- bugfix in Smarty_Security 'nl2br' should be a trusted modifier, not PHP function (code.google issue 223)

change_log.txt

@@ -6,6 +6,7 @@
         was extended or Smarty properties had been modified in the class source
       - display Smarty version number
       - Truncate lenght of Origin display and extend strin value display to 80 character
+  - bugfix in Smarty_Security  'nl2br' should be a trusted modifier, not PHP function (code.google issue 223)
   
  12.05.2015
   - bugfix {$smarty.constant.TEST} did fail  on undefined constant https://github.com/smarty-php/smarty/issues/28

libs/sysplugins/smarty_security.php

@@ -108,7 +108,6 @@ class Smarty_Security
         'count', 'sizeof',
         'in_array', 'is_array',
         'time',
-        'nl2br',
     );
     /**
      * This is an array of trusted PHP modifiers.
@@ -119,7 +118,8 @@ class Smarty_Security
      */
     public $php_modifiers = array(
         'escape',
-        'count'
+        'count',
+        'nl2br',
     );
     /**
      * This is an array of allowed tags.