From 6af75db3c31c6a3c51a42a9a0941328668032586 Mon Sep 17 00:00:00 2001
From: "Uwe.Tews@googlemail.com" <Uwe.Tews@googlemail.com>
Date: Sun, 12 Oct 2014 14:11:34 +0000
Subject: [PATCH]

---
 change_log.txt                                |  3 ++
 .../smarty_internal_templatelexer.php         | 46 ++++++++++++++++---
 .../smarty_internal_templateparser.php        |  6 +--
 3 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/change_log.txt b/change_log.txt
index 94024bfa..9ceaeae3 100644
--- a/change_log.txt
+++ b/change_log.txt
@@ -1,4 +1,7 @@
  ===== 3.1.21-dev ===== (xx.xx.2014)
+ 12.10.2014
+ - bugfix a comment like "<script{*foo*} language=php>" bypassed $php_handling checking (Thue Kristensen)
+
  ===== 3.1.20 ===== (09.10.2014)
  08.10.2014
  - bugfix security mode of "<script language=php>" must be controlled by $php_handling property (Thue Kristensen)
diff --git a/libs/sysplugins/smarty_internal_templatelexer.php b/libs/sysplugins/smarty_internal_templatelexer.php
index 534df2f8..f39a3201 100644
--- a/libs/sysplugins/smarty_internal_templatelexer.php
+++ b/libs/sysplugins/smarty_internal_templatelexer.php
@@ -21,6 +21,7 @@ class Smarty_Internal_Templatelexer
     public $line;
     public $taglineno;
     public $is_phpScript = false;
+    public $phpValue = '';
     public $state = 1;
     public $smarty;
     private $heredoc_id_stack = Array();
@@ -164,12 +165,13 @@ class Smarty_Internal_Templatelexer
             20 => 0,
             21 => 0,
             22 => 0,
-            23 => 0,
+            23 => 4,
+            28 => 0,
         );
         if ($this->counter >= strlen($this->data)) {
             return false; // end of input
         }
-        $yy_global_pattern = "/\G(\\{\\})|\G(" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*setfilter\\s+)|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(<\/script>)|\G(\\s*" . $this->rdel . ")|\G(<%)|\G(%>)|\G([\S\s])/iS";
+        $yy_global_pattern = "/\G(\\{\\})|\G(" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*setfilter\\s+)|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(<\/script>)|\G(\\s*" . $this->rdel . ")|\G(<%)|\G(%>)|\G(<(([^>]*?)(?=" . $this->ldel . ")" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")+([^>]*?)(?!" . $this->ldel . ")>)|\G([\S\s])/iS";
 
         do {
             if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -341,6 +343,7 @@ class Smarty_Internal_Templatelexer
             if ($script) {
                 $this->is_phpScript = true;
             }
+            $this->phpValue = $this->value;
             $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
         } elseif ($this->value == '<?xml') {
             $this->token = Smarty_Internal_Templateparser::TP_XMLTAG;
@@ -387,11 +390,26 @@ class Smarty_Internal_Templatelexer
     }
 
     function yy_r1_23($yy_subpatterns)
+    {
+
+        $clean = preg_replace("/{$this->ldel}\*([\S\s]*?)\*{$this->rdel}/", '', $this->value);
+        if (preg_match("/<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>/", $clean, $match)) {
+            $this->phpValue = $match[0];
+            $this->is_phpScript = true;
+            $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
+        } else {
+            preg_match("/([\S\s]*?)(?={$this->ldel})/", $this->value, $match);
+            $this->value = $match[0];
+            $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+        }
+    }
+
+    function yy_r1_28($yy_subpatterns)
     {
 
         $phpEndScript = $this->is_phpScript ? '|<\\/script>' : '';
         $to = strlen($this->data);
-        preg_match("/{$this->ldel}|<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
+        preg_match("/<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>|<(([^>]*?)(?={$this->ldel}){$this->ldel}\*([\S\s]*?)\*{$this->rdel})+([^>]*?)(?!{$this->ldel})>|{$this->ldel}{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
         if (isset($match[0][1])) {
             $to = $match[0][1];
         }
@@ -969,12 +987,13 @@ class Smarty_Internal_Templatelexer
             7  => 0,
             8  => 0,
             9  => 0,
-            10 => 0,
+            10 => 4,
+            15 => 0,
         );
         if ($this->counter >= strlen($this->data)) {
             return false; // end of input
         }
-        $yy_global_pattern = "/\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(<%)|\G(%>)|\G([\S\s])/iS";
+        $yy_global_pattern = "/\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(<%)|\G(%>)|\G(<(([^>]*?)(?=" . $this->ldel . ")" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")+([^>]*?)(?!" . $this->ldel . ")>)|\G([\S\s])/iS";
 
         do {
             if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -1085,11 +1104,26 @@ class Smarty_Internal_Templatelexer
     }
 
     function yy_r3_10($yy_subpatterns)
+    {
+
+        $clean = preg_replace("/{$this->ldel}\*([\S\s]*?)\*{$this->rdel}/", '', $this->value);
+        if (preg_match("/<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>/", $clean, $match)) {
+            $this->phpValue = $match[0];
+            $this->is_phpScript = true;
+            $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
+        } else {
+            preg_match("/([\S\s]*?)(?={$this->ldel})/", $this->value, $match);
+            $this->value = $match[0];
+            $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+        }
+    }
+
+    function yy_r3_15($yy_subpatterns)
     {
 
         $phpEndScript = $this->is_phpScript ? '|<\\/script>' : '';
         $to = strlen($this->data);
-        preg_match("/{$this->ldel}\/?literal{$this->rdel}|<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
+        preg_match("/<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>|<(([^>]*?)(?={$this->ldel}){$this->ldel}\*([\S\s]*?)\*{$this->rdel})+([^>]*?)(?!{$this->ldel})>|{$this->ldel}\/?literal{$this->rdel}{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
         if (isset($match[0][1])) {
             $to = $match[0][1];
         } else {
diff --git a/libs/sysplugins/smarty_internal_templateparser.php b/libs/sysplugins/smarty_internal_templateparser.php
index 90a38818..59c2356e 100644
--- a/libs/sysplugins/smarty_internal_templateparser.php
+++ b/libs/sysplugins/smarty_internal_templateparser.php
@@ -3313,13 +3313,13 @@ class Smarty_Internal_Templateparser#line 80 "smarty_internal_templateparser.php
     #line 152 "smarty_internal_templateparser.y"
     function yy_r7()
     {
-        if (strpos($this->yystack[$this->yyidx + 0]->minor, '<s') === 0) {
+        if (strpos($this->lex->phpValue, '<s') === 0) {
             $this->lex->is_phpScript = true;
         }
         if ($this->php_handling == Smarty::PHP_PASSTHRU) {
-            $this->_retvalue = new _smarty_text($this, self::escape_start_tag($this->yystack[$this->yyidx + 0]->minor));
+            $this->_retvalue = new _smarty_text($this, self::escape_start_tag($this->lex->phpValue));
         } elseif ($this->php_handling == Smarty::PHP_QUOTE) {
-            $this->_retvalue = new _smarty_text($this, htmlspecialchars($this->yystack[$this->yyidx + 0]->minor, ENT_QUOTES));
+            $this->_retvalue = new _smarty_text($this, htmlspecialchars($this->lex->phpValue, ENT_QUOTES));
         } elseif ($this->php_handling == Smarty::PHP_ALLOW) {
             if (!($this->smarty instanceof SmartyBC)) {
                 $this->compiler->trigger_template_error(self::Err3);