Commit Graph

1655 Commits

Author SHA1 Message Date
Simon Wisselink
7677db7bc9 Implement fix and tests 2023-03-24 12:21:08 +01:00
Simon Wisselink
e1fb2ad688 clean output buffer for Throwable instead of just Exception (#798)
* clean output buffer for Throwable instead of just Exception
2022-09-22 14:56:33 +02:00
Simon Wisselink
c51719bdfe version bump 2022-09-14 13:28:58 +02:00
Simon Wisselink
3f426c498e Test for existence of htmlspecialchars flag (PHP < 5.4) 2022-09-14 13:19:53 +02:00
Simon Wisselink
4d316d37a9 Smarty5 syntax fix 2022-09-14 13:09:50 +02:00
Simon Wisselink
80e45491e1 Smarty5 syntax fix 2022-09-14 12:58:07 +02:00
Simon Wisselink
08afb5150e Fixed unselected year/month/day not working in html_select_date
Fixes #395
2022-09-14 12:49:31 +02:00
Simon Wisselink
f1f7ee6e34 Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks
Fixes #454
2022-09-14 11:53:34 +02:00
Simon Wisselink
25051e6e88 Bugfix/rand without param v3 (#796)
* Fixed use of `rand()` without a parameter in math function (for v3.1)
Fixes #794

* Add change in regex for PRCE (PHP < 7.3)

* Add unit tests and correctly set PHP supported versions

* Drop PHP5.2 from CI workflows because it cannot be build anymore

* Fix CI workflow for PHP7.2 and up

* re-add compose packages cache with specific key

* Exclude unit test files from git export

* prevent double CI workflows in PRs
2022-09-12 16:03:27 +02:00
Simon Wisselink
4bcca1a2b4 version bump 2022-08-01 23:58:11 +02:00
Simon Wisselink
0f7037d7ee Fixed second param of unescape modifier (#779)
Fixes #777
2022-08-01 23:49:30 +02:00
Simon Wisselink
c7c2d476aa Merge branch 'fix-issue-549-v3' of github.com:AnrDaemon/smarty into AnrDaemon-fix-issue-549-v3 2022-07-15 10:33:38 +02:00
Simon Wisselink
28ea4f078c version bump 2022-05-17 14:57:50 +02:00
Simon Wisselink
4eb86a6770 Replace '*/' in user supplied input in C-style comments with '* /'. 2022-05-16 13:36:03 +02:00
AnrDaemon
ed14f5269a Fixed replace modifier by converting encoding if needed
`mb_split` will fail if `$pattern` or `$string` contains byte sequences not valid for `mb_regex_encoding()`.

Convert both strings and set regex encoding before calling `mb_split()` if needed.

Fixes smarty-php#549
2022-03-04 10:45:57 +03:00
Pavel Kochman
9f47b059ed math equation return warning: math: illegal character for : {math equation="max(x, y)" x=$x y=$y} 2022-02-07 09:45:14 +01:00
Simon Wisselink
eed1e07128 version bump 2022-01-18 00:12:03 +01:00
Simon Wisselink
208f881d06 Bugfix/702 (#709)
* fix(math): fix equation regexp

Fixes #702.
2022-01-18 00:10:25 +01:00
Simon Wisselink
ce1ff003d7 version bump 2022-01-10 10:52:39 +01:00
Simon Wisselink
28519ca00f Merge pull request from GHSA-4h9c-v5vg-5m6m 2022-01-10 10:48:27 +01:00
Simon Wisselink
a52a5b72ba version bump 2022-01-10 00:08:34 +01:00
Simon Wisselink
7ad97ad030 Merge pull request from GHSA-29gp-2c3m-3j6m
* Temporary fix. Waiting for CVE

* Add CVE
2022-01-10 00:07:57 +01:00
Simon Wisselink
1b6919da85 version bump 2022-01-09 23:21:19 +01:00
Simon Wisselink
457284283a Rewrote the mailto function to not use eval when encoding with javascript
(cherry picked from commit c7576eb1a1)
2022-01-09 23:18:17 +01:00
Simon Wisselink
7c4354e7b8 version bump 2021-10-13 12:04:29 +02:00
Simon Wisselink
3b0fd82849 Merge branch 'escape' of https://github.com/m-haritonov/smarty into m-haritonov-escape 2021-08-19 15:26:27 +02:00
David Goodwin
039043e5a2 Update modifier.escape.php (#649)
trigger a notice if an incorrect modifier was used (E.g.|escape:quotes vs |escape:quote).
2021-03-21 21:21:55 +01:00
Mihail Haritonov
9cde36e3bc plugins: escape: javascript escaping secure fix 2021-02-28 16:44:56 +03:00
Simon Wisselink
a21f59663c version bump 2021-02-17 22:57:50 +01:00
Simon Wisselink
4f634c0097 Merge branch 'bugfix/tplfunction_sandbox_escape' 2021-02-17 22:52:34 +01:00
Simon Wisselink
165f1bd4d2 Fixed Code injection vulnerability by using illegal function names 2021-01-24 23:44:07 +01:00
Simon Wisselink
6463519a6c Prevent access to .template_object when in security mode to prevent PHP code injection vulnerability 2021-01-24 23:13:26 +01:00
Simon Wisselink
2af2a07906 version bump 2021-01-08 15:05:40 +01:00
Simon Wisselink
cb4254355e Removed unused error_reporting.ini file, updated version number in Smarty::SMARTY_VERSION, fixed inline phpdoc that caused an IDE error 2021-01-08 15:05:10 +01:00
Simon Wisselink
e2b28167f8 Clarify correct LGPL version.
Fixes #612
2021-01-05 22:23:13 +01:00
Libor M
820782cd80 const fix for usage with comparison operators (#618)
Fixes #609 #613
2021-01-05 22:07:44 +01:00
Simon Wisselink
c295786e43 Fixes for php8.0.0beta3 (#608)
* Set $errcontext argument optional to support PHP 8

- Argument is optional and deprecated in PHP 7.2

* Getting ready for PHP8, handling changed error levels/handlers mostly

* php5 compat syntax

* Updated UndefinedTemplateVarTest for PHP8 (and disabled a check for PHP<5.6) and re-enabled php:nightly in travis config

* Attempt to fix travis runs for (almost) all php versions supported

* Fix unit tests for php8, force composer to think we are still php7 to pick a supported phpunit and being less specific about an error msg because PHP8 is in active development and the exact wording is changing.

* Fixed a unit test that accidentally passed on phpunit < 7 because of sloppy string comparison.

* changelog

* run travis in xenial where possible for latest php versions. Fix unit tests from freakingo over inconsistent error messages in php8-beta.

* Incorporated AnrDaemons suggestions, making composer figure out the required phpunit version instead of specifying it explicitly and removing a unneeded error supression (@).

Co-authored-by: Jorge Sá Pereira <me@jorgesapereira.com>
2020-09-12 21:37:31 +02:00
♚ PH⑦ de Soria™♛
859a09e1bb Bumped phpdoc @version tag to 3.1.36 (#598)
Although this could be removed, since the header comment is still there, it's good to keep the @version tag updated in order to avoid confusion for those who read it :)
2020-09-11 13:34:15 +02:00
AnrDaemon
eae19f23b9 PHP 5.3 compatibility fixes 2020-05-05 01:37:36 +03:00
Sławomir Kaleta
e1c050a32c Fix comment - Method can return string (#583) 2020-04-14 17:26:20 +02:00
Simon Wisselink
07772aac90 version bump 2020-04-14 16:44:24 +02:00
Simon Wisselink
e0ea6899c8 fixed version of Smarty::SMARTY_VERSION and updates make-release script to do so automatically from now on 2020-04-14 16:40:44 +02:00
Simon Wisselink
19ef8342aa Strip now removes whitespaces after comment (#582)
* Mark text sections as to be stripped, but do not strip them right away. Combine equivalent sections in chunks at the template level and strip combined chunks where possible.
- simplified Smarty_Internal_TemplateCompilerBase::processText along the way
Fixes #447
2020-04-13 22:27:42 +02:00
Simon Wisselink
4f89f6d84f Throw SmartyException when setting caching attributes for cacheable plugin as compiling this would fail (#573)
Fixes #457
2020-04-13 22:26:24 +02:00
Simon Wisselink
4396351d75 Switched to a more advanced regex to test wheter parameter is a variable (#567)
* This appears to fix #453, #498, #499 and possibly more issues.
2020-04-13 22:24:29 +02:00
Vadim Kuragkovskiy
38b5ac72fa fix minor typo 2020-02-07 18:56:25 +02:00
Simon Wisselink
62d772e734 Fixed broken nesting and null handling. 2020-01-27 16:02:02 +01:00
Simon Wisselink
388993e9ca Fix foreachelse on arrayiterators
Keep track of main loop using a do_else variable.
Fixed #506
2020-01-27 15:24:45 +01:00
mohrt
a62a7caf97 Merge pull request #540 from Hunman/master
Fixing problem with assigning value to object variables as arrays in smarty_internal_compile_assign
2020-01-13 18:50:41 -06:00
mohrt
9e9961feae Merge pull request #551 from bits4breakfast/master
Replace callback typehint with callable
2020-01-13 18:45:23 -06:00