← All changes | framework/base/class-view.php +33 -12 5.5.1 → 6.3.0 View file →

		@@ -50,9 +50,9 @@
50	50
51	51	/**
52	52	* Constructor to set the base path of the view.
53	53	*
54		- * @param mixed $base_path The base path of the view.
	54	+ * @param mixed $base_path The base path of the view.
55	55	*/
56	56	public function __construct( $base_path ) {
57	57	$this->base_path = $base_path;
58	58	}
		@@ -60,19 +60,24 @@
60	60	/**
61	61	* Render a view file. This will be used to render a whole page.
62	62	* If a layout is defined, then we will render layout + view.
63	63	*
64		- * @param string $view The name of the view file to render.
65		- * @param array $params An optional array of parameters to pass to the view file.
	64	+ * @param string $view The name of the view file to render.
	65	+ * @param array $params An optional array of parameters to pass to the view file.
66	66	*
67	67	* @return string
68	68	*/
69	69	public function render( $view, $params = array() ) {
70	70	$view_file = $this->base_path . DIRECTORY_SEPARATOR . $view . '.php';
71		- if ( is_file( $view_file ) ) {
72		- $content = $this->render_php_file( $view_file, $params );
	71	+ $real_base = realpath( $this->base_path );
	72	+ $real_file = realpath( $view_file );
73	73
74		- return $content;
	74	+ if ( false !== $real_base && false !== $real_file && str_starts_with(
	75	+ $real_file,
	76	+ rtrim( $real_base, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR
	77	+ ) && is_file( $real_file )
	78	+ ) {
	79	+ return $this->render_php_file( $real_file, $params );
75	80	}
76	81
77	82	return '';
78	83	}
		@@ -79,20 +84,36 @@
79	84
80	85	/**
81	86	* Renders a PHP file and returns its output.
82	87	*
83		- * @param string $file The path to the PHP file to render.
84		- * @param array $params An optional array of parameters to pass to the PHP file.
	88	+ * @param string $_view_file_path_ The path to the PHP file to render.
	89	+ * @param array $params An optional array of parameters to pass to the PHP file.
85	90	*
86	91	* @return string The output of the rendered PHP file.
87	92	*/
88		- private function render_php_file( $file, $params = array() ) {
	93	+ private function render_php_file( $_view_file_path_, $params = array() ) {
89	94	ob_start();
90	95	ob_implicit_flush( false );
91		- foreach ( $params as $key => $value ) {
92		- $$key = $value;
	96	+ $reserved_names = array(
	97	+ '_view_file_path_',
	98	+ 'params',
	99	+ 'param_name',
	100	+ 'param_value',
	101	+ 'reserved_names',
	102	+ 'GLOBALS',
	103	+ 'this',
	104	+ );
	105	+ foreach ( $params as $param_name => $param_value ) {
	106	+ if (
	107	+ is_string( $param_name )
	108	+ && preg_match( '/^[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*$/', $param_name )
	109	+ && ! in_array( $param_name, $reserved_names, true )
	110	+ ) {
	111	+ ${$param_name} = $param_value;
	112	+ }
93	113	}
94		- require $file;
	114	+ unset( $param_name, $param_value, $reserved_names );
	115	+ require $_view_file_path_;
95	116
96	117	return ob_get_clean();
97	118	}
98	119	}