From 472db0b829a18c8f486dd4f39c0375d377574f9d Mon Sep 17 00:00:00 2001 From: mohrt Date: Fri, 29 Jun 2001 19:35:06 +0000 Subject: [PATCH] update release notes --- NEWS | 4 + README | 2 +- RELEASE_NOTES | 14 +- Smarty.addons.php | 904 ++++++++++++++++++++++++++++++++++++++ Smarty.class.php | 10 +- demo/index.php | 1 + demo/templates/debug.tpl | 14 +- demo/templates/header.tpl | 4 + demo/templates/index.tpl | 2 + docs.sgml | 34 +- index.php | 1 + libs/Smarty.class.php | 10 +- templates/debug.tpl | 14 +- templates/header.tpl | 4 + templates/index.tpl | 2 + 15 files changed, 1000 insertions(+), 20 deletions(-) diff --git a/NEWS b/NEWS index cb238f54..ac6c6b08 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,7 @@ + - added overLib functionality (Monte) + - updated debug console with config file vars (Monte) + - added debugging url control (Monte) + - added 'quotes' type to escape modifier (Monte, Mike Krus) - added 'total' and 'iteration' section properties. (Andrei) - added 'start', 'max', and step section attributes/properties. (Andrei) - fixed a bug with security checking of functions inside {if} tags. (Andrei) diff --git a/README b/README index f64ea7df..7893d4c0 100644 --- a/README +++ b/README @@ -2,7 +2,7 @@ NAME: Smarty - the PHP compiling template engine -VERSION: 1.4.2 +VERSION: 1.4.3 AUTHORS: diff --git a/RELEASE_NOTES b/RELEASE_NOTES index 750c6c09..cf676883 100644 --- a/RELEASE_NOTES +++ b/RELEASE_NOTES @@ -1,7 +1,17 @@ +1.4.4 +----- + +A few bug fixes, debugging console function for control via URL, and overLib +integration. + 1.4.3 ----- -The major additions were the security system and the debugging console. Several -bugs were fixed. See Changelog for more details. + +This release has a few bug fixes and several enhancements. Smarty now supports +template security for third-party template editing. These features disallow the +ability for someone to execute commands or PHP code from the template language. +Smarty also now has a built-in debugging console, which is a javascript pop-up +window that displays all the included template names and assigned variables. 1.4.2 ----- diff --git a/Smarty.addons.php b/Smarty.addons.php index cced0a79..b6b27828 100644 --- a/Smarty.addons.php +++ b/Smarty.addons.php @@ -88,6 +88,10 @@ function smarty_mod_escape($string, $esc_type = 'html') case 'url': return urlencode($string); + case 'quotes': + // escape unescaped single quotes + return preg_replace("%(?_tpl_vars; ksort($assigned_vars); + $config_vars = $smarty_obj->_config[0]; + ksort($config_vars); $included_templates = $smarty_obj->_included_tpls; $smarty_obj->assign("_debug_keys",array_keys($assigned_vars)); $smarty_obj->assign("_debug_vals",array_values($assigned_vars)); + $smarty_obj->assign("_debug_config_keys",array_keys($config_vars)); + $smarty_obj->assign("_debug_config_vals",array_values($config_vars)); $smarty_obj->assign("_debug_tpls",$included_templates); return true; } +/*======================================================================*\ + Function: smarty_func_overlib_init + Purpose: initialize use of overlib +\*======================================================================*/ +function smarty_func_overlib_init($args, &$smarty_obj) { + +?> + + + + + +_trigger_error_msg("overlib: attribute 'text' required"); + return false; + } + + if(empty($trigger)) { $trigger = "onMouseOver"; } + + echo $trigger.'="return overlib(\''.str_replace("'","\'",$text).'\''; + if($sticky) { echo ",STICKY"; } + if(!empty($caption)) { echo ",CAPTION,'".str_replace("'","\'",$caption)."'"; } + if(!empty($fgcolor)) { echo ",FGCOLOR,'$fgcolor'"; } + if(!empty($bgcolor)) { echo ",BGCOLOR,'$bgcolor'"; } + if(!empty($textcolor)) { echo ",TEXTCOLOR,'$textcolor'"; } + if(!empty($capcolor)) { echo ",CAPCOLOR,'$capcolor'"; } + if(!empty($closecolor)) { echo ",CLOSECOLOR,'$closecolor'"; } + if(!empty($textfont)) { echo ",TEXTFONT,'$textfont'"; } + if(!empty($captionfont)) { echo ",CAPTIONFONT,'$captionfont'"; } + if(!empty($closefont)) { echo ",CLOSEFONT,'$closefont'"; } + if(!empty($textsize)) { echo ",TEXTSIZE,'$textsize'"; } + if(!empty($captionsize)) { echo ",CAPTIONSIZE,'$captionsize'"; } + if(!empty($closesize)) { echo ",CLOSESIZE,'$closesize'"; } + if(!empty($width)) { echo ",WIDTH,'$width'"; } + if(!empty($height)) { echo ",HEIGHT,'$height'"; } + if(!empty($left)) { echo ",LEFT"; } + if(!empty($right)) { echo ",RIGHT"; } + if(!empty($center)) { echo ",CENTER"; } + if(!empty($above)) { echo ",ABOVE"; } + if(!empty($below)) { echo ",BELOW"; } + if(!empty($border)) { echo ",BORDER,'$border'"; } + if(!empty($offsetx)) { echo ",OFFSETX,'$offsetx'"; } + if(!empty($offsety)) { echo ",OFFSETY,'$offsetxy'"; } + if(!empty($fgbackground)) { echo ",FGBACKGROUND,'$fgbackground'"; } + if(!empty($bgbackground)) { echo ",BGBACKGROUND,'$bgbackground'"; } + if(!empty($closetext)) { echo ",CLOSETEXT,'".str_replace("'","\'",$closetext)."'"; } + if(!empty($noclose)) { echo ",NOCLOSE"; } + if(!empty($status)) { echo ",STATUS,'".str_replace("'","\'",$status)."'"; } + if(!empty($autostatus)) { echo ",AUTOSTATUS"; } + if(!empty($autostatuscap)) { echo ",AUTOSTATUSCAP"; } + if(!empty($inarray)) { echo ",INARRAY,'$inarray'"; } + if(!empty($caparray)) { echo ",CAPARRAY,'$caparray'"; } + if(!empty($capicaon)) { echo ",CAPICON,'$capicon'"; } + if(!empty($snapx)) { echo ",SNAPX,'$snapx'"; } + if(!empty($snapy)) { echo ",SNAPY,'$snapy'"; } + if(!empty($fixy)) { echo ",FIXY,'$fixy'"; } + if(!empty($background)) { echo ",BACKGROUND,'$background'"; } + if(!empty($padx)) { echo ",PADX,'$padx'"; } + if(!empty($pady)) { echo ",PADY,'$pady'"; } + if(!empty($fullhtml)) { echo ",FULLHTML"; } + if(!empty($frame)) { echo ",FRAME,'$frame'"; } + if(!empty($timeout)) { echo ",TIMEOUT,'$timeout'"; } + if(!empty($function)) { echo ",FUNCTION,'$function'"; } + if(!empty($delay)) { echo ",DELAY,'$delay'"; } + if(!empty($hauto)) { echo ",HAUTO"; } + if(!empty($vauto)) { echo ",VAUTO"; } + echo ');" onMouseOut="nd();"'; + return; +} + /* vim: set expandtab: */ ?> diff --git a/Smarty.class.php b/Smarty.class.php index 4ef52f60..8704ccf4 100644 --- a/Smarty.class.php +++ b/Smarty.class.php @@ -62,7 +62,11 @@ class Smarty var $debugging = false; // enable debugging console true/false var $debug_tpl = 'file:debug.tpl'; // path to debug console template - + var $debugging_ctrl = 'NONE'; // Possible values: + // NONE - no debug control allowed + // URL - enable debugging when keyword + // SMARTY_DEBUG is found in $QUERY_STRING + var $global_assign = array( 'HTTP_SERVER_VARS' => array( 'SCRIPT_NAME' ) ); // variables from the GLOBALS array // that are implicitly assigned @@ -128,6 +132,8 @@ class Smarty 'fetch' => 'smarty_func_fetch', 'counter' => 'smarty_func_counter', 'assign' => 'smarty_func_assign', + 'overlib_init' => 'smarty_func_overlib_init', + 'overlib' => 'smarty_func_overlib', 'assign_debug_info' => 'smarty_func_assign_debug_info' ); @@ -578,7 +584,7 @@ class Smarty if ($display) { if (isset($results)) { echo $results; } - if ($this->debugging) { echo $this->_generate_debug_output(); } + if ($this->debugging || ($this->debugging_ctrl == 'URL' && (!empty($QUERY_STRING) && strstr('SMARTY_DEBUG',$QUERY_STRING)))) { echo $this->_generate_debug_output(); } return; } else { if (isset($results)) { return $results; } diff --git a/demo/index.php b/demo/index.php index 9b751fc5..5acebb36 100644 --- a/demo/index.php +++ b/demo/index.php @@ -5,6 +5,7 @@ require("Smarty.class.php"); $smarty = new Smarty; $smarty->compile_check = true; +$smarty->debugging = true; $smarty->assign("now", time()); diff --git a/demo/templates/debug.tpl b/demo/templates/debug.tpl index 06d7ccb7..6a0fc179 100644 --- a/demo/templates/debug.tpl +++ b/demo/templates/debug.tpl @@ -9,11 +9,21 @@ _smarty_console.document.write("Smarty Debug Console"); _smarty_console.document.write("included templates:"); {section name=templates loop=$_debug_tpls} - _smarty_console.document.write("{section name=indent loop=$_debug_tpls[templates].depth}   {/section}{$_debug_tpls[templates].template}"); + _smarty_console.document.write("{section name=indent loop=$_debug_tpls[templates].depth}   {/section}{$_debug_tpls[templates].template}"); + {sectionelse} + _smarty_console.document.write("no templates included"); {/section} _smarty_console.document.write("assigned template variables:"); {section name=vars loop=$_debug_keys} - _smarty_console.document.write("{$_debug_keys[vars]}{if is_array($_debug_vals[vars])}Array ({$_debug_vals[vars]|@count}){elseif empty($_debug_vals[vars])}no value{else}{$_debug_vals[vars]|truncate:50|regex_replace:"![\r\t\n]!":" "|escape|default:"empty"}{/if}"); + _smarty_console.document.write("{ldelim}${$_debug_keys[vars]}{rdelim}{if is_array($_debug_vals[vars])}Array ({$_debug_vals[vars]|@count}){elseif empty($_debug_vals[vars])}no value{else}{$_debug_vals[vars]|truncate:50|regex_replace:"![\r\t\n]!":" "|escape|default:"empty"}{/if}"); + {sectionelse} + _smarty_console.document.write("no template variables assigned"); + {/section} + _smarty_console.document.write("assigned config file variables (outter template scope):"); + {section name=config_vars loop=$_debug_config_keys} + _smarty_console.document.write("{ldelim}#{$_debug_config_keys[config_vars]}#{rdelim}{if is_array($_debug_config_vals[config_vars])}Array ({$_debug_config_vals[config_vars]|@count}){elseif empty($_debug_config_vals[config_vars])}no value{else}{$_debug_config_vals[config_vars]|truncate:50|regex_replace:"![\r\t\n]!":" "|escape|default:"empty"}{/if}"); + {sectionelse} + _smarty_console.document.write("no config vars assigned"); {/section} _smarty_console.document.write(""); _smarty_console.document.write(""); diff --git a/demo/templates/header.tpl b/demo/templates/header.tpl index 3724c783..24d26fdf 100644 --- a/demo/templates/header.tpl +++ b/demo/templates/header.tpl @@ -1,3 +1,7 @@ + +{tooltip_init} +{tooltip_element id="help" width="200" text="This is an example of a tooltip. Tooltips are handy for context sensitive information."} + {$title} - {$Name} diff --git a/demo/templates/index.tpl b/demo/templates/index.tpl index 109fd991..d6dc7b4d 100644 --- a/demo/templates/index.tpl +++ b/demo/templates/index.tpl @@ -9,6 +9,8 @@ Title: {#title#|capitalize} {if #bold#}{/if} +Tooltip example: Move your mouse over the Help link to see a tooltip pop-up. + the value of $SCRIPT_NAME is {$SCRIPT_NAME} {* A simple variable test. print $Name in uppercase *} diff --git a/docs.sgml b/docs.sgml index 41907cd7..86c9d670 100644 --- a/docs.sgml +++ b/docs.sgml @@ -309,6 +309,19 @@ chmod 700 cache NOTE: This was added to Smarty 1.4.3. + + $debugging_ctrl + + This allows alternate ways to enable debugging. NONE means no + alternate methods are allowed. URL means when the keyword + SMARTY_DEBUG is found in the QUERY_STRING, debugging is enabled + for that invocation of the script. If $debugging is true, this + value is ignored. + + + NOTE: This was added to Smarty 1.4.4. + + $global_assign @@ -3560,7 +3573,7 @@ OUTPUT: NOTE: if you apply a modifier to an array instead of a single value variable, the modifier will be applied to every value in that array. If you really want the entire array passed to the modifier, you must - prepend it with an "@" sign like so: {$articleTitle} (this will + prepend it with an "@" sign like so: {$articleTitle|@count} (this will print out the number of elements in the $articleTitle array.) @@ -4330,14 +4343,17 @@ s m o k e r s a r e p. . . Debugging Console There is a dubugging console included with Smarty. The console informs you - of all the included templates and assigned variables for the current - invocation of the template. A template named "debug.tpl" is included with - the distribution of Smarty which controls the formatting of the console. Set - $debugging to true in Smarty, and if needed set $debug_tpl to the template - resource path for debug.tpl (this is in $template_dir by default.) When you - load the page, a javascript console window should pop up and give you the - names of all the included templates and assigned variables for the current - page. To disable the debugging console, set $debugging to false. + of all the included templates, assigned variables and config file variables + for the current invocation of the template. A template named "debug.tpl" is + included with the distribution of Smarty which controls the formatting of + the console. Set $debugging to true in Smarty, and if needed set $debug_tpl + to the template resource path for debug.tpl (this is in $template_dir by + default.) When you load the page, a javascript console window should pop up + and give you the names of all the included templates and assigned variables + for the current page. To disable the debugging console, set $debugging to + false. You can also temporarily turn on the debugging console by putting + SMARTY_DEBUG in the URL if you enable this option with $debugging_ctrl. TECHNICAL NOTE: The debugging console does not work when you use the fetch() diff --git a/index.php b/index.php index 9b751fc5..5acebb36 100644 --- a/index.php +++ b/index.php @@ -5,6 +5,7 @@ require("Smarty.class.php"); $smarty = new Smarty; $smarty->compile_check = true; +$smarty->debugging = true; $smarty->assign("now", time()); diff --git a/libs/Smarty.class.php b/libs/Smarty.class.php index 4ef52f60..8704ccf4 100644 --- a/libs/Smarty.class.php +++ b/libs/Smarty.class.php @@ -62,7 +62,11 @@ class Smarty var $debugging = false; // enable debugging console true/false var $debug_tpl = 'file:debug.tpl'; // path to debug console template - + var $debugging_ctrl = 'NONE'; // Possible values: + // NONE - no debug control allowed + // URL - enable debugging when keyword + // SMARTY_DEBUG is found in $QUERY_STRING + var $global_assign = array( 'HTTP_SERVER_VARS' => array( 'SCRIPT_NAME' ) ); // variables from the GLOBALS array // that are implicitly assigned @@ -128,6 +132,8 @@ class Smarty 'fetch' => 'smarty_func_fetch', 'counter' => 'smarty_func_counter', 'assign' => 'smarty_func_assign', + 'overlib_init' => 'smarty_func_overlib_init', + 'overlib' => 'smarty_func_overlib', 'assign_debug_info' => 'smarty_func_assign_debug_info' ); @@ -578,7 +584,7 @@ class Smarty if ($display) { if (isset($results)) { echo $results; } - if ($this->debugging) { echo $this->_generate_debug_output(); } + if ($this->debugging || ($this->debugging_ctrl == 'URL' && (!empty($QUERY_STRING) && strstr('SMARTY_DEBUG',$QUERY_STRING)))) { echo $this->_generate_debug_output(); } return; } else { if (isset($results)) { return $results; } diff --git a/templates/debug.tpl b/templates/debug.tpl index 06d7ccb7..6a0fc179 100644 --- a/templates/debug.tpl +++ b/templates/debug.tpl @@ -9,11 +9,21 @@ _smarty_console.document.write("Smarty Debug Console"); _smarty_console.document.write("included templates:"); {section name=templates loop=$_debug_tpls} - _smarty_console.document.write("{section name=indent loop=$_debug_tpls[templates].depth}   {/section}{$_debug_tpls[templates].template}"); + _smarty_console.document.write("{section name=indent loop=$_debug_tpls[templates].depth}   {/section}{$_debug_tpls[templates].template}"); + {sectionelse} + _smarty_console.document.write("no templates included"); {/section} _smarty_console.document.write("assigned template variables:"); {section name=vars loop=$_debug_keys} - _smarty_console.document.write("{$_debug_keys[vars]}{if is_array($_debug_vals[vars])}Array ({$_debug_vals[vars]|@count}){elseif empty($_debug_vals[vars])}no value{else}{$_debug_vals[vars]|truncate:50|regex_replace:"![\r\t\n]!":" "|escape|default:"empty"}{/if}"); + _smarty_console.document.write("{ldelim}${$_debug_keys[vars]}{rdelim}{if is_array($_debug_vals[vars])}Array ({$_debug_vals[vars]|@count}){elseif empty($_debug_vals[vars])}no value{else}{$_debug_vals[vars]|truncate:50|regex_replace:"![\r\t\n]!":" "|escape|default:"empty"}{/if}"); + {sectionelse} + _smarty_console.document.write("no template variables assigned"); + {/section} + _smarty_console.document.write("assigned config file variables (outter template scope):"); + {section name=config_vars loop=$_debug_config_keys} + _smarty_console.document.write("{ldelim}#{$_debug_config_keys[config_vars]}#{rdelim}{if is_array($_debug_config_vals[config_vars])}Array ({$_debug_config_vals[config_vars]|@count}){elseif empty($_debug_config_vals[config_vars])}no value{else}{$_debug_config_vals[config_vars]|truncate:50|regex_replace:"![\r\t\n]!":" "|escape|default:"empty"}{/if}"); + {sectionelse} + _smarty_console.document.write("no config vars assigned"); {/section} _smarty_console.document.write(""); _smarty_console.document.write(""); diff --git a/templates/header.tpl b/templates/header.tpl index 3724c783..24d26fdf 100644 --- a/templates/header.tpl +++ b/templates/header.tpl @@ -1,3 +1,7 @@ + +{tooltip_init} +{tooltip_element id="help" width="200" text="This is an example of a tooltip. Tooltips are handy for context sensitive information."} + {$title} - {$Name} diff --git a/templates/index.tpl b/templates/index.tpl index 109fd991..d6dc7b4d 100644 --- a/templates/index.tpl +++ b/templates/index.tpl @@ -9,6 +9,8 @@ Title: {#title#|capitalize} {if #bold#}{/if} +Tooltip example: Move your mouse over the Help link to see a tooltip pop-up. + the value of $SCRIPT_NAME is {$SCRIPT_NAME} {* A simple variable test. print $Name in uppercase *}