smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-08-03 01:44:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Do not auto-html-escape custom function results.

Browse Source 
Fixes #906
This behavior is under-defined though. This requires some clear documentation.
This commit is contained in:
Simon Wisselink
2023-09-21 23:52:45 +02:00
parent 26332c9de4
commit 134e7074ce
2 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Compiler/Template.php
View File

@@ -1140,7 +1140,7 @@ class Template extends BaseCompiler {
if ($this->smarty->getFunctionHandler($base_tag)) { if ($this->smarty->getFunctionHandler($base_tag)) {
if (!isset($this->smarty->security_policy) || $this->smarty->security_policy->isTrustedTag($base_tag, $this)) { if (!isset($this->smarty->security_policy) || $this->smarty->security_policy->isTrustedTag($base_tag, $this)) {
return (new \Smarty\Compile\PrintExpressionCompiler())->compile( return (new \Smarty\Compile\PrintExpressionCompiler())->compile(
[], ['nofilter'], // functions are never auto-escaped
$this, $this,
['value' => $this->compileFunctionCall($base_tag, $args, $parameter)] ['value' => $this->compileFunctionCall($base_tag, $args, $parameter)]
); );

31
tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php
View File

@@ -30,4 +30,35 @@ class AutoEscapeTest extends PHPUnit_Smarty
$tpl->assign('foo', '<a@b.c>'); $tpl->assign('foo', '<a@b.c>');
$this->assertEquals("&lt;a@b.c&gt;", $this->smarty->fetch($tpl)); $this->assertEquals("&lt;a@b.c&gt;", $this->smarty->fetch($tpl));
} }
/**
* test 'escapeHtml' property
* @group issue906
*/
public function testAutoEscapeDoesNotEscapeFunctionPlugins()
{
$this->smarty->registerPlugin(
\Smarty\Smarty::PLUGIN_FUNCTION,
'horizontal_rule',
function ($params, $smarty) { return "<hr>"; }
);
$tpl = $this->smarty->createTemplate('eval:{horizontal_rule}');
$this->assertEquals("<hr>", $this->smarty->fetch($tpl));
}
/**
* test 'escapeHtml' property
* @group issue906
*/
public function testAutoEscapeDoesNotEscapeBlockPlugins()
{
$this->smarty->registerPlugin(
\Smarty\Smarty::PLUGIN_BLOCK,
'paragraphify',
function ($params, $content) { return $content == null ? null : "<p>".$content."</p>"; }
);
$tpl = $this->smarty->createTemplate('eval:{paragraphify}hi{/paragraphify}');
$this->assertEquals("<p>hi</p>", $this->smarty->fetch($tpl));
}
} }