Re: [Postfixadmin-devel] big merge/commit of smarty branch into?trunk

[David G. <da...@co...>]

Christian Boltz wrote :
> Hello,
> 
> Am Donnerstag, 5. November 2009 schrieb David Goodwin:
> [templates_c]
> > a) setup.php has a check to see whether it exists and is writeable
> 
> Good idea. Just try to write some text to a test file ;-)
> 
> > b) if templates_c is not writeable, 
> 
> Then display an error message ;-)
> 
> > we use e.g. /tmp/?
> 
> Please don't do this. The filenames in templates_c are predictable and 
> therefore at the risk of symlink attacks.
> 
> BTW: Is there a way to make smarty working without the templates_c 
> directory? If yes, it could serve as a fallback solution and the error 
> message could be "just" a warning. (The reduced performance because of 
> the missing cache would be better than blocking everything ;-)
> 

Yes; you can tell it to not compile templates (i.e. re-compile every
template every time etc). No one is likely to notice the performance
hit of this.

David.

-- 
David Goodwin 

[ david at codepoets dot co dot uk ]
[ http://www.codepoets.co.uk       ]