Verzeichnisstruktur phpBB-3.3.16
- Veröffentlicht
- 27.04.2026
So funktioniert es
|
|
Auf das letzte Element klicken. Dies geht jeweils ein Schritt zurück |
Auf das Icon klicken, dies öffnet das Verzeichnis. Nochmal klicken schließt das Verzeichnis. |
|
|
(Beispiel Datei-Icons)
|
Auf das Icon klicken um den Quellcode anzuzeigen |
SecurityPolicy.php
001 <?php
002
003 /*
004 * This file is part of Twig.
005 *
006 * (c) Fabien Potencier
007 *
008 * For the full copyright and license information, please view the LICENSE
009 * file that was distributed with this source code.
010 */
011
012 namespace Twig\Sandbox;
013
014 use Twig\Markup;
015 use Twig\Template;
016
017 /**
018 * Represents a security policy which need to be enforced when sandbox mode is enabled.
019 *
020 * @author Fabien Potencier <fabien@symfony.com>
021 */
022 final class SecurityPolicy implements SecurityPolicyInterface
023 {
024 private $allowedTags;
025 private $allowedFilters;
026 private $allowedMethods;
027 private $allowedProperties;
028 private $allowedFunctions;
029
030 public function __construct(array $allowedTags = [], array $allowedFilters = [], array $allowedMethods = [], array $allowedProperties = [], array $allowedFunctions = [])
031 {
032 $this->allowedTags = $allowedTags;
033 $this->allowedFilters = $allowedFilters;
034 $this->setAllowedMethods($allowedMethods);
035 $this->allowedProperties = $allowedProperties;
036 $this->allowedFunctions = $allowedFunctions;
037 }
038
039 public function setAllowedTags(array $tags)
040 {
041 $this->allowedTags = $tags;
042 }
043
044 public function setAllowedFilters(array $filters)
045 {
046 $this->allowedFilters = $filters;
047 }
048
049 public function setAllowedMethods(array $methods)
050 {
051 $this->allowedMethods = [];
052 foreach ($methods as $class => $m) {
053 $this->allowedMethods[$class] = array_map(function ($value) { return strtr($value, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'); }, \is_array($m) ? $m : [$m]);
054 }
055 }
056
057 public function setAllowedProperties(array $properties)
058 {
059 $this->allowedProperties = $properties;
060 }
061
062 public function setAllowedFunctions(array $functions)
063 {
064 $this->allowedFunctions = $functions;
065 }
066
067 public function checkSecurity($tags, $filters, $functions)
068 {
069 foreach ($tags as $tag) {
070 if (!\in_array($tag, $this->allowedTags)) {
071 throw new SecurityNotAllowedTagError(sprintf('Tag "%s" is not allowed.', $tag), $tag);
072 }
073 }
074
075 foreach ($filters as $filter) {
076 if (!\in_array($filter, $this->allowedFilters)) {
077 throw new SecurityNotAllowedFilterError(sprintf('Filter "%s" is not allowed.', $filter), $filter);
078 }
079 }
080
081 foreach ($functions as $function) {
082 if (!\in_array($function, $this->allowedFunctions)) {
083 throw new SecurityNotAllowedFunctionError(sprintf('Function "%s" is not allowed.', $function), $function);
084 }
085 }
086 }
087
088 public function checkMethodAllowed($obj, $method)
089 {
090 if ($obj instanceof Template || $obj instanceof Markup) {
091 return;
092 }
093
094 $allowed = false;
095 $method = strtr($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');
096 foreach ($this->allowedMethods as $class => $methods) {
097 if ($obj instanceof $class && \in_array($method, $methods)) {
098 $allowed = true;
099 break;
100 }
101 }
102
103 if (!$allowed) {
104 $class = \get_class($obj);
105 throw new SecurityNotAllowedMethodError(sprintf('Calling "%s" method on a "%s" object is not allowed.', $method, $class), $class, $method);
106 }
107 }
108
109 public function checkPropertyAllowed($obj, $property)
110 {
111 $allowed = false;
112 foreach ($this->allowedProperties as $class => $properties) {
113 if ($obj instanceof $class && \in_array($property, \is_array($properties) ? $properties : [$properties])) {
114 $allowed = true;
115 break;
116 }
117 }
118
119 if (!$allowed) {
120 $class = \get_class($obj);
121 throw new SecurityNotAllowedPropertyError(sprintf('Calling "%s" property on a "%s" object is not allowed.', $property, $class), $class, $property);
122 }
123 }
124 }
125
126 class_alias('Twig\Sandbox\SecurityPolicy', 'Twig_Sandbox_SecurityPolicy');
127