repo_zf1Php7/documentation/manual/en/module_specs/Zend_View-Migration.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- Reviewed: no -->
<sect1 id="zend.view.migration">
    <title>Migrating from Previous Versions</title>

    <para>
        This chapter documents primarily backwards compatibility breaks made in
        Zend_View, and should serve to aid in migration from previous versions.
    </para>

    <sect2 id="zend.view.migration.zf5748">
        <title>Migrating from versions prior to 1.7.5</title>

        <para>
            Prior to the 1.7.5 release, the Zend Framework team was notified of
            a potential Local File Inclusion (LFI) vulnerability in the
            <classname>Zend_View::render()</classname> method. Prior to 1.7.5, the method
            allowed, by default, the ability to specify view scripts that
            included parent directory notation (e.g., "../" or "..\"). This
            opens the possibility for an LFI attack if unfiltered user input is
            passed to the <code>render()</code> method:
        </para>

        <programlisting language="php"><![CDATA[
// Where $_GET['foobar'] = '../../../../etc/passwd'
echo $view->render($_GET['foobar']); // LFI inclusion
]]></programlisting>

        <para>
            <classname>Zend_View</classname> now by default raises an exception when such
            a view script is requested.
        </para>

        <sect3 id="zend.view.migration.zf5748.disabling">
            <title>Disabling LFI protection for the render() method</title>

            <para>
                Since a number of developers reported that they were using such
                notation within their applications that was <emphasis>not</emphasis>
                the result of user input, a special flag was created to allow
                disabling the default protection. You have two methods for doing so:
                by passing the 'lfiProtectionOn' key to the constructor options, or
                by explicitly calling the <code>setLfiProtection()</code> method.
            </para>

            <programlisting language="php"><![CDATA[
// Disabling via constructor
$view = new Zend_View(array('lfiProtectionOn' => false));

// Disabling via exlicit method call:
$view = new Zend_View();
$view->setLfiProtection(false);
]]></programlisting>
        </sect3>
    </sect2>
</sect1>
<!--
vim:se ts=4 sw=4 et:
-->