diff --git a/library/Rain/Tpl.php b/library/Rain/Tpl.php index acf9318..b060bda 100644 --- a/library/Rain/Tpl.php +++ b/library/Rain/Tpl.php @@ -121,7 +121,7 @@ public function draw($templateFilePath, $toString = FALSE) { extract($this->var); // Merge local and static configurations $this->config = $this->objectConf + static::$conf; - + ob_start(); require $this->checkTemplate($templateFilePath); $html = ob_get_clean(); @@ -533,9 +533,9 @@ protected function compileTemplate($code, $isString, $templateBasedir, $template //get the included template $includeTemplate = $actualFolder . $this->varReplace($matches[1], $loopLevel); - // reduce the path + // reduce the path $includeTemplate = Tpl::reducePath( $includeTemplate ); - + //dynamic include $parsedCode .= 'checkTemplate("' . $includeTemplate . '");?>'; @@ -695,7 +695,7 @@ protected function compileTemplate($code, $isString, $templateBasedir, $template } // registered tags else { - + $found = FALSE; foreach (static::$registered_tags as $tags => $array) { if (preg_match_all('/' . $array['parse'] . '/', $html, $matches)) { @@ -764,11 +764,17 @@ protected function varReplace($html, $loopLevel = NULL, $escape = TRUE, $echo = $html = str_replace($matches[0][$i], $rep, $html); } + // add "safe" modifier to skip html escaping + if($this->config['auto_escape'] && $escape && !preg_match('/\$.*=.*/', $html) && (preg_match('/\|safe$/', $html) || preg_match('/\|safe\|/', $html))) { + $escape = false; + $html = preg_replace(array('/\|safe\|/', '/\|safe$/'), array('|', ''), $html); + } + // update modifier $html = $this->modifierReplace($html); // if does not initialize a value, e.g. {$a = 1} - if (!preg_match('/\$.*=.*/', $html)) { + if (!preg_match('/\$.*[^<>=!]=[^>].*/', $html)) { // escape character if ($this->config['auto_escape'] && $escape) @@ -790,7 +796,7 @@ protected function conReplace($html) { } protected function modifierReplace($html) { - + $this->blackList($html); if (strpos($html,'|') !== false && substr($html,strpos($html,'|')+1,1) != "|") { preg_match('/([\$a-z_A-Z0-9\(\),\[\]"->]+)\|([\$a-z_A-Z0-9\(\):,\[\]"->]+)/i', $html,$result);