Improved template loading mechanism. bugid:107561

lib/MT.pm

@@ -2178,6 +2178,15 @@ sub template_paths {
         push @paths, File::Spec->catdir( $addon->{path}, 'tmpl' );
     }
 
+    foreach my $sig ( keys %MT::Plugins ) {
+        my $obj = $MT::Plugins{$sig}{object};
+        next if $obj && !$obj->isa('MT::Plugin');
+
+        my $full_path = $obj->{full_path};
+        push @paths, File::Spec->catdir( $full_path, 'tmpl' )
+            if -d $full_path;
+    }
+
     push @paths, File::Spec->catdir( $path, $mt->{template_dir} )
         if $mt->{template_dir};
     push @paths, $path;

lib/MT/Template.pm

@@ -167,28 +167,39 @@ sub new_string {
 sub load_file {
     my $tmpl = shift;
     my ($file) = @_;
-    die 'Template load error'
-        if $file =~ /\.\./;
-
-    if ( File::Spec->file_name_is_absolute($file) ) {
-        require Cwd;
-        my $ok            = 0;
-        my @paths         = @{ $tmpl->{include_path} || [] };
-        my $abs_file_path = MT::Util::realpath($file);
-        foreach my $path (@paths) {
-            next unless -d $path;
-            my $abs_path = MT::Util::realpath($path);
-            $ok = 1, last if $abs_file_path =~ /^\Q$abs_path\E/;
-        }
-        die "Template load error" unless $ok;
-    }
-    else {
+
+    # If file is not absolute path, try to load
+    # the file from include path.
+    unless ( File::Spec->file_name_is_absolute($file) ) {
         my @paths = @{ $tmpl->{include_path} || [] };
         foreach my $path (@paths) {
             my $test_file = File::Spec->catfile( $path, $file );
-            $file = $test_file, last if -f $test_file;
+            $test_file = MT::Util::canonicalize_path($test_file);
+            $test_file = MT::Util::realpath($test_file);
+            $file      = $test_file, last if -f $test_file;
         }
+        die MT->translate( "Template load error: [_1]",
+            MT->translate( "No such file or directory: '[_1]'", $file ) )
+            unless File::Spec->file_name_is_absolute($file);
+    }
+
+    require Cwd;
+    my $ok            = 0;
+    my @paths         = @{ $tmpl->{include_path} || [] };
+    my $abs_file_path = MT::Util::canonicalize_path($file);
+    $abs_file_path = MT::Util::realpath($abs_file_path);
+    foreach my $path (@paths) {
+        next unless -d $path;
+        my $abs_path = MT::Util::realpath($path);
+        $ok = 1, last if $abs_file_path =~ /^\Q$abs_path\E/;
     }
+    die MT->translate(
+        "Template load error: [_1]",
+        MT->translate(
+            "Tried to load the file from outside of the include path '[_1]'",
+            $file
+        )
+    ) unless $ok;
 
     return $tmpl->trans_error( "File not found: [_1]", $file )
         unless -e $file;

lib/MT/Util.pm

@@ -28,7 +28,7 @@ our @EXPORT_OK
     epoch2ts ts2epoch escape_unicode unescape_unicode
     sax_parser expat_parser libxml_parser trim ltrim rtrim asset_cleanup caturl multi_iter
     weaken log_time make_string_csv browser_language sanitize_embed
-    extract_url_path break_up_text dir_separator deep_do deep_copy realpath);
+    extract_url_path break_up_text dir_separator deep_do deep_copy realpath canonicalize_path);
 
 {
     my $Has_Weaken;
@@ -1509,7 +1509,7 @@ sub discover_tb {
         'pdd' => {
             name    => 'PublicDomainDedication',
             permits => [qw( Reproduction Distribution DerivativeWorks )],
-         },
+        },
     );
 
     sub cc_url {
@@ -2673,6 +2673,42 @@ sub realpath {
     return $abs_path;
 }
 
+sub canonicalize_path {
+    my $path  = shift;
+    my @parts = ();
+
+    require Cwd;
+    $path = Cwd::abs_path($path)
+        unless File::Spec->file_name_is_absolute($path);
+
+    require File::Spec;
+    my ( $vol, $dirs, $filename ) = File::Spec->splitpath($path);
+    my @paths = File::Spec->splitdir($dirs);
+    @parts = ('');
+
+    foreach my $path (@paths) {
+        if ( $path eq File::Spec->updir ) {
+            if ( @parts == 0 ) {
+                @parts = ( File::Spec->updir );
+            }
+            elsif ( @parts == 1 and '' eq $parts[0] ) {
+                return undef;
+            }
+            elsif ( $parts[$#parts] eq File::Spec->updir ) {
+                push @parts, File::Spec->updir;
+            }
+            else {
+                pop @parts;
+            }
+        }
+        elsif ( $path and $path ne File::Spec->curdir ) {
+            push @parts, $path;
+        }
+    }
+    $path = (@parts) ? join( dir_separator(), @parts ) : '.';
+    return File::Spec->catfile( $path, $filename );
+}
+
 package MT::Util::XML::SAX::LexicalHandler;
 
 sub start_dtd {
@@ -2884,6 +2920,10 @@ Wrapper method to Cwd::realpath which returns true real path.
 Why? Because on Windows, Cwd::realpath returns wrong value.
 (died, or change path separator from backslash to slash)
 
+=head2 canonicalize_path
+
+Returns canonical path
+
 =head1 AUTHOR & COPYRIGHTS
 
 Please see the I<MT> manpage for author, copyright, and license information.

t/08-util.t

@@ -21,7 +21,7 @@ use MT::Util qw( start_end_day start_end_week start_end_month start_end_year
                  sax_parser trim ltrim rtrim asset_cleanup caturl multi_iter
                  weaken log_time make_string_csv browser_language sanitize_embed
                  extract_url_path break_up_text dir_separator deep_do
-                 deep_copy );
+                 deep_copy canonicalize_path );
 use MT::I18N qw( encode_text );
 use strict;
 
@@ -536,4 +536,16 @@ ok(dir_separator(), 'dir_separator()');
     ok($data->[0] = $copied->[0], 'not deep copied');
 }
 
+{
+    my $path;
+    $path= '/foo/bar/baz';
+    is( canonicalize_path( $path ), '/foo/bar/baz', 'Already canonicalized(abs)' );
+    $path= 't/../t/08-util.t';
+    is( canonicalize_path( $path ), File::Spec->catdir( Cwd::getcwd, 't', '08-util.t' ), 'Already canonicalized(rel)' );
+    $path= '/foo/../bar/baz';
+    is( canonicalize_path( $path ), '/bar/baz', '.. including' );
+
+
+}
+
 done_testing();