Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Output from false condition #392

Closed
Stadly opened this issue Oct 9, 2017 · 12 comments
Closed

Output from false condition #392

Stadly opened this issue Oct 9, 2017 · 12 comments

Comments

@Stadly
Copy link

Stadly commented Oct 9, 2017

Consider the following smarty template.

{"{if false}"|cat:'foo'|cat:"{/if}"}

It is compiled into the following php template.

ob_start();
if (false) {
$_prefixVariable1=ob_get_clean();
ob_start();
}
$_prefixVariable2=ob_get_clean();
echo (($_prefixVariable1).('foo')).($_prefixVariable2);
}

When the compiled template is run, foo is output, even though it should only be output when the condition is true (which it isn't).

Note: running this template also generates an error: Notice: Undefined variable: _prefixVariable1, but that issue is already reported here: #391

@uwetews
Copy link
Contributor

uwetews commented Oct 9, 2017

Why don't you use the {eval} tag which has been designed for such use case.

{eval '{if true}'|cat:'foo'|cat:'{/if}'}

@Stadly
Copy link
Author

Stadly commented Oct 9, 2017

Thanks. There are probably lots of other ways to do it, but I just wanted to make you aware that this doesn't work. In my opinion, it should either produce a compilation error, or give the expected result of no output.

@uwetews
Copy link
Contributor

uwetews commented Oct 9, 2017

Yes, I will look into it ASAP

@AnrDaemon
Copy link
Contributor

May I ask, what was the original intention of such code?

@Stadly
Copy link
Author

Stadly commented Oct 10, 2017

@AnrDaemon Actually, I just discovered this issue when trying to make a minimal example for issue #391. So there was no intention behind this code other than that.

@AnrDaemon
Copy link
Contributor

AnrDaemon commented Oct 10, 2017

I've seen both reports, but to me, the interpretation of the given template is far from intuitive.
From my naive PoV, the result should've been literal {if false}foo{/if}.

Else it looks much like an implicit reevaluation. Which often could be exploited as a recursion bomb.

@Stadly
Copy link
Author

Stadly commented Oct 10, 2017

@AnrDaemon Sure, {if false}foo{/if} would give the expected result and be much easier to understand.

As I said, I did not actually use this template for anything. Just discovered the issue when making a minimal example.

In order to not mix the issue conversations, please ask on the other issue if you're wondering about the intention of that template.

@AnrDaemon
Copy link
Contributor

No, I mean that I expect the OUTPUT of a provided sample to be LITERAL {if false}foo{/if}. Not a result of its evaluation as a smarty template.

@Stadly
Copy link
Author

Stadly commented Oct 10, 2017

@AnrDaemon Sorry, then I misunderstood you.

The literal {if false}foo{/if} would actually be the output of {'{if false}'|cat:'foo'|cat:'{/if}'}. Note the use of ' instead of ", which makes all the difference. It's kind of similar to the difference between ' and " in php.

@AnrDaemon
Copy link
Contributor

Makes a little bit more sense, thanks for explanation.

@uwetews
Copy link
Contributor

uwetews commented Oct 12, 2017

Smarty does allow to embed tags in double quoted strings like
"something {foo}"
"{if true}foo{/if}" does work also

In case of block tags opening and closing tags must stay in the same double quoted string otherwise it does break the generated PHP code structure and does not make sense anyway.
So your example should result in a syntax error.

@uwetews
Copy link
Contributor

uwetews commented Oct 12, 2017

The master branch has been updated to throw a compiler exception for this condition.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants