Re: [Postfixadmin-devel] big merge/commit of smarty branch into trunk

[Christian B. <pos...@cb...>]

Hello,

Am Donnerstag, 5. November 2009 schrieb David Goodwin:
[templates_c]
> a) setup.php has a check to see whether it exists and is writeable

Good idea. Just try to write some text to a test file ;-)

> b) if templates_c is not writeable, 

Then display an error message ;-)

> we use e.g. /tmp/?

Please don't do this. The filenames in templates_c are predictable and 
therefore at the risk of symlink attacks.

BTW: Is there a way to make smarty working without the templates_c 
directory? If yes, it could serve as a fallback solution and the error 
message could be "just" a warning. (The reduced performance because of 
the missing cache would be better than blocking everything ;-)


Regards,

Christian Boltz
-- 
Ossi-Virus
Güdn tog, isch bün än Häggr aüs Läibzsch un dis is än selbsdprögammirdr
bösardscher Gommbjudrfirus. Do isch nö nit sö vül wäis von döm Gommbjudr
is dis än mänuoöllr Firus. Alsö löschnse bidde ölle Dodein fön de
Fesdpladde und schiggnse disn Firus ön ölle di se genn.
- Dangge für de Midorbeid -