68
phpBB/phpbb/template/twig/tokenparser/includephp.php
View File

@ -1,68 +0,0 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @copyright Portions (c) 2009 Fabien Potencier, Armin Ronacher
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\template\twig\tokenparser;
class includephp extends \Twig\TokenParser\AbstractTokenParser
{
/** @var \phpbb\template\twig\environment */
protected $environment;
/**
* Constructor
*
* @param \phpbb\template\twig\environment $environment
*/
public function __construct(\phpbb\template\twig\environment $environment)
{
$this->environment = $environment;
}
/**
* Parses a token and returns a node.
*
* @param \Twig\Token $token A Twig\Token instance
*
* @return \Twig\Node\Node A Twig\Node instance
*/
public function parse(\Twig\Token $token)
{
$expr = $this->parser->getExpressionParser()->parseExpression();
$stream = $this->parser->getStream();
$ignoreMissing = false;
if ($stream->test(\Twig\Token::NAME_TYPE, 'ignore'))
{
$stream->next();
$stream->expect(\Twig\Token::NAME_TYPE, 'missing');
$ignoreMissing = true;
}
$stream->expect(\Twig\Token::BLOCK_END_TYPE);
return new \phpbb\template\twig\node\includephp($expr, $this->environment, $token->getLine(), $ignoreMissing, $this->getTag());
}
/**
* Gets the tag name associated with this token parser.
*
* @return string The tag name
*/
public function getTag()
{
return 'INCLUDEPHP';
}
}

65
phpBB/phpbb/template/twig/tokenparser/php.php
View File

@ -1,65 +0,0 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\template\twig\tokenparser;
class php extends \Twig\TokenParser\AbstractTokenParser
{
/** @var \phpbb\template\twig\environment */
protected $environment;
/**
* Constructor
*
* @param \phpbb\template\twig\environment $environment
*/
public function __construct(\phpbb\template\twig\environment $environment)
{
$this->environment = $environment;
}
/**
* Parses a token and returns a node.
*
* @param \Twig\Token $token A Twig\Token instance
*
* @return \Twig\Node\Node A Twig\Node instance
*/
public function parse(\Twig\Token $token)
{
$stream = $this->parser->getStream();
$stream->expect(\Twig\Token::BLOCK_END_TYPE);
$body = $this->parser->subparse(array($this, 'decideEnd'), true);
$stream->expect(\Twig\Token::BLOCK_END_TYPE);
return new \phpbb\template\twig\node\php($body, $this->environment, $token->getLine(), $this->getTag());
}
public function decideEnd(\Twig\Token $token)
{
return $token->test('ENDPHP');
}
/**
* Gets the tag name associated with this token parser.
*
* @return string The tag name
*/
public function getTag()
{
return 'PHP';
}
}

10
tests/template/extension_test.php
View File

@ -264,16 +264,6 @@ class phpbb_template_extension_test extends phpbb_template_template_test_case
'',
[]
],
[
'extension_config_test.html',
[
'config_name' => 'tpl_allow_php',
],
[],
[],
'',
[]
],
];
}

62
tests/template/includephp_test.php
View File

@ -1,62 +0,0 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
use phpbb\filesystem\helper as filesystem_helper;
require_once __DIR__ . '/template_test_case.php';
class phpbb_template_includephp_test extends phpbb_template_template_test_case
{
public function test_includephp_relative()
{
$this->setup_engine(array('tpl_allow_php' => true));
$this->run_template('includephp_relative.html', array(), array(), array(), "Path is relative to board root.\ntesting included php");
$this->template->set_filenames(array('test' => 'includephp_relative.html'));
$this->assertEquals("Path is relative to board root.\ntesting included php", $this->display('test'), "Testing INCLUDEPHP");
}
public function test_includephp_variables()
{
$this->setup_engine(array('tpl_allow_php' => true));
$this->run_template('includephp_variables.html', array('TEMPLATES' => 'templates'), array(), array(), "Path includes variables.\ntesting included php");
$this->template->set_filenames(array('test' => 'includephp_variables.html'));
$this->assertEquals("Path includes variables.\ntesting included php", $this->display('test'), "Testing INCLUDEPHP");
}
public function test_includephp_absolute()
{
global $phpbb_root_path;
$path_to_php = str_replace('\\', '/', __DIR__) . '/templates/_dummy_include.php.inc';
$this->assertTrue(filesystem_helper::is_absolute_path($path_to_php));
$template_text = "Path is absolute.\n<!-- INCLUDEPHP $path_to_php -->";
$cache_dir = $phpbb_root_path . 'cache/';
$fp = fopen($cache_dir . 'includephp_absolute.html', 'w');
fputs($fp, $template_text);
fclose($fp);
$this->setup_engine(array('tpl_allow_php' => true));
$this->template->set_custom_style('tests', $cache_dir);
$this->run_template('includephp_absolute.html', array(), array(), array(), "Path is absolute.\ntesting included php");
$this->template->set_filenames(array('test' => 'includephp_absolute.html'));
$this->assertEquals("Path is absolute.\ntesting included php", $this->display('test'), "Testing INCLUDEPHP");
}
}

31
tests/template/subdir/includephp_from_subdir_test.php
View File

@ -1,31 +0,0 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
require_once __DIR__ . '/../template_test_case.php';
class phpbb_template_subdir_includephp_from_subdir_test extends phpbb_template_template_test_case
{
// Exact copy of test_includephp_relatve from ../includephp_test.php.
// Verifies that relative php inclusion works when including script
// (and thus current working directory) is in a subdirectory of
// board root.
public function test_includephp_relative()
{
$this->setup_engine(array('tpl_allow_php' => true));
$this->run_template('includephp_relative.html', array(), array(), array(), "Path is relative to board root.\ntesting included php");
$this->template->set_filenames(array('test' => 'includephp_relative.html'));
$this->assertEquals("Path is relative to board root.\ntesting included php", $this->display('test'), "Testing INCLUDEPHP");
}
}

25
tests/template/template_test.php
View File

@ -256,13 +256,6 @@ class phpbb_template_template_test extends phpbb_template_template_test_case
. str_repeat("pass\n", 3) . "\n"
. str_repeat("pass\n", 2) . "\n"),
),
array(
'php.html',
array(),
array(),
array(),
'',
),
array(
'include.html',
array('VARIABLE' => 'value'),
@ -644,24 +637,6 @@ class phpbb_template_template_test extends phpbb_template_template_test_case
$this->assertEquals(array('POSITION' => 'O3M2', 'ONE' => true, 'TWO' => 'two', 'THREE' => 3), $this->template->retrieve_block_vars('outer[2].middle[1]', array()), 'Retrieve all vars from a block in the template');
}
public function test_php()
{
global $phpbb_root_path;
$template_text = '<!-- PHP -->echo "test";<!-- ENDPHP -->';
$cache_dir = $phpbb_root_path . 'cache/';
$fp = fopen($cache_dir . 'php.html', 'w');
fputs($fp, $template_text);
fclose($fp);
$this->setup_engine(array('tpl_allow_php' => true));
$this->template->set_custom_style('tests', $cache_dir);
$this->run_template('php.html', array(), array(), array(), 'test');
}
public function alter_block_array_data()
{
return array(

1
tests/template/template_test_case.php
View File

@ -64,7 +64,6 @@ class phpbb_template_template_test_case extends phpbb_test_case
{
$defaults = array(
'load_tplcompile' => true,
'tpl_allow_php' => false,
);
return $defaults;
}

2
tests/template/templates/includephp_relative.html
View File

@ -1,2 +0,0 @@
Path is relative to board root.
<!-- INCLUDEPHP ../tests/template/templates/_dummy_include.php.inc -->

2
tests/template/templates/includephp_variables.html
View File

@ -1,2 +0,0 @@
Path includes variables.
<!-- INCLUDEPHP ../tests/template/{TEMPLATES}/_dummy_include.php.inc -->

1
tests/template/templates/php.html
View File

@ -1 +0,0 @@
<!-- PHP -->echo "test";<!-- ENDPHP -->