Compare commits

...

134 Commits

Author SHA1 Message Date
colemanw 1f9eef51c7 Fix double semicolon in getRightDelimiter method (#1202) 2026-07-04 13:37:14 +02:00
Simon Wisselink 94a27cbbc7 Merge branch 'release/5.8.4' 2026-06-29 12:46:32 +02:00
Simon Wisselink badc5ef3a0 version bump 2026-06-29 12:46:30 +02:00
Simon Wisselink 2ae0f9a65f Fix TypeError for non-array static_classes in Security policy (#1198) 2026-06-29 12:45:58 +02:00
Simon Wisselink b668745acf drop unused version attribute from docker-compose.yml 2026-06-29 12:40:41 +02:00
Simon Wisselink 3c9f77a2e0 Security: validate nested stream wrapper in stream: resource (CWE-22) (#1195)
The built-in stream: resource type let a template bypass Security stream
restrictions. BasePlugin::load() matches the 'stream' sysplugin before the
stream_get_wrappers()/isTrustedStream() check, so a resource such as
stream:php://filter/read=convert.base64-encode/resource=/path was opened by
StreamPlugin::getContent() via fopen() on the nested php:// wrapper without
ever validating it. This bypassed Security::$streams (including
Security::$streams = null) and allowed reading arbitrary local files.

Parse the wrapper scheme from the resolved path in StreamPlugin::getContent()
and validate it with Security::isTrustedStream() before fopen(), giving the
stream: resource the same check the direct wrapper path already receives.

Adds regression tests covering the disabled-streams bypass, the
not-on-allowlist case, and a positive test that an explicitly allowed wrapper
still works.
2026-06-29 11:47:32 +02:00
Simon Wisselink 042dff64a9 Merge branch 'release/5.8.3' 2026-06-29 00:15:09 +02:00
Simon Wisselink 1830aa7a12 version bump 2026-06-29 00:15:07 +02:00
Simon Wisselink b83ffdd2d6 requirements for building docs, switched test-runner from mutagen to basic docker compose 2026-06-29 00:14:40 +02:00
Simon Wisselink ac27e1e5b6 fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent
Fixes #1192
2026-06-29 00:12:45 +02:00
Simon Wisselink 17fae11a38 update documentation for building and previewing with mkdocs, fix unit tests for windows 2026-06-24 10:33:14 +02:00
Simon Wisselink 06594a1149 Merge branch 'release/5.8.2' 2026-06-24 10:04:41 +02:00
Simon Wisselink 75a738ad44 version bump 2026-06-24 10:04:39 +02:00
Simon Wisselink 11e69eca68 Security: escape value-context attributes in html_image/html_select_date (CWE-79)
{html_image} already escaped alt and pass-through attributes, but emitted
file, path_prefix, href/link, width and height raw, letting an untrusted
value break out of the generated tag. Escape these at output time; the
unescaped values are still used for getimagesize()/DPI math. Escaping uses
htmlspecialchars with double_encode=false, so existing entities and values
like "100%" are preserved (no BC break for legitimate values).

{html_select_date} treated day_size/month_size/year_size as strings and
emitted them raw into size="…"; cast them to int to match
{html_select_time} and close the breakout.

The remaining flagged parameters (mailto extra; html_table *_attr/
trailpad/caption/loop; html_radios/html_checkboxes separator;
html_select_* *_extra/field_separator and the unrecognised-attribute
pass-through) intentionally emit raw markup as documented, so escaping
them would break backwards compatibility. Add a security note to those
docs pages instead, telling authors to escape untrusted values themselves.

Adds tests for html_image escaping (incl. benign-value/no-double-encode
checks) and the html_select_date size cast.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24 00:48:01 +02:00
Simon Wisselink 31e06fc087 Security: stop {fetch} from following redirects past trusted_uri (CWE-918)
{fetch} validates the requested URL with Security::isTrustedUri(), but
for non-http schemes (e.g. https) it reads the resource via
file_get_contents(), which follows redirects by default. An open redirect
on an otherwise trusted host could therefore be used to reach a
non-trusted, internal target, bypassing the trusted_uri policy (SSRF).

When a security policy is active, pass a stream context that disables
redirect-following (follow_location => 0, max_redirects => 1) to
file_get_contents() for remote resources. Behavior is unchanged when no
security policy is set, since there is no trusted_uri to bypass.

Adds a regression test using a custom stream wrapper that captures the
context {fetch} passes to file_get_contents, plus a backwards-compat test
for the no-security-policy case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24 00:21:12 +02:00
Simon Wisselink 99c048ce7a Security: prevent symlink path traversal out of secure_dir (CWE-22)
Security::_checkDir() validated file access using Smarty::_realpath(),
which only normalizes paths as strings and never follows symlinks. A
symlink placed inside a trusted secure_dir/template directory therefore
passed the trust check while file_get_contents() followed it to an
arbitrary file (e.g. /etc/passwd), affecting {include} and {fetch} of
local files.

Resolve the requested file with native realpath() and re-validate the
canonical, symlink-free path against the trusted directories. The trusted
directories are canonicalized the same way so legitimate symlinked
deployment paths (e.g. a Capistrano "current" release symlink, or macOS'
/var -> /private/var) keep working. Falls back to string normalization
only when the file does not yet exist on disk.

Adds regression tests covering both the rejected escape and an allowed
in-sandbox symlink, and documents the changelog convention in AGENTS.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24 00:15:19 +02:00
Antonio Norman 1c9b2ce1d3 fix for Error: Attempt to assign property "step" on null closes issue #1036 (#1071)
* fix for Error: Attempt to assign property "step" on null in extended templates + added tests closes issue #1036
2026-06-23 23:50:43 +02:00
Simon Wisselink 29a77ded2f Merge branch 'release/5.8.1' 2026-06-23 23:04:23 +02:00
Simon Wisselink 6d06c5e61f version bump 2026-06-23 23:04:21 +02:00
Simon Wisselink ba745f5b91 Added changelog for the fix for issue #1189 2026-06-23 23:03:58 +02:00
Simon Wisselink 0775fa84d1 Agents instructions 2026-06-23 22:52:51 +02:00
Simon Wisselink 56ab75df2c Bugfix/issue 1189 inheritance state leak (#1190)
* Reproduce block override leakage in template inheritance
* Fixes #1189
2026-06-23 22:50:39 +02:00
Masatoshi Ogiwara 383e20e6b4 fix: return type (#1180) 2026-05-16 00:34:29 +02:00
Simon Wisselink c139883770 update todos 2026-05-03 22:19:59 +02:00
Simon Wisselink 6e648ed809 Remove incomplete test cases for usesCompiler across multiple test files 2026-05-03 22:19:50 +02:00
Simon Wisselink 3577fc7091 Re-activate unit tests for user literals. 2026-04-13 22:31:06 +02:00
Simon Wisselink ff2ef3b0cb Redirect test temp dirs to system temp directory
* Redirect test temp dirs to system temp directory. Fixes #1178

Move all test-generated output (compiled templates, cache files, and
temporary template sources) from per-test-directory folders inside the
working tree to a parallel structure under sys_get_temp_dir()/smarty-tests/.

This removes 215 boilerplate .gitignore files from the repo and ensures
running the test suite leaves zero uncommitted files in the working tree.

All 2296 tests continue to pass with identical behavior.

* Isolate each test class in a unique temp directory

getTempDir() now appends a per-class uniqid token to the temp path, so
concurrent or sequential test runs never share compiled/cached output.
The token is generated lazily on first use and reset in
tearDownAfterClass(), giving every test class a fresh isolated directory.

As a result, the Bootstrap.php pre-run cleanup of smarty-tests/ is no
longer needed for correctness (stale paths are unreachable) and was
harmful to concurrent runs, so it has been removed.

* Remove individualFolders dead code and spurious assertTrue from cleanDirs()

- Remove the never-active individualFolders code path from setUpSmarty()
  (the constant was always true, making the branch unreachable)
- Remove define('individualFolders') from Config.php and the constructor
- Remove $this->assertTrue(true) from cleanDirs(): it existed solely to
  make testInit() count as a passing test; now that cleanDirs() is called
  from setUpSmarty() and from test methods directly, the assertion was
  spuriously inflating assertion counts
- Add tests/**/templates_c/, cache/, templates_tmp/ to .gitignore to
  prevent stale test output from appearing as untracked files

* Clean up each test class's unique temp dir in tearDownAfterClass()

Add a private static removeDir() helper and call it from
tearDownAfterClass() to recursively delete the per-class unique temp
directory after each test class finishes. Cleanup failures are silently
ignored (@ suppression) so they never cause test failures.

Set KEEP_SMARTY_TEST_ARTIFACTS=1 in the environment to skip cleanup and
keep the artifacts on disk for debugging.

* cleanup of unused template files, non-shared files stored in __shared folder, no longer required calls to add template folders et cetera

* fixed the unit tests

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* remove useless resetting of static properties in tearDownAfterClass

* changed an incorrect doc and formatted some code.

* add changelog

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-13 21:36:33 +02:00
Simon Wisselink aa2dcd82cf Added AGENTS.md for improved vibe coding experience 2026-04-10 22:57:32 +02:00
Simon Wisselink 78d259d3b9 Merge branch 'release/5.8.0' 2026-02-15 15:27:15 +01:00
Simon Wisselink 4ed569c674 version bump 2026-02-15 15:27:13 +01:00
Simon Wisselink a46478d0cb changelogs 2026-02-15 15:26:43 +01:00
Simon Wisselink 5487e31c4b Add support for Backed Enums (#1171)
* Add support for Backed Enums
Fixes #1012

Also added docs (and docs for matches operator)
2026-02-15 15:23:55 +01:00
Simon Wisselink 12ce28e265 Regex matches operator (#1169)
* Regex matches operator support
2026-02-15 14:44:48 +01:00
Simon Wisselink 139797a165 Support for Laravel Collections style object chaining (#1168)
* Support for Laravel Collections style object chaining for objects return from function calls implemented as modifiers
Fixes #1151

* explain publishing docs
2026-02-11 00:02:52 +01:00
hirosan 6709d000cd Fix static analysis warnings for isDot() and remove deprecated APC support (#1164)
* Fix static analysis warnings for isDot()
* Remove deprecated APC support
* Remove redundant isDot() check and fix static analysis warnings
2026-01-08 11:21:57 +01:00
Simon Wisselink aa6edc3c0b Document missing inline implementation. Fixed #1152 (#1156) 2025-12-21 22:58:11 +01:00
Simon Wisselink 73da7e90f3 Merge branch 'release/5.7.0' 2025-11-19 22:36:38 +01:00
Simon Wisselink c0d7a36124 version bump 2025-11-19 22:36:36 +01:00
Simon Wisselink 8cc9a75964 Php8.5 support (#1138)
* PHP 8.5 support (using RC docker image for php 8.5 unit tests)
2025-11-19 22:33:49 +01:00
Wim Wisselink 21d7fbb67e Non-canonical cast (boolean) fix (#1145) 2025-10-17 14:45:38 +02:00
Simon Wisselink 1fc41e385d Merge branch 'release/5.6.0' 2025-10-03 23:22:25 +02:00
Simon Wisselink fe325daec0 version bump 2025-10-03 23:22:23 +02:00
Simon Wisselink 3f0f308a7b added changelog 2025-10-03 23:19:22 +02:00
pharixces b390e50974 Add support for shorttags in functions (#1142)
* Add support for shorttags in functions

Co-authored-by: Anne Zijlstra <a.zijlstra@iwink.nl>
Co-authored-by: Simon Wisselink <s.wisselink@iwink.nl>
2025-10-03 23:17:55 +02:00
Simon Wisselink 0e46ae3add Merge branch 'release/5.5.2' 2025-08-26 10:38:06 +02:00
Simon Wisselink 4d793ee04c version bump 2025-08-26 10:38:05 +02:00
Simon Wisselink 7677b84058 Fixed escaping of array/object keys in debug_print_var 2025-08-26 10:32:02 +02:00
Simon Wisselink e7457d78cb Add iWink and Temma logos 2025-05-27 22:39:34 +02:00
Simon Wisselink cbcd66e1de Merge branch 'release/5.5.1' 2025-05-19 11:29:42 +02:00
Simon Wisselink 46cd224efb version bump 2025-05-19 11:29:40 +02:00
Simon Wisselink d3b716a0b9 changelog 2025-05-19 11:29:30 +02:00
pharixces 693502c341 Bugfix/bcpluginsadapter support modifiercompiler (#1132)
* Add support for modifiercompiler in the BCPluginsAdapter class.

---------

Co-authored-by: Anne Zijlstra <a.zijlstra@iwink.nl>
2025-05-19 11:28:10 +02:00
Shad bb968469fa add empty and in_array modifier doc (#1113) 2025-05-06 14:23:46 +02:00
Simon Wisselink 372f7cf41a Merge branch 'release/5.5.0' 2025-05-03 23:36:46 +02:00
Simon Wisselink f659193c94 version bump 2025-05-03 23:36:44 +02:00
Simon Wisselink 0b6166482a changelog 2025-05-03 23:36:27 +02:00
hirosan 4ff25bbe59 Support trailing comma in array (#1128) 2025-05-03 23:34:15 +02:00
hirosan afbd71b868 Update getting-started.md (#1111)
Indicate support for php8.4 in docs.
2025-04-16 08:11:00 +02:00
Simon Wisselink e26f82d02c Merge branch 'release/5.4.5' 2025-04-15 13:20:08 +02:00
Simon Wisselink 6ad6a35824 version bump 2025-04-15 13:20:06 +02:00
Simon Wisselink baa53399f5 changelog 2025-04-15 13:19:54 +02:00
gherosh 37bea77ea7 Update StringEval.php (#1126)
Fix: Implicitly marking parameter $_template as nullable is deprecated, the explicit nullable type must be used instead
2025-04-15 13:19:00 +02:00
Simon Wisselink 0d33f3acde Added sponsor 2025-04-13 22:34:16 +02:00
Simon Wisselink 05adbf45f3 Drop jit runs from CI unit tests.
Fixes #1125
2025-04-13 22:20:14 +02:00
Simon Wisselink df4795b803 Merge branch 'release/5.4.4' 2025-04-13 22:12:10 +02:00
Simon Wisselink 5401418258 version bump 2025-04-13 22:12:08 +02:00
Simon Wisselink a5bbba3f05 Fix syntax error occurring when registering a function plugin that ends with the string 'close' (#1124)
Fixes #1122
2025-04-10 23:47:44 +02:00
Simon Wisselink a0664a4ab2 Added funding options 2025-04-10 22:39:35 +02:00
Simon Wisselink a4b8466205 Added unit tests to prevent regressions of issue #1100 that was fixed in v4 2025-02-13 23:20:05 +01:00
Simon Wisselink 5d1ea5806a change SMARTY_VERSION to $smarty.version.
Fixes #1073
2024-12-28 17:40:25 +01:00
Simon Wisselink ab247c723b Add upgrading remarks on magic APi methods.
Fixes #979
2024-12-27 23:37:21 +01:00
Simon Wisselink fb997111f4 Add note to docs about plugins that expect parameters by reference 2024-12-27 23:08:17 +01:00
Simon Wisselink c6bff57950 Merge branch 'release/5.4.3' 2024-12-23 01:38:44 +01:00
Simon Wisselink 07faafe4da version bump 2024-12-23 01:38:41 +01:00
Simon Wisselink 295b7fb582 move to official php8.4 image for unit testing in CI 2024-12-23 01:34:55 +01:00
Simon Wisselink cf9de567c1 Restore special handling of isset and empty as it was in v4. Fixes #1063 (#1093)
* Restore special handling of isset and empty as it was in v4. Fixes #1063
2024-12-23 01:29:07 +01:00
Simon Wisselink f47ac761af replace/qualify call_user_func_array. (#1083)
Fixes #1074
2024-11-20 23:05:14 +01:00
Simon Wisselink 642a97adcc Merge branch 'release/5.4.2' 2024-11-20 22:18:16 +01:00
Simon Wisselink 3bba3ff5e9 version bump 2024-11-20 22:18:13 +01:00
Simon Wisselink b3b43af816 Add to changelog 2024-11-20 22:18:03 +01:00
Wim Wisselink 1b06b37db2 Add PHP 8.4 support to Smarty (#1043) 2024-11-20 15:59:26 +01:00
Simon Wisselink a1b4c9c551 Add unit tests for short hand template function definition and shorthand template function calls. 2024-10-06 22:06:39 +02:00
Simon Wisselink cd58df7a26 Merge branch 'release/5.4.1' 2024-08-30 01:10:45 +02:00
Simon Wisselink 70ed68ff5b version bump 2024-08-30 01:10:42 +02:00
Simon Wisselink 598ccde435 Changelog 2024-08-29 00:09:43 +02:00
Atsushi Matsuo cb09fda90d Update a workflow file for GitHub Actions to test on Windows (#1046) 2024-08-28 23:56:51 +02:00
Atsushi Matsuo c8f1853bfe Modify NullCoalescingTest.php and TernaryTest.php to prevent test failure on Windows (#1059) 2024-08-28 23:16:04 +02:00
Atsushi Matsuo 2f781e2e65 Fix unit tests to enable to run CacheResourceFileTest.php on Windows (#1055) 2024-08-28 23:15:57 +02:00
Atsushi Matsuo 30c6ee64ab Fix an issue that preventing the use of "extends:" to define the inheritance tree on Windows (#1056) 2024-08-28 23:09:34 +02:00
Simon Wisselink fd90f7eac9 Merge branch 'release/5.4.0' 2024-08-14 22:00:44 +02:00
Simon Wisselink 77b91a072b version bump 2024-08-14 22:00:42 +02:00
Simon Wisselink 9ede0e40fa changelog 2024-08-14 22:00:15 +02:00
Stephan Lueckl 1ccfca17d6 Fixing forced OpCache invalidation on every template include, which is resulting in fast raising wasted OpCache memory #1007 (#1047)
* Fixing forced OpCache Invalidation on every call, which is resulting in fast raising wasted memory
* Fix undefined $path variable warning
---------

Co-authored-by: Daniel Metzner <daniel.metzner@niceshops.com>
2024-08-14 21:58:51 +02:00
Shad d6153d4d4d add missing closing tr tag (#1039) 2024-07-01 16:38:18 +02:00
Amaury Bouchard 2289fa69f1 Improvement of auto-escaping (#1030)
* Evolution of auto-escaping: no double-escaping when using the 'escape' modifier; add the 'force' mode to the 'escape' modifier; add the 'raw' modifier.
* Add 'raw' modifier's documentation
---------

Co-authored-by: Simon Wisselink <s.wisselink@iwink.nl>
2024-06-30 13:25:30 +02:00
Simon Wisselink 3cb3585432 Merge branch 'release/5.3.1' 2024-06-16 21:51:13 +02:00
Simon Wisselink a2193eb4cf version bump 2024-06-16 21:51:11 +02:00
Simon Wisselink 8ecde47203 fixed error when using section with nocache.
Fixes #1034
2024-06-16 21:48:14 +02:00
Simon Wisselink b978cb348e add smarty logo svg for future use 2024-06-16 21:36:57 +02:00
Simon Wisselink 353ca06d07 Merge branch 'release/5.3.0' 2024-05-30 13:14:56 +02:00
Simon Wisselink 20c08ac40d version bump 2024-05-30 13:14:54 +02:00
Simon Wisselink 4aa1273a80 Merge branch 'support/5' 2024-05-30 13:11:33 +02:00
Simon Wisselink 2a87c65994 implemented and documented prependTemplateDir. (#1025) 2024-05-29 15:32:47 +02:00
Simon Wisselink cdee97d3f1 Merge branch 'release/5.2.0' 2024-05-28 23:45:16 +02:00
Simon Wisselink 06d6a5efd9 version bump 2024-05-28 23:45:14 +02:00
Simon Wisselink 0be92bc8a6 Merge pull request from GHSA-4rmg-292m-wg3w 2024-05-28 22:44:30 +02:00
Simon Wisselink 61db287b8f Scottchiefbaker/master (#1019)
* Add a PSR-4 loading script to allow Smarty to be used without Composer
authored-by: Scott Baker <scott@perturb.org>
2024-05-24 00:21:02 +02:00
Simon Wisselink 3293a873bd Remove unused attributes from config_load (#1004)
fixes #993
2024-04-29 10:01:40 +02:00
Simon Wisselink 8d53d3cbf2 Merge branch 'release/5.1.0' 2024-04-23 00:22:15 +02:00
Simon Wisselink 47c4864dd1 version bump 2024-04-23 00:22:13 +02:00
Simon Wisselink f411247aa1 Prevent notices on null to string conversion in Template::appendCode (#1002)
Fixes #996
2024-04-19 11:14:07 +02:00
Simon Wisselink 9a8702d937 Corrected invalid classnames in Runtime code for foreach (#1001)
Fixes #1000
2024-04-19 10:42:54 +02:00
Simon Wisselink 5ee4363000 Fix change in signature of getTemplateVars (#995) 2024-04-13 16:53:05 +02:00
kynx 77c0b74e3b Fix docblock types (#992) 2024-04-11 20:31:30 +02:00
Simon Wisselink 34adf4e54c Fixed unit tests to not rely on the existence of any domain or unavailability of internet access when running tests. (#987) 2024-04-06 23:41:20 +02:00
Simon Wisselink 5400b53edf Revert "fix release tooling to support/5 branch"
This reverts commit 569cef71d0.
2024-04-05 22:40:31 +02:00
Simon Wisselink 599bcee13e Fix Smarty::assign() not returning when called with an array as first parameter. (#973)
Fixes #972
2024-04-05 22:38:57 +02:00
Simon Wisselink 569cef71d0 fix release tooling to support/5 branch 2024-04-05 22:38:57 +02:00
Simon Wisselink 0972503aef version bump 2024-04-05 22:38:57 +02:00
Shad 46b15e6365 add is_array modifier doc (#984) 2024-04-03 19:57:09 +02:00
Simon Wisselink 3232277bc5 Fix warning when calling hasVariable for an undefined variable (#978)
Fixes #977
2024-03-29 23:32:49 +01:00
Simon Wisselink bbd09c7bfa Merge branch 'release/5.0.2' into support/5 2024-03-28 11:23:18 +01:00
Simon Wisselink 52dc8adafb version bump 2024-03-28 11:23:16 +01:00
Simon Wisselink 6f054ecc2f Fix Smarty::assign() not returning when called with an array as first parameter. (#973)
Fixes #972
2024-03-28 11:22:29 +01:00
Simon Wisselink 4fec27ccc2 fix release tooling to support/5 branch 2024-03-27 23:05:16 +01:00
Simon Wisselink fea0d02d99 version bump 2024-03-27 23:03:40 +01:00
Simon Wisselink beafa5ec31 Merge branch 'release/5.0.1' 2024-03-27 22:57:07 +01:00
Simon Wisselink 82a815aafb version bump 2024-03-27 22:57:04 +01:00
Simon Wisselink 4efa427a87 Fix missing and bogus use lines in src/Smarty.php. (#970) 2024-03-27 22:55:23 +01:00
Wim Wisselink 30b1c5bf6d Deprecation fix for providing a non string value to ctype_digit (#960) 2024-03-27 22:55:23 +01:00
Markus Frühauf 3f871f9f7a Fix docblock information after Smarty 5 namespace changes (#968) 2024-03-27 22:55:23 +01:00
Simon Wisselink cafe5e1e59 Fix missing and bogus use lines in src/Smarty.php. (#970) 2024-03-27 22:53:03 +01:00
Wim Wisselink a58d869502 Deprecation fix for providing a non string value to ctype_digit (#960) 2024-03-27 11:48:38 +01:00
Markus Frühauf 28e11b114b Fix docblock information after Smarty 5 namespace changes (#968) 2024-03-27 11:47:42 +01:00
509 changed files with 5179 additions and 3577 deletions
+1
View File
@@ -0,0 +1 @@
github: [wisskid]
+6 -21
View File
@@ -23,6 +23,7 @@ jobs:
matrix:
os:
- ubuntu-latest
- windows-latest
php-version:
- "7.2"
@@ -32,31 +33,15 @@ jobs:
- "8.1"
- "8.2"
- "8.3"
- "8.4"
- "8.5"
compiler:
- default
include:
- os: ubuntu-latest
php-version: "8.0"
compiler: jit
- os: ubuntu-latest
php-version: "8.1"
compiler: jit
- os: ubuntu-latest
php-version: "8.2"
compiler: jit
- os: ubuntu-latest
php-version: "8.3"
compiler: jit
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Override PHP ini values for JIT compiler
if: matrix.compiler == 'jit'
run: echo "PHP_INI_VALUES::assert.exception=1, zend.assertions=1, opcache.enable=1, opcache.enable_cli=1, opcache.optimization_level=-1, opcache.jit=1255, opcache.jit_buffer_size=32M" >> $GITHUB_ENV
uses: actions/checkout@v4
- name: Install PHP with extensions
uses: shivammathur/setup-php@v2
@@ -68,7 +53,7 @@ jobs:
- name: Cache Composer packages
id: composer-cache
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: vendor
key: v5r2-${{ runner.os }}-php-${{ matrix.php-version }}-${{ hashFiles('**/composer.lock') }}
@@ -76,7 +61,7 @@ jobs:
v5r1-${{ runner.os }}-php-${{ matrix.php-version }}-
- name: Install dependencies
uses: php-actions/composer@v6
run: composer install
- name: Run make
run: make -B
+2
View File
@@ -7,3 +7,5 @@ phpunit*
.phpunit.result.cache
vendor/*
composer.lock
+87
View File
@@ -0,0 +1,87 @@
# AGENTS.md
This file is the single source of truth for AI coding assistants working in this repo (including Claude Code, claude.ai/code).
## Project
Smarty v5 — PHP template engine. Single Composer package (`smarty/smarty`), namespace `Smarty\`, source in `src/`, autoloaded via PSR-4. Supports PHP 7.28.5.
Do not use PHP syntax newer than 7.2 in `src/` unless it is guarded for older runtimes.
## Commands
```bash
# Install dependencies
composer install
# Regenerate lexers and parsers (required before tests; CI runs this)
make -B
# Run all tests
php ./vendor/phpunit/phpunit/phpunit
# Run a single test file
php ./vendor/phpunit/phpunit/phpunit tests/UnitTests/TemplateSource/TagTests/If/CompileIfTest.php
# Run tests matching a PHPUnit group
php ./vendor/phpunit/phpunit/phpunit --group 20221124
# Run tests excluding slow group
php ./vendor/phpunit/phpunit/phpunit --exclude-group slow
```
There is no linter or static analysis configured. No typecheck step.
## Generated code — do not hand-edit
Four files are generated from grammar/lexer definitions via `make`:
| Source (edit this) | Generated (do not edit) |
|---|---|
| `src/Lexer/TemplateLexer.plex` | `src/Lexer/TemplateLexer.php` |
| `src/Lexer/ConfigfileLexer.plex` | `src/Lexer/ConfigfileLexer.php` |
| `src/Parser/TemplateParser.y` | `src/Parser/TemplateParser.php` |
| `src/Parser/ConfigfileParser.y` | `src/Parser/ConfigfileParser.php` |
After editing a `.plex` or `.y` file, run `make -B` to regenerate. The generators require the `smarty/smarty-lexer` dev dependency.
## Architecture
- `src/Smarty.php` — main class, extends `TemplateBase`. Version constant: `Smarty::SMARTY_VERSION`.
- `src/Compile/`, `src/Compiler/` — template compilation pipeline.
- `src/Lexer/`, `src/Parser/` — lexer/parser (generated, see above).
- `src/Extension/` — extension system (`ExtensionInterface`, `CoreExtension`, `DefaultExtension`, `BCPluginsAdapter`).
- `src/Runtime/` — runtime helpers (foreach, capture, inheritance, tpl functions).
- `src/Resource/`, `src/Cacheresource/` — template resource and cache resource handlers.
- `src/BlockHandler/`, `src/FunctionHandler/`, `src/Filter/` — built-in tags, functions, and filters.
- `libs/Smarty.class.php` — non-Composer autoload stub. Points to `src/`. Not the main source.
- `src/functions.php` — global helper functions, always loaded via Composer `files` autoload.
## Tests
- Framework: PHPUnit 7.5/8.5 (bootstrap: `tests/Bootstrap.php`).
- All tests extend `PHPUnit_Smarty` (defined in `tests/PHPUnit_Smarty.php`), which provides `setUpSmarty($dir)`.
- Test suite root: `tests/UnitTests/`. Typical test `setUp()` calls `$this->setUpSmarty(__DIR__)`.
- Each test directory may have its own `templates/`, `configs/` subdirectories. Compiled output goes to `templates_c/` and `cache/` (auto-created by the test harness).
- Running the suite scatters generated `templates_c/`, `cache/`, and `templates_tmp/` directories (and empty runtime `templates/`/`configs/` dirs) throughout `tests/` and the repo root. These are not tracked — treat them as noise in `git status`, never commit them, and clean them with `git clean -fd` (exclude tool dirs like `.serena`).
- Three test files are excluded in `phpunit.xml`: Memcache, APC, and HttpModifiedSince tests (require external services).
- Tests needing MySQL/PDO are gated by constants in `tests/Config.php` (disabled by default).
## CI
GitHub Actions (`.github/workflows/ci.yml`): matrix of PHP 7.28.5 on ubuntu + windows. Steps: `composer install``make -B``phpunit`. No deploy step.
## Docs
Markdown in `docs/`, built with mkdocs + Material theme. Install the toolchain with `pip install -r docs/requirements.txt`, then preview with `mkdocs serve`. Published via `mike deploy 5.x`.
## Release
`./make-release.sh <version>` — only v5.x.x. Updates changelog and version constant, creates a merge commit and tag on `master`.
### Changelog
Every change that should appear in `CHANGELOG.md` must add a new markdown file under `changelog/`. At release time `utilities/update-changelog.php` concatenates all `changelog/*.md` files into the `## [Unreleased]` section, so:
- One file per change, containing a single line that starts with a dash (`- ...`). The filename is arbitrary; name it after the issue number (e.g. `1036.md`) when there is one, otherwise use a short descriptive slug.
- Include a markdown link to the relevant issue when one exists, e.g. `[#1036](https://github.com/smarty-php/smarty/issues/1036)`. Omit the link when there is no public issue (e.g. embargoed security reports).
+110 -1
View File
@@ -6,11 +6,120 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
## [5.8.4] - 2026-06-29
- Fixed a `TypeError` on PHP 8 when `Security::$static_classes` was set to a non-array value (e.g. the string `'none'`) to disable static class access; any non-array value now cleanly denies access. Use `Security::$static_classes = null` to disable access to all static classes.
- Security: the built-in `stream:` resource type now validates the nested stream wrapper against the security policy, so a template such as `stream:php://filter/...` can no longer bypass `Security::$streams` (including `Security::$streams = null`) to read local files (CWE-22)
## [5.8.3] - 2026-06-28
- fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
## [5.8.2] - 2026-06-24
- Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
- Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
- Security: `{fetch}` no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing `trusted_uri` (CWE-918 server-side request forgery)
- Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template [#1036](https://github.com/smarty-php/smarty/issues/1036)
## [5.8.1] - 2026-06-23
- Re-activated unit tests for user literals, which were previously disabled due to a bug in refactoring to v5.
- fixed a bug where child template's block content leaked into subsequent rendering of the parent template [#1189](https://github.com/smarty-php/smarty/issues/1189)
- Moved all unit test-generated output from inside the working tree to tmp files [#1178](https://github.com/smarty-php/smarty/issues/1178)
## [5.8.0] - 2026-02-15
- Added support for Backed Enums for php versions >= 8.1 [#1171](https://github.com/smarty-php/smarty/pull/1171)
- Added support for new 'matches' operator doing regex matching [#1169](https://github.com/smarty-php/smarty/pull/1169)
- Update documentation to clarify that include inline is currently not implemented in Smarty v5 [#1152](https://github.com/smarty-php/smarty/issues/1152)
- Support for Laravel Collections style object chaining for objects return from function calls implemented as modifiers [#1151](https://github.com/smarty-php/smarty/issues/1151)
## [5.7.0] - 2025-11-19
- PHP 8.5 support
## [5.6.0] - 2025-10-03
- Added support for shorttags in functions [#1005](https://github.com/smarty-php/smarty/issues/1005)
## [5.5.2] - 2025-08-26
- Fixed escaping of array/object keys in debug_print_var
## [5.5.1] - 2025-05-19
- Fix missing support for loading modifiercompilers from plugin dir in BCPluginsAdapter [#1132](https://github.com/smarty-php/smarty/pull/1132)
## [5.5.0] - 2025-05-03
- Support trailing comma in array [#1013](https://github.com/smarty-php/smarty/issues/1013)
## [5.4.5] - 2025-04-15
- Fixed deprecation notice in StringEval in PHP8.4 [#1119](https://github.com/smarty-php/smarty/issues/1119)
## [5.4.4] - 2025-04-13
- Fix syntax error occurring when registering a function plugin that ends with the string 'close' [#1122](https://github.com/smarty-php/smarty/issues/1122)
- Replace SMARTY_VERSION constant with $smarty.version in debug.tpl [#1073](https://github.com/smarty-php/smarty/issues/1073)
## [5.4.3] - 2024-12-23
- Fix PHP backtraces by qualifying/replacing `call_user_func_array` calls [#1074](https://github.com/smarty-php/smarty/issues/1074)
## [5.4.2] - 2024-11-20
- Support the deprecations introduced in PHP 8.4 and added tests for PHP 8.4 [#1043](https://github.com/smarty-php/smarty/pull/1043)
## [5.4.1] - 2024-08-29
- Enable (and fix) unit tests for Windows [#1046](https://github.com/smarty-php/smarty/pull/1046)
- Fix the use of "extends:" to define the inheritance tree on Windows [#1018](https://github.com/smarty-php/smarty/issues/1018)
## [5.4.0] - 2024-08-14
- Fixing forced OpCache invalidation on every template include, which is resulting in fast raising wasted OpCache memory [#1007](https://github.com/smarty-php/smarty/issues/1007)
- Improvement of auto-escaping [#1030](https://github.com/smarty-php/smarty/pull/1030)
## [5.3.1] - 2024-06-16
- Fixed error when using section with nocache [#1034](https://github.com/smarty-php/smarty/issues/1034)
## [5.3.0] - 2024-05-30
- Fix warning when calling hasVariable for an undefined variable [#977](https://github.com/smarty-php/smarty/issues/977)
- Added `$smarty->prependTemplateDir()` method [#1022](https://github.com/smarty-php/smarty/issues/1022)
## [5.2.0] - 2024-05-28
- Fixed a code injection vulnerability in extends-tag. This addresses CVE-2024-35226.
- Added `$smarty->setCacheModifiedCheck()` setter for cache_modified_check
- Added a PSR-4 loading script to allow Smarty to be used without Composer [#1017](https://github.com/smarty-php/smarty/pull/1017)
## [5.1.0] - 2024-04-22
- Prevent deprecation notices during compilation in PHP8.3 [#996](https://github.com/smarty-php/smarty/issues/996)
- Fix that getTemplateVars would return an array of objects instead of the assigned variables values [#994](https://github.com/smarty-php/smarty/issues/994)
- Fix Smarty::assign() not returning $this when called with an array as first parameter [#972](https://github.com/smarty-php/smarty/pull/972)
- Documented support for `{if $element is in $array}` syntax [#937](https://github.com/smarty-php/smarty/issues/937)
- Added support for `{if $element is not in $array}` syntax [#937](https://github.com/smarty-php/smarty/issues/937)
- Using stream variables in templates now throws a deprecation notice [#933](https://github.com/smarty-php/smarty/pull/933)
- Internal compiler classes always return a string (the internal has_code flag has been removed for simplicity) [#918](https://github.com/smarty-php/smarty/pull/918)
- Fix invalid classnames in Runtime code for foreach [#1000](https://github.com/smarty-php/smarty/issues/1000)
## [5.0.2] - 2024-03-28
- Fix Smarty::assign() not returning $this when called with an array as first parameter [#972](https://github.com/smarty-php/smarty/pull/972)
## [5.0.1] - 2024-03-27
- Fix error in Smarty\Smarty::compileAllTemplates() by including missing FilesystemIterator class [#966](https://github.com/smarty-php/smarty/issues/966)
## [5.0.0] - 2024-03-25
- Fixed that scoped variables would overwrite parent scope [#952](https://github.com/smarty-php/smarty/issues/952)
- Removed publicly accessible `$tpl->_var_stack` variable
### Fixed
- Too many shorthand attributes error when using a modifier as a function with more than 3 parameters in an expression [#949](https://github.com/smarty-php/smarty/issues/949)
+7
View File
@@ -100,6 +100,11 @@ Enhancement suggestions are tracked as [GitHub issues](https://github.com/smarty
The [docs](docs/index.md) are written in markdown, configured in [mkdocs.yml](mkdocs.yml) and published
to [GitHub pages](https://smarty-php.github.io/smarty) using [mkdocs](https://www.mkdocs.org/) and [mike](https://github.com/jimporter/mike).
You need Python to build the docs. Install the required packages first:
```bash
pip install -r docs/requirements.txt
```
To preview the docs while you are writing, run:
```bash
mkdocs serve
@@ -115,5 +120,7 @@ If you are a maintainer, you can publish the document using [mike](https://githu
mike deploy 5.x
```
Then, push the `gh-pages` branch.
## Attribution
This guide is based on the **contributing.md**. [Make your own](https://contributing.md/)!
+9 -1
View File
@@ -7,7 +7,7 @@ Smarty is a template engine for PHP, facilitating the separation of presentation
Read the [documentation](https://smarty-php.github.io/smarty/) to find out how to use it.
## Requirements
Smarty v5 can be run with PHP 7.2 to PHP 8.3.
Smarty v5 can be run with PHP 7.2 to PHP 8.5.
## Installation
Smarty versions 3.1.11 or later can be installed with [Composer](https://getcomposer.org/).
@@ -18,3 +18,11 @@ composer require smarty/smarty
````
More in the [Getting Started](./docs/getting-started.md) section of the docs.
## Sponsors
Smarty is sponsored by:
- Marc Laporte [@marclaporte](https://github.com/marclaporte)
- [Temma](https://github.com/Digicreon/Temma), the MVC framework based on Smarty
Thank you!
+4 -5
View File
@@ -11,10 +11,10 @@
## include inline
- Re-introduce merge_compiled_includes and the {include inline} attribute?
## Output buffering
- Fix ob_ output buffering commands being scattered around the codebase
## Output buffering (major)
- Fix ob_ output buffering commands being scattered around the codebase: Smarty's output model is fundamentally "echo everything, wrap in a buffer to capture". An alternative that would be where rendering returns a string rather than echoing — but that touches the entire compiled template format (the unifunc functions all echo) and is a large change.
## Review public static vars
## Review public static vars (major)
- such as _CHARSET and _IS_WINDOWS
## Block / inheritance
@@ -24,9 +24,8 @@
## Plugin system
- fix template security checks in one place in compiler
## Beatify output
## Beatify output (major)
- compiled templates could be proper classes, possibly using [nette/php-generator](https://packagist.org/packages/nette/php-generator)
## Unrelated / other
- review (and avoid) use of 'clone' keyword
- what is 'user literal support', why are unit tests skipped?
-1
View File
@@ -1 +0,0 @@
- Internal compiler classes always return a string (the internal has_code flag has been removed for simplicity) [#918](https://github.com/smarty-php/smarty/pull/918)
-1
View File
@@ -1 +0,0 @@
- Using stream variables in templates now throws a deprecation notice [#933](https://github.com/smarty-php/smarty/pull/933)
-2
View File
@@ -1,2 +0,0 @@
- Documented support for `{if $element is in $array}` syntax [#937](https://github.com/smarty-php/smarty/issues/937)
- Added support for `{if $element is not in $array}` syntax [#937](https://github.com/smarty-php/smarty/issues/937)
+5 -1
View File
@@ -1,4 +1,3 @@
version: "2"
services:
base:
build:
@@ -42,6 +41,11 @@ services:
service: base
build:
dockerfile: ./utilities/testrunners/php83/Dockerfile
php84:
extends:
service: base
build:
dockerfile: ./utilities/testrunners/php84/Dockerfile
volumes:
smarty-code:
+42 -10
View File
@@ -12,24 +12,27 @@ Use `getTemplateDir()` to retrieve the configured paths.
<?php
// set a single directory where the config files are stored
$smarty->setTemplateDir('./config');
$smarty->setTemplateDir('./templates');
// set multiple directories where config files are stored
$smarty->setTemplateDir(['./config', './config_2', './config_3']);
// set multiple directories where templates are stored
$smarty->setTemplateDir(['./templates', './templates_2', './templates_3']);
// add directory where config files are stored to the current list of dirs
$smarty->addTemplateDir('./config_1');
// add directory where templates files are stored to the current list of dirs
$smarty->addTemplateDir('./templates_1');
// add multiple directories to the current list of dirs
$smarty->addTemplateDir([
'./config_2',
'./config_3',
'./templates_2',
'./templates_3',
]);
// chaining of method calls
$smarty->setTemplateDir('./config')
->addTemplateDir('./config_1')
->addTemplateDir('./config_2');
$smarty->setTemplateDir('./templates')
->addTemplateDir('./templates_1')
->addTemplateDir('./templates_2');
// insert a template dir before exising template dirs
$smarty->prependTemplateDir('./more_important_templates')
// get all directories where config files are stored
$template_dirs = $smarty->getTemplateDir();
@@ -140,6 +143,35 @@ Enable auto-escaping for HTML as follows:
$smarty->setEscapeHtml(true);
```
When auto-escaping is enabled, the `|escape` modifier's default mode (`html`) has no effect,
to avoid double-escaping. It is possible to force it with the `force` mode.
Other modes (`htmlall`, `url`, `urlpathinfo`, `quotes`, `javascript`) may be used
with the result you might expect, without double-escaping.
Even when auto-escaping is enabled, you might want to display the content of a variable without
escaping it. To do so, use the `|raw` modifier.
Examples (with auto-escaping enabled):
```smarty
{* these three statements are identical *}
{$myVar}
{$myVar|escape}
{$myVar|escape:'html'}
{* no double-escaping on these statements *}
{$var|escape:'htmlall'}
{$myVar|escape:'url'}
{$myVar|escape:'urlpathinfo'}
{$myVar|escape:'quotes'}
{$myVar|escape:'javascript'}
{* no escaping at all *}
{$myVar|raw}
{* force double-escaping *}
{$myVar|escape:'force'}
```
## Disabling compile check
By default, Smarty tests to see if the
current template has changed since the last time
@@ -50,6 +50,120 @@ separated from surrounding elements by spaces. Note that items listed in
| is \[not\] odd by | | $a is not odd by $b | \[not\] an odd grouping | ($a / $b) % 2 != 0 |
| is in | | $a is in $b | exists in array | in_array($a, $b) |
| is \[not\] in | | $a is not in $b | does not exist in array | !in_array($a, $b) |
| matches | | $a matches $b | regex pattern match | preg_match($b, $a) |
## Regex Matching Operator
The `matches` operator allows you to test if a string matches a regular expression pattern.
### Basic Usage
```smarty
{if "hello" matches "/^[a-z]+$/"}
String matches the pattern!
{/if}
{if $email matches "/^[^@]+@[^@]+\.[^@]+$/"}
Valid email format
{else}
Invalid email format
{/if}
```
### Using Variables
```smarty
{$pattern = '/^[a-zA-Z0-9]{8,}$/'}
{if $password matches $pattern}
Password meets requirements
{else}
Password must be at least 8 alphanumeric characters
{/if}
```
### Pattern Modifiers
The `matches` operator supports all standard PHP regex modifiers:
```smarty
{* Case insensitive matching *}
{if "HELLO" matches "/hello/i"}
Matches (case insensitive)
{/if}
{* Multiline mode *}
{if "line1\nline2" matches "/line2$/m"}
Matches in multiline mode
{/if}
{* Dot matches newlines *}
{if "hello\nworld" matches "/hello.world/s"}
Matches with dotall modifier
{/if}
```
### Complex Conditions
The `matches` operator can be combined with other operators:
```smarty
{if $username matches "/^[a-z]+$/" && $username|length > 3}
Valid username
{else}
Username must be lowercase letters and at least 4 characters
{/if}
{if $input matches "/^[0-9]+$/" || $input matches "/^[a-z]+$/"}
Input is either numeric or lowercase letters
{else}
Invalid input format
{/if}
```
### Practical Examples
**Email Validation:**
```smarty
{if $email matches "/^[^@\s]+@[^@\s]+\.[^@\s]+$/"}
Valid email address
{else}
Please enter a valid email address
{/if}
```
**Password Strength:**
```smarty
{if $password matches "/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/"}
Strong password
{else}
Password must contain uppercase, lowercase, numbers and be at least 8 characters
{/if}
```
**URL Validation:**
```smarty
{if $url matches "/^https?:\/\/(www\.)?[a-z0-9\-]+(\.[a-z]{2,})+/i"}
Valid URL format
{else}
Please enter a valid URL
{/if}
```
**Numeric Validation:**
```smarty
{if $input matches "/^[0-9]+$/"}
Valid numeric input
{else}
Please enter numbers only
{/if}
```
### Notes
- The `matches` operator uses PHP's `preg_match()` function internally
- Pattern delimiters must be valid regex delimiters (typically `/`)
- Invalid patterns will cause PHP warnings but won't break template execution
- For complex regex patterns, consider using variables for better readability
## Ternary
You can use the `?:` (or ternary) operator to test one expression and present the value
@@ -9,7 +9,6 @@
|----------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| file | Yes | The name of the config file to include |
| section | No | The name of the section to load |
| scope | no | How the scope of the loaded variables are treated, which must be one of local, parent or global. local means variables are loaded into the local template context. parent means variables are loaded into both the local context and the parent template that called it. global means variables are available to all templates. |
## Examples
@@ -47,11 +47,13 @@ available within the included template.
## Option Flags
| Name | Description |
|---------|--------------------------------------------------------------------------------------|
| nocache | Disables caching of this subtemplate |
| caching | Enable caching of this subtemplate |
| inline | If set, merge the compile-code of the subtemplate into the compiled calling template |
| Name | Description |
|-----------|--------------------------------------------------------------------------------------|
| nocache | Disables caching of this subtemplate |
| caching | Enable caching of this subtemplate |
| inline \* | If set, merge the compile-code of the subtemplate into the compiled calling template |
\* The `inline` option flag is currently not implemented in Smarty v5. Using it will not trigger an error, however.
## Examples
```smarty
@@ -27,6 +27,13 @@ which item(s) are selected by default as well.
- All parameters that are not in the list above are printed as
name/value-pairs inside each of the created <input\>-tags.
> **Security note**
>
> The `separator` attribute is written into the generated HTML without escaping,
> so it can contain markup such as `separator='<br />'`. If its value originates
> from untrusted input, escape it yourself first to avoid cross-site scripting
> (XSS). Option values and labels are escaped automatically.
## Examples
```php
<?php
@@ -28,6 +28,13 @@ selected by default as well.
- All parameters that are not in the list above are output as
name/value-pairs inside each of the created `<input>`-tags.
> **Security note**
>
> The `separator` attribute is written into the generated HTML without escaping,
> so it can contain markup such as `separator='<br />'`. If its value originates
> from untrusted input, escape it yourself first to avoid cross-site scripting
> (XSS). Option values and labels are escaped automatically.
## Examples
```php
@@ -47,6 +47,14 @@ name/value-pairs inside the `<select>` tags of day, month and year.
> There is an useful php function on the [date tips page](../../appendixes/tips.md)
> for converting `{html_select_date}` form values to a timestamp.
> **Security note**
>
> The `*_extra` attributes, `field_separator`/`option_separator`, and any
> unrecognised parameter (which is emitted as a raw attribute on the `<select>`
> tag) are written into the generated HTML without escaping. If any of these
> values originate from untrusted input, escape them yourself first to avoid
> cross-site scripting (XSS).
## Exaples
Template code
@@ -47,6 +47,14 @@ parseable by PHP's [`strtotime()`](https://www.php.net/strtotime).
| meridian\_empty | null | If supplied then the first element of the meridian's select-box has this value as it's label and "" as it's value. This is useful to make the select-box read "Please select an meridian" for example. |
> **Security note**
>
> The `*_extra` attributes, `field_separator`/`option_separator`, and any
> unrecognised parameter (which is emitted as a raw attribute on the `<select>`
> tag) are written into the generated HTML without escaping. If any of these
> values originate from untrusted input, escape them yourself first to avoid
> cross-site scripting (XSS).
## Examples
```smarty
@@ -31,6 +31,15 @@ dumps an array of data into an HTML `<table>`.
- `trailpad` is the value put into the trailing cells on the last
table row if there are any present.
> **Security note**
>
> The `loop`/`cols` data and the `caption`, `trailpad`, `table_attr`, `tr_attr`,
> `td_attr` and `th_attr` attributes are written into the generated HTML without
> escaping (this is by design — e.g. `table_attr='border="1"'`). If any of these
> values originate from untrusted input, escape them yourself first (e.g. with the
> [`escape`](../language-modifiers/language-modifier-escape.md) modifier) to avoid
> cross-site scripting (XSS).
## Examples
```php
@@ -24,6 +24,14 @@ spiders to lift email addresses off of a site.
> you can use hex encoding too.
> **Security note**
>
> The `extra` attribute is written into the generated `<a>` tag without escaping,
> so that you can add attributes such as `extra='class="mailto"'`. If you pass a
> value that originates from untrusted input, escape it yourself first (e.g. with
> the [`escape`](../language-modifiers/language-modifier-escape.md) modifier) to
> avoid cross-site scripting (XSS).
## Examples
```smarty
@@ -0,0 +1,10 @@
# empty
Returns true if var does not exist or has a value that is empty or equal to zero, aka falsey, see conversion to boolean. Otherwise returns false.
## Basic usage
```smarty
{if $myVar|empty}it's an empty variable{/if}
{if empty($myVar)}it's an empty variable{/if}
```
@@ -73,6 +73,6 @@ This snippet is useful for emails, but see also
<a href="mailto:{$EmailAddress|escape:'hex'}">{$EmailAddress|escape:'mail'}</a>
```
See also [escaping smarty parsing](../language-basic-syntax/language-escaping.md),
See also [auto-escaping](../../api/configuring.md#enabling-auto-escaping), [escaping smarty parsing](../language-basic-syntax/language-escaping.md),
[`{mailto}`](../language-custom-functions/language-function-mailto.md) and the [obfuscating email
addresses](../../appendixes/tips.md#obfuscating-e-mail-addresses) page.
addresses](../../appendixes/tips.md#obfuscating-e-mail-addresses) pages.
@@ -0,0 +1,17 @@
# in_array
test if value is contained in an array
## Basic usage
```smarty
{if in_array('value2', $myarray)} value2 is in myarray{/if}
```
Can be replaced by operator *is in*
```smarty
{if 'value2' is in $myarray}value2 is in myarray{/if}
```
See Also [operators](../language-basic-syntax/language-syntax-operators.md)
@@ -0,0 +1,9 @@
# is_array
Return true if the variable passed to it is an array.
## Basic usage
```smarty
{if $myVar|is_array}it's an array{/if}
```
@@ -0,0 +1,8 @@
# raw
Prevents variable escaping when [auto-escaping](../../api/configuring.md#enabling-auto-escaping) is activated.
## Basic usage
```smarty
{$myVar|raw}
```
@@ -123,4 +123,89 @@ this will output:
```html
name: Zaphod Beeblebrox<br />
email: zaphod@slartibartfast.example.com<br />
```
```
## Backed Enums (PHP 8.1+)
Smarty supports accessing properties of [backed enums](https://www.php.net/manual/en/language.enumerations.backed.php) introduced in PHP 8.1.
### Accessing Enum Properties
You can access the `name` and `value` properties of backed enum cases:
```smarty
{* Access enum case properties *}
<option id="{MyEnum::Foo->name}">{MyEnum::Foo->value}</option>
```
### Complete Example
```php
<?php
use Smarty\Smarty;
// Define a backed enum
enum Status: string {
case Active = 'active';
case Inactive = 'inactive';
case Pending = 'pending';
}
$smarty = new Smarty();
$smarty->assign('currentStatus', Status::Active);
$smarty->display('template.tpl');
```
`template.tpl`:
```smarty
{* Display enum properties *}
Current status: {$currentStatus->name} (value: {$currentStatus->value})
{* Use in HTML attributes *}
<select name="status">
<option value="{Status::Active->value}" {if $currentStatus->name === 'Active'}selected{/if}>Active</option>
<option value="{Status::Inactive->value}" {if $currentStatus->name === 'Inactive'}selected{/if}>Inactive</option>
<option value="{Status::Pending->value}" {if $currentStatus->name === 'Pending'}selected{/if}>Pending</option>
</select>
```
This would output:
```html
Current status: Active (value: active)
<select name="status">
<option value="active" selected>Active</option>
<option value="inactive">Inactive</option>
<option value="pending">Pending</option>
</select>
```
### Integer-backed Enums
Integer-backed enums work the same way:
```php
<?php
enum Priority: int {
case Low = 1;
case Medium = 2;
case High = 3;
}
$smarty->assign('priority', Priority::High);
```
```smarty
{* Access integer enum properties *}
Priority level: {$priority->value} ({$priority->name})
```
Output:
```html
Priority level: 3 (High)
```
> **Note**: Backed enum support requires PHP 8.1 or higher. The enum must be registered or available in the current namespace.
+2
View File
@@ -22,6 +22,8 @@ Some of Smarty's features:
- [Template Inheritance](api/inheritance.md) for
easy management of template content.
- [Plugin](api/extending/introduction.md) architecture
- Regex pattern matching with the [`matches`](designers/language-basic-syntax/language-syntax-operators.md#regex-matching-operator) operator
- Support for PHP 8.1+ [backed enums](designers/language-variables/language-assigned-variables.md#backed-enums-php-81)
## Separation of presentation from application code
- This means templates can certainly contain logic under the condition
+9 -1
View File
@@ -1,7 +1,7 @@
# Getting started
## Requirements
Smarty can be run with PHP 7.2 to PHP 8.3.
Smarty can be run with PHP 7.2 to PHP 8.5.
## Installation
Smarty can be installed with [Composer](https://getcomposer.org/).
@@ -25,9 +25,17 @@ Here's how you create an instance of Smarty in your PHP scripts:
```php
<?php
// Instantiated via composer
require 'vendor/autoload.php';
use Smarty\Smarty;
$smarty = new Smarty();
// or ...
// Instantiated directly
require("/path/to/smarty/libs/Smarty.class.php");
use Smarty\Smarty;
$smarty = new Smarty();
```
Now that the library files are in place, it's time to set up the Smarty
+30
View File
@@ -0,0 +1,30 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Generator: Adobe Illustrator 21.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
viewBox="0 0 343.3 174.5" style="enable-background:new 0 0 343.3 174.5;" xml:space="preserve">
<style type="text/css">
.st0{fill:#E60000;}
.st1{fill:#FFFFFF;}
</style>
<path class="st0" d="M333.8,0H9.5C4.3,0,0,4.3,0,9.5v155.4c0,5.3,4.3,9.5,9.5,9.5h324.3c5.3,0,9.5-4.3,9.5-9.5V9.5
C343.3,4.3,339,0,333.8,0z"/>
<g>
<path class="st1" d="M148.7,58.5c-5.2,0-4.7,4.3-4.7,9.5v38.6c0,5.3,4.3,9.5,9.5,9.5c5.2,0,9.5-4.3,9.5-9.5V81.5
C163,65.7,154,58.5,148.7,58.5L148.7,58.5z"/>
<path class="st1" d="M47.1,72.6c-5.2,0-4.7,4.3-4.7,9.5v24.5c0,5.2,4.3,9.5,9.5,9.5c5.2,0,9.5-4.3,9.5-9.5V95.5
C61.4,79.8,52.4,72.6,47.1,72.6L47.1,72.6z"/>
<path class="st1" d="M200.7,58.3c-7.4,0-13.8,6.9-15.2,11.4c-3-7.6-8.5-11.2-12.2-11.2c-5.2,0-4.7,4.3-4.7,9.5l0.1,9.5v29.1
c0,5.2,4.3,9.5,9.5,9.5c5.2,0,9.5-4.3,9.5-9.5V84.4c0-3.8,1.2-8.4,7-8.4c1.7,0,6.8,0,6.8,8.4v22.2c0,5.2,4.3,9.5,9.5,9.5
c5.2,0,9.5-4.3,9.5-9.5V79.8C220.5,66.5,212.9,58.3,200.7,58.3L200.7,58.3z"/>
<path class="st1" d="M130.8,58.4c-4.4,0-7.7,2.6-9.1,7.1l-6.1,19.9l-6.1-19.7c-1.4-4.6-5.1-7.4-9.6-7.4h-0.9
c-4.5,0-8.2,2.8-9.6,7.4l-5.4,17.5c-1.5-4.9-5.8-31.4-31.1-33c-8.7-0.5-11.2,4.7-12,7.6c-0.7,2.8-0.4,5.2,1.3,7.3
c1.7,2.2,5,2.5,8.9,4C61,73,63.6,81.8,65.9,87.3c0.8,1.9,6.4,20.8,6.4,20.8c1.8,5.2,5.4,8.1,10.2,8.1H83c4.8,0,8.4-2.9,10-7.8
l6.3-19.7l6.2,19.7c1.6,5,5.2,7.8,10,7.8h0.5c4.8,0,8.4-2.9,10.2-8L139.2,71l0-0.1c0.2-0.7,0.6-2.3,0.6-3.6
C139.8,62.3,135.9,58.4,130.8,58.4L130.8,58.4z"/>
<path class="st1" d="M276,99.9c-0.2-0.2-0.4-0.4-0.6-0.6l-14.1-14.4l11.3-9.6l0,0c1.9-1.8,4.1-4.3,4.1-8c0-4.3-3.2-8.7-8.6-8.7
c-3.6,0-5.9,1.9-8,3.9l-15,14.2c-1.6-12.5-9.2-18.4-14-18.4c-4.2,0-4.8,2.7-4.8,6.5c-0.1,1.1-0.1,2.4-0.1,3.7v38
c0,4.9,3.8,9.1,8.6,9.6c0.3,0,0.7,0.1,1,0.1c5.3,0,9.5-4.4,9.5-9.6v-7.5l3.3-3l14.5,16.4c0.6,0.6,1.3,1.3,2.1,1.9
c1.1,0.9,2.5,1.5,4.2,1.8c0.1,0,1.2,0.1,1.8,0.1c4.3-0.1,8.7-3.2,8.6-8.6C279.6,104.1,277.9,101.9,276,99.9L276,99.9z"/>
<circle class="st1" cx="293.3" cy="106.7" r="9.5"/>
</g>
</svg>

After

Width:  |  Height:  |  Size: 2.2 KiB

+22
View File
@@ -0,0 +1,22 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- Generator: Adobe Illustrator 25.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" style="enable-background:new 0 0 1000 1000;" xml:space="preserve">
<style type="text/css">
.st0{fill:#F5E0B4;}
.st1{fill:#383535;}
.st2{fill:#FBDE3D;}
.st3{fill:#8C919F;}
.st4{fill:#CACED5;}
.st5{fill:#FFFFFF;}
</style>
<g>
<polygon class="st0" points="782.2,925.8 733.4,643.2 996.4,532.7 745.7,396.4 823.6,120.2 560.7,232.2 391.6,0 313.7,274.7 26.5,260.1 194.4,491.3 3.6,705.5 289.4,721.3 340.5,1000 529.1,787 "/>
<path class="st1" d="M706.9,493.4c0-126-102.2-228.2-228.2-228.2c-126,0-228.2,102.2-228.2,228.2c0,81.8,43.1,153.6,107.8,193.8 v202.6l43.5,43.5l0.2-0.2h150.6l0.2,0.2l43.5-43.5V689C662.6,649,706.9,576.4,706.9,493.4z"/>
<path class="st2" d="M682.2,492.9c0-112.7-91.3-204-204-204s-204,91.3-204,204c0,78,43.8,145.8,108.1,180.1v93.6h191.7V673 C638.4,638.7,682.2,571,682.2,492.9z"/>
<g>
<polygon class="st3" points="382.7,790.4 382.7,881.1 412,910.3 544.9,910.3 574.1,881.1 574.1,790.4 "/>
<polygon class="st4" points="540,813.2 540,866.5 527,879.5 540.4,892.9 558.7,874.6 558.9,874.6 558.9,813.2 "/>
</g>
<path class="st5" d="M478.3,310.4c-5,0-9.1,4.1-9.1,9.1c0,5,4.1,9.1,9.1,9.1c90.7,0,164.3,73.5,164.3,164.3c0,5,4.1,9.1,9.1,9.1 s9.1-4.1,9.1-9.1C660.8,392.1,579.1,310.4,478.3,310.4z"/>
</g>
</svg>

After

Width:  |  Height:  |  Size: 1.5 KiB

+68
View File
@@ -0,0 +1,68 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="195mm"
height="43.093071mm"
viewBox="0 0 195 43.093071"
version="1.1"
id="svg1156"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">
<defs
id="defs1153" />
<g
id="layer1"
transform="translate(-6.9662436,-7.8467567)">
<g
id="g21305-1"
style="font-size:33.5139px;line-height:1.25;stroke-width:0.0700042"
transform="translate(1.0553387,0.93988827)">
<g
id="g21248-5">
<rect
style="font-size:33.5139px;line-height:1.25;fill:#107ef4;fill-opacity:1;stroke:none;stroke-width:0.0727743"
id="rect846-9-0-1-2-7-2-1-9"
width="43.093071"
height="43.093071"
x="5.9109049"
y="6.9068685"
ry="2.4179134" />
<path
d="M 22.234889,18.179756 V 36.734061 H 19.567887 V 18.179756 h -6.882585 v -2.35155 h 16.403494 v 2.35155 z"
style="font-size:31.75px;line-height:1.25;font-family:FreeSans;-inkscape-font-specification:FreeSans;fill:#ffffff;stroke-width:0.238978"
id="path16874-7-9-2-4" />
<path
d="m 41.725989,35.328866 v 1.806679 q -0.946355,0.258097 -1.634613,0.258097 -2.380228,0 -2.46626,-2.380228 -1.691969,2.380228 -4.674422,2.380228 -1.548582,0 -2.580969,-0.745614 v 6.395069 H 27.989497 V 21.707084 h 2.380228 v 10.639329 q 0,1.347839 0.831645,2.150808 0.831646,0.802968 2.23684,0.802968 1.864034,0 2.982454,-1.376517 1.11842,-1.405195 1.11842,-3.699389 v -8.517199 h 2.380227 v 12.503362 q 0,1.175775 1.290485,1.175775 0.229419,0 0.516193,-0.05736 z"
style="font-size:31.75px;line-height:1.25;font-family:FreeSans;-inkscape-font-specification:FreeSans;fill:#ffffff;stroke-width:0.238978"
id="path16871-6-1-9-9" />
</g>
<g
aria-label="Temma"
transform="matrix(0.91459055,0,0,0.9686482,-4.3308403,0.67015143)"
id="text87274-2-5-0"
style="font-size:39.8454px;line-height:1.25;font-family:'DejaVu Sans';-inkscape-font-specification:'DejaVu Sans';fill:#000000;stroke-width:0.0205099">
<path
d="m 89.719297,15.597759 v 4.50253 h -10.24872 v 23.30956 h -5.578356 v -23.30956 h -10.24872 v -4.50253 z"
style="font-weight:600;font-family:Poppins;-inkscape-font-specification:'Poppins Semi-Bold';fill:#000000"
id="path7781-61-0-9" />
<path
d="m 109.19647,31.894528 q 0,1.195362 -0.15939,2.151652 H 92.899673 q 0.199227,2.390724 1.673504,3.745467 1.4743,1.354744 3.62597,1.354744 3.107933,0 4.422823,-2.669642 h 6.01666 q -0.95629,3.187632 -3.66578,5.259593 -2.70948,2.032115 -6.654173,2.032115 -3.18765,0 -5.737768,-1.394588 -2.51026,-1.434435 -3.944694,-4.024386 -1.394589,-2.589951 -1.394589,-5.97681 0,-3.426705 1.394589,-6.016656 1.394589,-2.589951 3.904849,-3.98454 2.510273,-1.394589 5.777613,-1.394589 3.147783,0 5.618193,1.354743 2.51026,1.354744 3.86501,3.865004 1.39459,2.470415 1.39459,5.697893 z m -5.77759,-1.593816 q -0.0398,-2.151652 -1.55397,-3.426705 -1.51411,-1.314898 -3.705613,-1.314898 -2.07197,0 -3.50643,1.275053 -1.394586,1.235207 -1.713349,3.46655 z"
style="font-weight:600;font-family:Poppins;-inkscape-font-specification:'Poppins Semi-Bold';fill:#000000"
id="path7783-8-3-1" />
<path
d="m 140.67428,21.016733 q 4.06423,0 6.53465,2.51026 2.51026,2.470415 2.51026,6.9331 v 12.949756 h -5.57836 V 31.217156 q 0,-2.589951 -1.3149,-3.944695 -1.3149,-1.394589 -3.58608,-1.394589 -2.27119,0 -3.62594,1.394589 -1.31489,1.354744 -1.31489,3.944695 v 12.192693 h -5.57836 V 31.217156 q 0,-2.589951 -1.3149,-3.944695 -1.3149,-1.394589 -3.58608,-1.394589 -2.31104,0 -3.66578,1.394589 -1.3149,1.354744 -1.3149,3.944695 v 12.192693 h -5.57836 V 21.335496 h 5.57836 v 2.669642 q 1.07583,-1.394589 2.74933,-2.191497 1.71336,-0.796908 3.74547,-0.796908 2.58995,0 4.62207,1.115671 2.03211,1.075826 3.14778,3.107942 1.07583,-1.91258 3.10795,-3.068096 2.07196,-1.155517 4.46268,-1.155517 z"
style="font-weight:600;font-family:Poppins;-inkscape-font-specification:'Poppins Semi-Bold';fill:#000000"
id="path7785-7-6-7" />
<path
d="m 182.4322,21.016733 q 4.06423,0 6.53465,2.51026 2.51026,2.470415 2.51026,6.9331 v 12.949756 h -5.57836 V 31.217156 q 0,-2.589951 -1.31489,-3.944695 -1.3149,-1.394589 -3.58609,-1.394589 -2.27119,0 -3.62593,1.394589 -1.3149,1.354744 -1.3149,3.944695 v 12.192693 h -5.57836 V 31.217156 q 0,-2.589951 -1.31489,-3.944695 -1.3149,-1.394589 -3.58609,-1.394589 -2.31103,0 -3.66578,1.394589 -1.3149,1.354744 -1.3149,3.944695 v 12.192693 h -5.57835 V 21.335496 h 5.57835 v 2.669642 q 1.07583,-1.394589 2.74934,-2.191497 1.71335,-0.796908 3.74546,-0.796908 2.58996,0 4.62207,1.115671 2.03212,1.075826 3.14779,3.107942 1.07582,-1.91258 3.10794,-3.068096 2.07196,-1.155517 4.46268,-1.155517 z"
style="font-weight:600;font-family:Poppins;-inkscape-font-specification:'Poppins Semi-Bold';fill:#000000"
id="path7787-9-1-7" />
<path
d="m 195.34205,32.292982 q 0,-3.347014 1.3149,-5.936965 1.35474,-2.589951 3.62593,-3.98454 2.31104,-1.394589 5.14006,-1.394589 2.47041,0 4.3033,0.996135 1.87274,0.996135 2.98841,2.51026 v -3.147787 h 5.6182 v 22.074353 h -5.6182 v -3.227478 q -1.07583,1.553971 -2.98841,2.589952 -1.87273,0.996134 -4.34315,0.996134 -2.78917,0 -5.10021,-1.434434 -2.27119,-1.434434 -3.62593,-4.024385 -1.3149,-2.629797 -1.3149,-6.016656 z m 17.3726,0.07969 q 0,-2.032116 -0.79691,-3.46655 -0.79691,-1.47428 -2.15165,-2.231343 -1.35475,-0.796908 -2.90872,-0.796908 -1.55397,0 -2.86887,0.757063 -1.31489,0.757062 -2.15165,2.231342 -0.79691,1.434435 -0.79691,3.426705 0,1.99227 0.79691,3.506395 0.83676,1.47428 2.15165,2.271188 1.35475,0.796908 2.86887,0.796908 1.55397,0 2.90872,-0.757062 1.35474,-0.796908 2.15165,-2.231343 0.79691,-1.47428 0.79691,-3.506395 z"
style="font-weight:600;font-family:Poppins;-inkscape-font-specification:'Poppins Semi-Bold';fill:#000000"
id="path7789-2-0-1" />
</g>
</g>
</g>
</svg>

After

Width:  |  Height:  |  Size: 6.0 KiB

+30 -1
View File
@@ -8,6 +8,25 @@ It allows you to write **templates**, using **variables**, **modifiers**, **func
<p>
The number of pixels is: {math equation="x * y" x=$height y=$width}.
</p>
<p>
{if $email matches "/^[^@]+@[^@]+\.[^@]+$/"}
Valid email address
{else}
Please enter a valid email
{/if}
</p>
```
```html
<h1>Hello world</h1>
<p>
The number of pixels is: 307200.
</p>
<p>
Valid email address
</p>
```
When this template is rendered, with the value "Hello world" for the variable $title, 640 for $width,
@@ -32,4 +51,14 @@ and 480 for $height, the result is:
- [Troubleshooting](./appendixes/troubleshooting.md)
## Source code
- [Smarty repository at GitHub](https://github.com/smarty-php/smarty)
- [Smarty repository at GitHub](https://github.com/smarty-php/smarty)
## Sponsors
### <img src="img/iwink-logo.svg" alt="iWink logo" width="100">
[iWink](https://www.iwink.nl/), fullservice digital agency
### <img src="img/temma-logo.svg" alt="Temma logo" width="100">
[Temma](https://www.temma.net/), the MVC framework based on Smarty
+14
View File
@@ -0,0 +1,14 @@
# Python dependencies for building/previewing the docs.
#
# pip install -r docs/requirements.txt
# mkdocs serve # local preview
# mike deploy 5.x # publish
#
# pymdown-extensions must be >=11: earlier releases pass filename=None to
# Pygments, and Pygments >=2.19 then crashes with
# "'NoneType' object has no attribute 'replace'" on any untitled code block.
mkdocs>=1.6
mkdocs-material>=9.7
pymdown-extensions>=11
Pygments>=2.19
mike>=2.2
+14
View File
@@ -49,6 +49,11 @@ $smarty->registerPlugin('modifier', 'my_special_func', 'my_special_func');
But you may want to consider writing a proper [extension](api/extending/extensions.md).
#### Passing parameters by reference
You cannot use plugins that expect a parameter by reference anymore. PHP-function such as `reset()`, `prev()`,
`next()` and `end()` can be registered as plugin, but they won't work because they expect a parameter by
reference and Smarty will try to pass it by value.
### Removed undocumented tags
Smarty 4 still supported some tags that have been carried over from previous version, but have never been documented.
@@ -102,6 +107,15 @@ Search your code for the following changes:
- `$smarty->assignByRef()` should be replaced with `$smarty->assign()`
- `$smarty->loadPlugin()` should be replaced with `$smarty->registerPlugin()`
### Removed undocumented magic API methods
Smarty v4 allowed setting (internal) properties for which no setter existed by using magic methods
that start with either `set` or `get`. This has been removed in Smarty 5.
For example, `$smarty->setErrorUnassigned(true);` would set the `error_unassigned` property.
Every setter of getter that was ever documented or unit tested has been kept.
### Removed PHP constants
The following constants have been removed to prevent global side effects.
+42
View File
@@ -0,0 +1,42 @@
<?php
/////////////////////////////////////////////////////////////////////
// This is a stub PSR-4 loading script that gets all the pieces of //
// Smarty 5.x loaded without requiring the use of composer. It's //
// not really a 'class' file, but the name is used so we're //
// backwards compatible with previous versions of Smarty. //
// //
// Example: //
// require_once("/path/to/smarty/libs/Smarty.class.php"); //
// //
// $smarty = new Smarty\Smarty; //
// $smarty->testInstall(); //
/////////////////////////////////////////////////////////////////////
define('__SMARTY_DIR', __DIR__ . '/../src/');
// Global function declarations
require_once(__SMARTY_DIR . "/functions.php");
spl_autoload_register(function ($class) {
// Class prefix
$prefix = 'Smarty\\';
// Does the class use the namespace prefix?
$len = strlen($prefix);
if (strncmp($prefix, $class, $len) !== 0) {
// If not, move to the next registered autoloader
return;
}
// Hack off the prefix part
$relative_class = substr($class, $len);
// Build a path to the include file
$file = __SMARTY_DIR . str_replace('\\', '/', $relative_class) . '.php';
// If the file exists, require it
if (file_exists($file)) {
require_once($file);
}
});
+4
View File
@@ -57,9 +57,12 @@ nav:
- 'date_format': 'designers/language-modifiers/language-modifier-date-format.md'
- 'debug_print_var': 'designers/language-modifiers/language-modifier-debug-print-var.md'
- 'default': 'designers/language-modifiers/language-modifier-default.md'
- 'empty': "designers/language-modifiers/language-modifier-empty.md"
- 'escape': 'designers/language-modifiers/language-modifier-escape.md'
- 'from_charset': 'designers/language-modifiers/language-modifier-from-charset.md'
- 'indent': 'designers/language-modifiers/language-modifier-indent.md'
- 'in_array': 'designers/language-modifiers/language-modifier-in_array.md'
- 'is_array': 'designers/language-modifiers/language-modifier-is_array.md'
- 'isset': 'designers/language-modifiers/language-modifier-isset.md'
- 'join': 'designers/language-modifiers/language-modifier-join.md'
- 'json_encode': 'designers/language-modifiers/language-modifier-json-encode.md'
@@ -67,6 +70,7 @@ nav:
- 'noprint': 'designers/language-modifiers/language-modifier-noprint.md'
- 'number_format': 'designers/language-modifiers/language-modifier-number-format.md'
- 'nl2br': 'designers/language-modifiers/language-modifier-nl2br.md'
- 'raw': 'designers/language-modifiers/language-modifier-raw.md'
- 'regex_replace': 'designers/language-modifiers/language-modifier-regex-replace.md'
- 'replace': 'designers/language-modifiers/language-modifier-replace.md'
- 'round': 'designers/language-modifiers/language-modifier-round.md'
-1
View File
@@ -20,7 +20,6 @@
<testsuite name="foo">
<directory>./tests/UnitTests/</directory>
<exclude>./tests/UnitTests/CacheResourceTests/Memcache/CacheResourceCustomMemcacheTest.php</exclude>
<exclude>./tests/UnitTests/CacheResourceTests/Apc/CacheResourceCustomApcTest.php</exclude>
<exclude>./tests/UnitTests/CacheModify/ModifiedSince/HttpModifiedSinceTest.php</exclude>
</testsuite>
</testsuites>
+2 -1
View File
@@ -5,7 +5,7 @@
# - ./run-tests-for-all-php-versions.sh --group 20221124
# - ./run-tests-for-all-php-versions.sh --exclude-group slow
COMPOSE_CMD="mutagen-compose"
COMPOSE_CMD="docker compose"
$COMPOSE_CMD run --rm php72 ./run-tests.sh $@ && \
$COMPOSE_CMD run --rm php73 ./run-tests.sh $@ && \
@@ -14,3 +14,4 @@ $COMPOSE_CMD run --rm php80 ./run-tests.sh $@ && \
$COMPOSE_CMD run --rm php81 ./run-tests.sh $@ && \
$COMPOSE_CMD run --rm php82 ./run-tests.sh $@
$COMPOSE_CMD run --rm php83 ./run-tests.sh $@
$COMPOSE_CMD run --rm php84 ./run-tests.sh $@
+1 -1
View File
@@ -14,6 +14,6 @@ class BlockPluginWrapper extends Base {
}
public function handle($params, $content, Template $template, &$repeat) {
return call_user_func_array($this->callback, [$params, $content, &$template, &$repeat]);
return \call_user_func_array($this->callback, [$params, $content, &$template, &$repeat]);
}
}
-3
View File
@@ -20,9 +20,6 @@ use Smarty\Template;
* - indent_char - string (" ")
* - wrap_boundary - boolean (true)
*
* @link https://www.smarty.net/manual/en/language.function.textformat.php {textformat}
* (Smarty online manual)
*
* @param array $params parameters
* @param string $content contents of the block
* @param Template $template template object
+1 -1
View File
@@ -44,7 +44,7 @@ abstract class Base
*/
abstract public function process(
Template $_template,
Cached $cached = null,
?Cached $cached = null,
$update = false
);
+1 -1
View File
@@ -139,7 +139,7 @@ abstract class Custom extends Base
*/
public function process(
Template $_smarty_tpl,
\Smarty\Template\Cached $cached = null,
?\Smarty\Template\Cached $cached = null,
$update = false
) {
if (!$cached) {
+4 -10
View File
@@ -99,7 +99,7 @@ class File extends Base
*/
public function process(
Template $_smarty_tpl,
Cached $cached = null,
?Cached $cached = null,
$update = false
) {
$_smarty_tpl->getCached()->setValid(false);
@@ -127,8 +127,6 @@ class File extends Base
&& (!function_exists('ini_get') || strlen(ini_get('opcache.restrict_api'))) < 1
) {
opcache_invalidate($_template->getCached()->filepath, true);
} elseif (function_exists('apc_compile_file')) {
apc_compile_file($_template->getCached()->filepath);
}
$cached = $_template->getCached();
$cached->timestamp = $cached->exists = is_file($cached->filepath);
@@ -145,7 +143,7 @@ class File extends Base
*
* @param Template $_template template object
*
* @return string content
* @return string|false content
*/
public function retrieveCachedContent(Template $_template)
{
@@ -223,10 +221,8 @@ class File extends Base
$_filepath = (string)$_file;
// directory ?
if ($_file->isDir()) {
if (!$_cache->isDot()) {
// delete folder if empty
@rmdir($_file->getPathname());
}
// delete folder if empty
@rmdir($_file->getPathname());
} else {
// delete only php files
if (substr($_filepath, -4) !== '.php') {
@@ -279,8 +275,6 @@ class File extends Base
&& (!function_exists('ini_get') || strlen(ini_get("opcache.restrict_api")) < 1)
) {
opcache_invalidate($_filepath, true);
} elseif (function_exists('apc_delete_file')) {
apc_delete_file($_filepath);
}
}
}
+1 -1
View File
@@ -103,7 +103,7 @@ abstract class KeyValueStore extends Base
*/
public function process(
Template $_smarty_tpl,
Cached $cached = null,
?Cached $cached = null,
$update = false
) {
if (!$cached) {
+144
View File
@@ -0,0 +1,144 @@
<?php
namespace Smarty\Compile;
/**
* This class handles compiling the attributes.
*/
class AttributeCompiler
{
/**
* Array of names of required attributes required by tag
*
* @var array
*/
protected $required_attributes = [];
/**
* Array of names of optional attribute required by tag
* use array('_any') if there is no restriction of attributes names
*
* @var array
*/
protected $optional_attributes = [];
/**
* Shorttag attribute order defined by its names
*
* @var array
*/
protected $shorttag_order = [];
/**
* Array of names of valid option flags
*
* @var array
*/
protected $option_flags = [];
public function __construct(
array $required_attributes = [],
array $optional_attributes = [],
array $shorttag_order = [],
array $option_flags = []
) {
$this->required_attributes = $required_attributes;
$this->optional_attributes = $optional_attributes;
$this->shorttag_order = $shorttag_order;
$this->option_flags = $option_flags;
}
/**
* This function checks if the attributes passed are valid
* The attributes passed for the tag to compile are checked against the list of required and
* optional attributes. Required attributes must be present. Optional attributes are check against
* the corresponding list. The keyword '_any' specifies that any attribute will be accepted
* as valid
*
* @param object $compiler compiler object
* @param array $attributes attributes applied to the tag
*
* @return array of mapped attributes for further processing
*/
public function getAttributes($compiler, $attributes)
{
$_indexed_attr = [];
$options = array_fill_keys($this->option_flags, true);
foreach ($attributes as $key => $mixed) {
// shorthand ?
if (!is_array($mixed)) {
// options flag ?
if (isset($options[trim($mixed, '\'"')])) {
$_indexed_attr[trim($mixed, '\'"')] = true;
// shorthand attribute ?
} elseif (isset($this->shorttag_order[$key])) {
$_indexed_attr[$this->shorttag_order[$key]] = $mixed;
} else {
// too many shorthands
$compiler->trigger_template_error('too many shorthand attributes', null, true);
}
// named attribute
} else {
foreach ($mixed as $k => $v) {
// options flag?
if (isset($options[$k])) {
if (is_bool($v)) {
$_indexed_attr[$k] = $v;
} else {
if (is_string($v)) {
$v = trim($v, '\'" ');
}
// Mapping array for boolean option value
static $optionMap = [1 => true, 0 => false, 'true' => true, 'false' => false];
if (isset($optionMap[$v])) {
$_indexed_attr[$k] = $optionMap[$v];
} else {
$compiler->trigger_template_error(
"illegal value '" . var_export($v, true) .
"' for options flag '{$k}'",
null,
true
);
}
}
// must be named attribute
} else {
$_indexed_attr[$k] = $v;
}
}
}
}
// check if all required attributes present
foreach ($this->required_attributes as $attr) {
if (!isset($_indexed_attr[$attr])) {
$compiler->trigger_template_error("missing '{$attr}' attribute", null, true);
}
}
// check for not allowed attributes
if ($this->optional_attributes !== ['_any']) {
$allowedAttributes = array_fill_keys(
array_merge(
$this->required_attributes,
$this->optional_attributes,
$this->option_flags
),
true
);
foreach ($_indexed_attr as $key => $dummy) {
if (!isset($allowedAttributes[$key]) && $key !== 0) {
$compiler->trigger_template_error("unexpected '{$key}' attribute", null, true);
}
}
}
// default 'false' for all options flags not set
foreach ($this->option_flags as $flag) {
if (!isset($_indexed_attr[$flag])) {
$_indexed_attr[$flag] = false;
}
}
return $_indexed_attr;
}
}
+6 -78
View File
@@ -82,84 +82,12 @@ abstract class Base implements CompilerInterface {
* @return array of mapped attributes for further processing
*/
protected function getAttributes($compiler, $attributes) {
$_indexed_attr = [];
$options = array_fill_keys($this->option_flags, true);
foreach ($attributes as $key => $mixed) {
// shorthand ?
if (!is_array($mixed)) {
// options flag ?
if (isset($options[trim($mixed, '\'"')])) {
$_indexed_attr[trim($mixed, '\'"')] = true;
// shorthand attribute ?
} elseif (isset($this->shorttag_order[$key])) {
$_indexed_attr[$this->shorttag_order[$key]] = $mixed;
} else {
// too many shorthands
$compiler->trigger_template_error('too many shorthand attributes', null, true);
}
// named attribute
} else {
foreach ($mixed as $k => $v) {
// options flag?
if (isset($options[$k])) {
if (is_bool($v)) {
$_indexed_attr[$k] = $v;
} else {
if (is_string($v)) {
$v = trim($v, '\'" ');
}
// Mapping array for boolean option value
static $optionMap = [1 => true, 0 => false, 'true' => true, 'false' => false];
if (isset($optionMap[$v])) {
$_indexed_attr[$k] = $optionMap[$v];
} else {
$compiler->trigger_template_error(
"illegal value '" . var_export($v, true) .
"' for options flag '{$k}'",
null,
true
);
}
}
// must be named attribute
} else {
$_indexed_attr[$k] = $v;
}
}
}
}
// check if all required attributes present
foreach ($this->required_attributes as $attr) {
if (!isset($_indexed_attr[$attr])) {
$compiler->trigger_template_error("missing '{$attr}' attribute", null, true);
}
}
// check for not allowed attributes
if ($this->optional_attributes !== ['_any']) {
$allowedAttributes = array_fill_keys(
array_merge(
$this->required_attributes,
$this->optional_attributes,
$this->option_flags
),
true
);
foreach ($_indexed_attr as $key => $dummy) {
if (!isset($allowedAttributes[$key]) && $key !== 0) {
$compiler->trigger_template_error("unexpected '{$key}' attribute", null, true);
}
}
}
// default 'false' for all options flags not set
foreach ($this->option_flags as $flag) {
if (!isset($_indexed_attr[$flag])) {
$_indexed_attr[$flag] = false;
}
}
return $_indexed_attr;
return (new AttributeCompiler(
$this->required_attributes,
$this->optional_attributes,
$this->shorttag_order,
$this->option_flags
))->getAttributes($compiler, $attributes);
}
/**
+20 -16
View File
@@ -3,24 +3,18 @@
* Smarty Internal Plugin Compile Registered Function
* Compiles code for the execution of a registered function
*
* @author Uwe Tews
*/
namespace Smarty\Compile;
use Smarty\Compiler\Template;
use Smarty\CompilerException;
use Smarty\FunctionHandler\AttributeFunctionHandlerInterface;
/**
* Smarty Internal Plugin Compile Registered Function Class
*
*/
class FunctionCallCompiler extends Base {
/**
* Attribute definition: Overwrites base class.
*
@@ -51,17 +45,27 @@ class FunctionCallCompiler extends Base {
*/
public function compile($args, Template $compiler, $parameter = [], $tag = null, $function = null): string
{
// check and get attributes
$_attr = $this->getAttributes($compiler, $args);
unset($_attr['nocache']);
$_paramsArray = $this->formatParamsArray($_attr);
$_params = 'array(' . implode(',', $_paramsArray) . ')';
if ($functionHandler = $compiler->getSmarty()->getFunctionHandler($function)) {
$attribute_overrides = [];
if ($functionHandler instanceof AttributeFunctionHandlerInterface) {
$attribute_overrides = $functionHandler->getSupportedAttributes();
}
// check and get attributes
$_attr = (new AttributeCompiler(
$attribute_overrides['required_attributes'] ?? $this->required_attributes,
$attribute_overrides['optional_attributes'] ?? $this->optional_attributes,
$attribute_overrides['shorttag_order'] ?? $this->shorttag_order,
$attribute_overrides['option_flags'] ?? $this->option_flags
))->getAttributes($compiler, $args);
unset($_attr['nocache']);
$_paramsArray = $this->formatParamsArray($_attr);
$_params = 'array(' . implode(',', $_paramsArray) . ')';
// not cacheable?
$compiler->tag_nocache = $compiler->tag_nocache || !$functionHandler->isCacheable();
$output = "\$_smarty_tpl->getSmarty()->getFunctionHandler(" . var_export($function, true) . ")";
@@ -11,8 +11,6 @@ namespace Smarty\Compile\Modifier;
* Input: string to catenate
* Example: {$var|cat:"foo"}
*
* @link https://www.smarty.net/manual/en/language.modifier.cat.php cat
* (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,8 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: count_characters
* Purpose: count the number of characters in a text
*
* @link https://www.smarty.net/manual/en/language.modifier.count.characters.php count_characters (Smarty online
* manual)
* @author Uwe Tews
*/
@@ -6,8 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: count_paragraphs
* Purpose: count the number of paragraphs in a text
*
* @link https://www.smarty.net/manual/en/language.modifier.count.paragraphs.php
* count_paragraphs (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,8 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: count_sentences
* Purpose: count the number of sentences in a text
*
* @link https://www.smarty.net/manual/en/language.modifier.count.paragraphs.php
* count_sentences (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: count_words
* Purpose: count the number of words in a text
*
* @link https://www.smarty.net/manual/en/language.modifier.count.words.php count_words (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: default
* Purpose: designate default value for empty variables
*
* @link https://www.smarty.net/manual/en/language.modifier.default.php default (Smarty online manual)
* @author Uwe Tews
*/
@@ -9,7 +9,6 @@ use Smarty\Exception;
* Name: escape
* Purpose: escape string for output
*
* @link https://www.smarty.net/docsv2/en/language.modifier.escape count_characters (Smarty online manual)
* @author Rodney Rehm
*/
@@ -25,22 +24,32 @@ class EscapeModifierCompiler extends Base {
}
switch ($esc_type) {
case 'html':
case 'force':
// in case of auto-escaping, and without the 'force' option, no double-escaping
if ($compiler->getSmarty()->escape_html && $esc_type != 'force')
return $params[0];
// otherwise, escape the variable
return 'htmlspecialchars((string)' . $params[ 0 ] . ', ENT_QUOTES, ' . var_export($char_set, true) . ', ' .
var_export($double_encode, true) . ')';
// no break
case 'htmlall':
$compiler->setRawOutput(true);
return 'htmlentities(mb_convert_encoding((string)' . $params[ 0 ] . ', \'UTF-8\', ' .
var_export($char_set, true) . '), ENT_QUOTES, \'UTF-8\', ' .
var_export($double_encode, true) . ')';
// no break
case 'url':
$compiler->setRawOutput(true);
return 'rawurlencode((string)' . $params[ 0 ] . ')';
case 'urlpathinfo':
$compiler->setRawOutput(true);
return 'str_replace("%2F", "/", rawurlencode((string)' . $params[ 0 ] . '))';
case 'quotes':
$compiler->setRawOutput(true);
// escape unescaped single quotes
return 'preg_replace("%(?<!\\\\\\\\)\'%", "\\\'", (string)' . $params[ 0 ] . ')';
case 'javascript':
$compiler->setRawOutput(true);
// escape quotes and backslashes, newlines, etc.
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
return 'strtr((string)' .
@@ -54,4 +63,4 @@ class EscapeModifierCompiler extends Base {
}
return '$_smarty_tpl->getSmarty()->getModifierCallback(\'escape\')(' . join(', ', $params) . ')';
}
}
}
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: indent
* Purpose: indent lines of text
*
* @link https://www.smarty.net/manual/en/language.modifier.indent.php indent (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: lower
* Purpose: convert string to lowercase
*
* @link https://www.smarty.net/manual/en/language.modifier.lower.php lower (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
* @author Uwe Tews
*/
@@ -7,7 +7,6 @@ namespace Smarty\Compile\Modifier;
* Name: nl2br
* Purpose: insert HTML line breaks before all newlines in a string
*
* @link https://www.smarty.net/docs/en/language.modifier.nl2br.tpl nl2br (Smarty online manual)
*/
class Nl2brModifierCompiler extends Base {
@@ -0,0 +1,21 @@
<?php
namespace Smarty\Compile\Modifier;
use Smarty\Exception;
/**
* Smarty raw modifier plugin
* Type: modifier
* Name: raw
* Purpose: when escaping is enabled by default, generates a raw output of a variable
*
* @author Amaury Bouchard
*/
class RawModifierCompiler extends Base {
public function compile($params, \Smarty\Compiler\Template $compiler) {
$compiler->setRawOutput(true);
return ($params[0]);
}
}
@@ -7,7 +7,6 @@ namespace Smarty\Compile\Modifier;
* Name: round
* Purpose: Returns the rounded value of num to specified precision (number of digits after the decimal point)
*
* @link https://www.smarty.net/docs/en/language.modifier.round.tpl round (Smarty online manual)
*/
class RoundModifierCompiler extends Base {
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: str_repeat
* Purpose: returns string repeated times times
*
* @link https://www.smarty.net/docs/en/language.modifier.str_repeat.tpl str_repeat (Smarty online manual)
*/
class StrRepeatModifierCompiler extends Base {
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: string_format
* Purpose: format strings via sprintf
*
* @link https://www.smarty.net/manual/en/language.modifier.string.format.php string_format (Smarty online manual)
* @author Uwe Tews
*/
@@ -9,7 +9,6 @@ namespace Smarty\Compile\Modifier;
* Example: {$var|strip} {$var|strip:"&nbsp;"}
* Date: September 25th, 2002
*
* @link https://www.smarty.net/manual/en/language.modifier.strip.php strip (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: strip_tags
* Purpose: strip html tags from text
*
* @link https://www.smarty.net/docs/en/language.modifier.strip.tags.tpl strip_tags (Smarty online manual)
* @author Uwe Tews
*/
@@ -7,7 +7,6 @@ namespace Smarty\Compile\Modifier;
* Name: strlen
* Purpose: return the length of the given string
*
* @link https://www.smarty.net/docs/en/language.modifier.strlen.tpl strlen (Smarty online manual)
*/
class StrlenModifierCompiler extends Base {
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: lower
* Purpose: convert string to uppercase
*
* @link https://www.smarty.net/manual/en/language.modifier.upper.php lower (Smarty online manual)
* @author Uwe Tews
*/
@@ -6,7 +6,6 @@ namespace Smarty\Compile\Modifier;
* Name: wordwrap
* Purpose: wrap a string of text at a given length
*
* @link https://www.smarty.net/manual/en/language.modifier.wordwrap.php wordwrap (Smarty online manual)
* @author Uwe Tews
*/
+1 -1
View File
@@ -75,7 +75,7 @@ class ModifierCompiler extends Base {
}
}
}
return $output;
return (string)$output;
}
/**
+2 -1
View File
@@ -82,12 +82,13 @@ class PrintExpressionCompiler extends Base {
$output = $compiler->compileModifier($modifierlist, $output);
}
if ($compiler->getTemplate()->getSmarty()->escape_html) {
if ($compiler->getTemplate()->getSmarty()->escape_html && !$compiler->isRawOutput()) {
$output = "htmlspecialchars((string) ({$output}), ENT_QUOTES, '" . addslashes(\Smarty\Smarty::$_CHARSET) . "')";
}
}
$output = "<?php echo {$output};?>\n";
$compiler->setRawOutput(false);
}
return $output;
}
+3 -5
View File
@@ -43,7 +43,7 @@ class ConfigLoad extends Base {
* @var array
* @see BasePlugin
*/
protected $optional_attributes = ['section', 'scope'];
protected $optional_attributes = ['section'];
/**
* Attribute definition: Overwrites base class.
@@ -51,7 +51,7 @@ class ConfigLoad extends Base {
* @var array
* @see BasePlugin
*/
protected $option_flags = ['nocache', 'noscope'];
protected $option_flags = [];
/**
* Compiles code for the {config_load} tag
@@ -66,9 +66,7 @@ class ConfigLoad extends Base {
{
// check and get attributes
$_attr = $this->getAttributes($compiler, $args);
if ($_attr['nocache'] === true) {
$compiler->trigger_template_error('nocache option not allowed', null, true);
}
// save possible attributes
$conf_file = $_attr['file'];
$section = $_attr['section'] ?? 'null';
+2 -62
View File
@@ -32,7 +32,7 @@ class ExtendsTag extends Inheritance {
*
* @var array
*/
protected $optional_attributes = ['extends_resource'];
protected $optional_attributes = [];
/**
* Attribute definition: Overwrites base class.
@@ -64,29 +64,7 @@ class ExtendsTag extends Inheritance {
}
// add code to initialize inheritance
$this->registerInit($compiler, true);
$file = trim($_attr['file'], '\'"');
if (strlen($file) > 8 && substr($file, 0, 8) === 'extends:') {
// generate code for each template
$files = array_reverse(explode('|', substr($file, 8)));
$i = 0;
foreach ($files as $file) {
if ($file[0] === '"') {
$file = trim($file, '".');
} else {
$file = "'{$file}'";
}
$i++;
if ($i === count($files) && isset($_attr['extends_resource'])) {
$this->compileEndChild($compiler);
}
$this->compileInclude($compiler, $file);
}
if (!isset($_attr['extends_resource'])) {
$this->compileEndChild($compiler);
}
} else {
$this->compileEndChild($compiler, $_attr['file']);
}
$this->compileEndChild($compiler, $_attr['file']);
return '';
}
@@ -106,42 +84,4 @@ class ExtendsTag extends Inheritance {
(isset($template) ? ", {$template}, \$_smarty_current_dir" : '') . ");\n?>"
);
}
/**
* Add code for including subtemplate to end of template
*
* @param \Smarty\Compiler\Template $compiler
* @param string $template subtemplate name
*
* @throws \Smarty\CompilerException
* @throws \Smarty\Exception
*/
private function compileInclude(\Smarty\Compiler\Template $compiler, $template) {
$compiler->getParser()->template_postfix[] = new \Smarty\ParseTree\Tag(
$compiler->getParser(),
$compiler->compileTag(
'include',
[
$template,
['scope' => 'parent'],
]
)
);
}
/**
* Create source code for {extends} from source components array
*
* @param \Smarty\Template $template
*
* @return string
*/
public static function extendsSourceArrayCode(\Smarty\Template $template) {
$resources = [];
foreach ($template->getSource()->components as $source) {
$resources[] = $source->resource;
}
return $template->getLeftDelimiter() . 'extends file=\'extends:' . join('|', $resources) .
'\' extends_resource=true' . $template->getRightDelimiter();
}
}
+15 -12
View File
@@ -51,8 +51,9 @@ class ForTag extends Base {
$var = $_statement['var'];
$index = '';
}
$output .= "\$_smarty_tpl->assign($var, null);\n";
$output .= "\$_smarty_tpl->tpl_vars[$var]->value{$index} = {$_statement['value']};\n";
$itemVar = "\$_smarty_tpl->getVariable({$var})";
$output .= "\$_smarty_tpl->assign($var, []);\n";
$output .= "{$itemVar}->value{$index} = {$_statement['value']};\n";
}
if (is_array($_attr['var'])) {
$var = $_attr['var']['var'];
@@ -61,7 +62,8 @@ class ForTag extends Base {
$var = $_attr['var'];
$index = '';
}
$output .= "if ($_attr[ifexp]) {\nfor (\$_foo=true;$_attr[ifexp]; \$_smarty_tpl->tpl_vars[$var]->value{$index}$_attr[step]) {\n";
$itemVar = "\$_smarty_tpl->getVariable({$var})";
$output .= "if ($_attr[ifexp]) {\nfor (\$_foo=true;$_attr[ifexp]; {$itemVar}->value{$index}$_attr[step]) {\n";
} else {
$_statement = $_attr['start'];
if (is_array($_statement['var'])) {
@@ -71,21 +73,22 @@ class ForTag extends Base {
$var = $_statement['var'];
$index = '';
}
$output .= "\$_smarty_tpl->assign($var, null);";
$itemVar = "\$_smarty_tpl->getVariable({$var})";
$output .= "\$_smarty_tpl->assign($var, []);";
if (isset($_attr['step'])) {
$output .= "\$_smarty_tpl->tpl_vars[$var]->step = $_attr[step];";
$output .= "{$itemVar}->step = $_attr[step];";
} else {
$output .= "\$_smarty_tpl->tpl_vars[$var]->step = 1;";
$output .= "{$itemVar}->step = 1;";
}
if (isset($_attr['max'])) {
$output .= "\$_smarty_tpl->tpl_vars[$var]->total = (int) min(ceil((\$_smarty_tpl->tpl_vars[$var]->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs(\$_smarty_tpl->tpl_vars[$var]->step)),$_attr[max]);\n";
$output .= "{$itemVar}->total = (int) min(ceil(({$itemVar}->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs({$itemVar}->step)),$_attr[max]);\n";
} else {
$output .= "\$_smarty_tpl->tpl_vars[$var]->total = (int) ceil((\$_smarty_tpl->tpl_vars[$var]->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs(\$_smarty_tpl->tpl_vars[$var]->step));\n";
$output .= "{$itemVar}->total = (int) ceil(({$itemVar}->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs({$itemVar}->step));\n";
}
$output .= "if (\$_smarty_tpl->tpl_vars[$var]->total > 0) {\n";
$output .= "for (\$_smarty_tpl->tpl_vars[$var]->value{$index} = $_statement[value], \$_smarty_tpl->tpl_vars[$var]->iteration = 1;\$_smarty_tpl->tpl_vars[$var]->iteration <= \$_smarty_tpl->tpl_vars[$var]->total;\$_smarty_tpl->tpl_vars[$var]->value{$index} += \$_smarty_tpl->tpl_vars[$var]->step, \$_smarty_tpl->tpl_vars[$var]->iteration++) {\n";
$output .= "\$_smarty_tpl->tpl_vars[$var]->first = \$_smarty_tpl->tpl_vars[$var]->iteration === 1;";
$output .= "\$_smarty_tpl->tpl_vars[$var]->last = \$_smarty_tpl->tpl_vars[$var]->iteration === \$_smarty_tpl->tpl_vars[$var]->total;";
$output .= "if ({$itemVar}->total > 0) {\n";
$output .= "for ({$itemVar}->value{$index} = $_statement[value], {$itemVar}->iteration = 1;{$itemVar}->iteration <= {$itemVar}->total;{$itemVar}->value{$index} += {$itemVar}->step, {$itemVar}->iteration++) {\n";
$output .= "{$itemVar}->first = {$itemVar}->iteration === 1;";
$output .= "{$itemVar}->last = {$itemVar}->iteration === {$itemVar}->total;";
}
$output .= '?>';
+1 -1
View File
@@ -99,7 +99,7 @@ class Section extends ForeachSection {
if ($compiler->tag_nocache) {
// push a {nocache} tag onto the stack to prevent caching of this block
$this->openTag('nocache');
$this->openTag($compiler, 'nocache');
}
$this->openTag($compiler, 'section', ['section', $compiler->tag_nocache]);
+1 -1
View File
@@ -33,7 +33,7 @@ class SectionClose extends Base {
if ($nocache_pushed) {
// pop the pushed virtual nocache tag
$this->closeTag('nocache');
$this->closeTag($compiler, 'nocache');
}
$output = "<?php\n";
+1 -1
View File
@@ -41,7 +41,7 @@ class CodeFrame
$content = '',
$functions = '',
$cache = false,
\Smarty\Compiler\Template $compiler = null
?\Smarty\Compiler\Template $compiler = null
) {
// build property code
$properties[ 'version' ] = \Smarty\Smarty::SMARTY_VERSION;
+66 -26
View File
@@ -313,6 +313,12 @@ class Template extends BaseCompiler {
*/
private $noCacheStackDepth = 0;
/**
* disabled auto-escape (when set to true, the next variable output is not auto-escaped)
*
* @var boolean
*/
private $raw_output = false;
/**
* Initialize compiler
@@ -368,7 +374,7 @@ class Template extends BaseCompiler {
* @throws CompilerException
* @throws Exception
*/
public function compileTemplateSource(\Smarty\Template $template, \Smarty\Compiler\Template $parent_compiler = null) {
public function compileTemplateSource(\Smarty\Template $template, ?\Smarty\Compiler\Template $parent_compiler = null) {
try {
// save template object in compiler class
$this->template = $template;
@@ -403,21 +409,37 @@ class Template extends BaseCompiler {
}
// get template source
if (!empty($this->template->getSource()->components)) {
// we have array of inheritance templates by extends: resource
// generate corresponding source code sequence
$_content =
ExtendsTag::extendsSourceArrayCode($this->template);
$_compiled_code = '<?php $_smarty_tpl->getInheritance()->init($_smarty_tpl, true); ?>';
$i = 0;
$reversed_components = array_reverse($this->template->getSource()->components);
foreach ($reversed_components as $source) {
$i++;
if ($i === count($reversed_components)) {
$_compiled_code .= '<?php $_smarty_tpl->getInheritance()->endChild($_smarty_tpl); ?>';
}
$_compiled_code .= $this->compileTag(
'include',
[
var_export($source->resource, true),
['scope' => 'parent'],
]
);
}
$_compiled_code = $this->smarty->runPostFilters($_compiled_code, $this->template);
} else {
// get template source
$_content = $this->template->getSource()->getContent();
$_compiled_code = $this->smarty->runPostFilters(
$this->doCompile(
$this->smarty->runPreFilters($_content, $this->template),
true
),
$this->template
);
}
$_compiled_code = $this->smarty->runPostFilters(
$this->doCompile(
$this->smarty->runPreFilters($_content, $this->template),
true
),
$this->template
);
} catch (\Exception $e) {
if ($this->smarty->debugging) {
$this->smarty->getDebug()->end_compile($this->template);
@@ -483,7 +505,7 @@ class Template extends BaseCompiler {
*
* @return string
*/
public function compileVariable($variable) {
public function triggerTagNoCache($variable): void {
if (!strpos($variable, '(')) {
// not a variable variable
$var = trim($variable, '\'');
@@ -494,7 +516,6 @@ class Template extends BaseCompiler {
false
)->isNocache();
}
return '$_smarty_tpl->getValue(' . $variable . ')';
}
/**
@@ -643,7 +664,7 @@ class Template extends BaseCompiler {
$script = null;
$cacheable = true;
$result = call_user_func_array(
$result = \call_user_func_array(
$defaultPluginHandlerFunc,
[
$tag,
@@ -680,7 +701,8 @@ class Template extends BaseCompiler {
*
* @return string
*/
public function appendCode($left, $right) {
public function appendCode(string $left, string $right): string
{
if (preg_match('/\s*\?>\s?$/D', $left) && preg_match('/^<\?php\s+/', $right)) {
$left = preg_replace('/\s*\?>\s?$/D', "\n", $left);
$left .= preg_replace('/^<\?php\s+/', '', $right);
@@ -1056,7 +1078,7 @@ class Template extends BaseCompiler {
$prefixArray = array_merge($this->prefix_code, array_pop($this->prefixCodeStack));
$this->prefixCodeStack[] = [];
foreach ($prefixArray as $c) {
$code = $this->appendCode($code, $c);
$code = $this->appendCode($code, (string) $c);
}
$this->prefix_code = [];
return $code;
@@ -1124,12 +1146,12 @@ class Template extends BaseCompiler {
}
// check if tag is a function
if ($this->smarty->getFunctionHandler($base_tag)) {
if (!isset($this->smarty->security_policy) || $this->smarty->security_policy->isTrustedTag($base_tag, $this)) {
if ($this->smarty->getFunctionHandler($tag)) {
if (!isset($this->smarty->security_policy) || $this->smarty->security_policy->isTrustedTag($tag, $this)) {
return (new \Smarty\Compile\PrintExpressionCompiler())->compile(
['nofilter'], // functions are never auto-escaped
$this,
['value' => $this->compileFunctionCall($base_tag, $args, $parameter)]
['value' => $this->compileFunctionCall($tag, $args, $parameter)]
);
}
}
@@ -1142,16 +1164,16 @@ class Template extends BaseCompiler {
}
// the default plugin handler is a handler of last resort, it may also handle not specifically registered tags.
if ($callback = $this->getPluginFromDefaultHandler($base_tag, Smarty::PLUGIN_COMPILER)) {
if ($callback = $this->getPluginFromDefaultHandler($tag, Smarty::PLUGIN_COMPILER)) {
if (!empty($parameter['modifierlist'])) {
throw new CompilerException('No modifiers allowed on ' . $base_tag);
throw new CompilerException('No modifiers allowed on ' . $tag);
}
$tagCompiler = new \Smarty\Compile\Tag\BCPluginWrapper($callback);
return $tagCompiler->compile($args, $this, $parameter);
}
if ($this->getPluginFromDefaultHandler($base_tag, Smarty::PLUGIN_FUNCTION)) {
return $this->defaultHandlerFunctionCallCompiler->compile($args, $this, $parameter, $tag, $base_tag);
return $this->defaultHandlerFunctionCallCompiler->compile($args, $this, $parameter, $tag, $tag);
}
if ($this->getPluginFromDefaultHandler($base_tag, Smarty::PLUGIN_BLOCK)) {
@@ -1258,9 +1280,10 @@ class Template extends BaseCompiler {
}
// call post compile callbacks
foreach ($this->postCompileCallbacks as $cb) {
$parameter = $cb;
$parameter[0] = $this;
call_user_func_array($cb[0], $parameter);
$callbackFunction = $cb[0];
$parameters = $cb;
$parameters[0] = $this;
$callbackFunction(...$parameters);
}
// return compiled code
return $this->prefixCompiledCode . $this->parser->retvalue . $this->postfixCompiledCode;
@@ -1469,4 +1492,21 @@ class Template extends BaseCompiler {
public function getTagStack(): array {
return $this->_tag_stack;
}
/**
* Should the next variable output be raw (true) or auto-escaped (false)
* @return bool
*/
public function isRawOutput(): bool {
return $this->raw_output;
}
/**
* Should the next variable output be raw (true) or auto-escaped (false)
* @param bool $raw_output
* @return void
*/
public function setRawOutput(bool $raw_output): void {
$this->raw_output = $raw_output;
}
}
+2 -2
View File
@@ -16,14 +16,14 @@ class CompilerException extends Exception {
* @param int $code The Exception code.
* @param string|null $filename The filename where the exception is thrown.
* @param int|null $line The line number where the exception is thrown.
* @param Throwable|null $previous The previous exception used for the exception chaining.
* @param \Throwable|null $previous The previous exception used for the exception chaining.
*/
public function __construct(
string $message = "",
int $code = 0,
?string $filename = null,
?int $line = null,
Throwable $previous = null
?\Throwable $previous = null
) {
parent::__construct($message, $code, $previous);
+6 -11
View File
@@ -109,7 +109,7 @@ class Data
foreach ($tpl_var as $_key => $_val) {
$this->assign($_key, $_val, $nocache, $scope);
}
return;
return $this;
}
switch ($scope ?? $this->getDefaultScope()) {
case self::SCOPE_GLOBAL:
@@ -163,8 +163,6 @@ class Data
* be not cached
*
* @return Data
* @link https://www.smarty.net/docs/en/api.append.tpl
*
* @api Smarty::append()
*/
public function append($tpl_var, $value = null, $merge = false, $nocache = false)
@@ -218,7 +216,6 @@ class Data
*
* @return mixed variable value or or array of variables
* @api Smarty::getTemplateVars()
* @link https://www.smarty.net/docs/en/api.get.template.vars.tpl
*
*/
public function getTemplateVars($varName = null, $searchParents = true)
@@ -227,7 +224,10 @@ class Data
return $this->getValue($varName, $searchParents);
}
return array_merge($this->parent && $searchParents ? $this->parent->getTemplateVars() : [], $this->tpl_vars);
return array_merge(
$this->parent && $searchParents ? $this->parent->getTemplateVars() : [],
array_map(function(Variable $var) { return $var->getValue(); }, $this->tpl_vars)
);
}
/**
@@ -290,7 +290,7 @@ class Data
* @return bool
*/
public function hasVariable($varName): bool {
return !($this->getVariable($varName) instanceof UndefinedVariable);
return !($this->getVariable($varName, true, false) instanceof UndefinedVariable);
}
/**
@@ -351,7 +351,6 @@ class Data
* @param string|array $tpl_var the template variable(s) to clear
*
* @return Data
* @link https://www.smarty.net/docs/en/api.clear.assign.tpl
*
* @api Smarty::clearAssign()
*/
@@ -371,7 +370,6 @@ class Data
* clear all the assigned template variables.
*
* @return Data
* @link https://www.smarty.net/docs/en/api.clear.all.assign.tpl
*
* @api Smarty::clearAllAssign()
*/
@@ -387,7 +385,6 @@ class Data
* @param string|null $name variable name or null
*
* @return Data
* @link https://www.smarty.net/docs/en/api.clear.config.tpl
*
* @api Smarty::clearConfig()
*/
@@ -440,7 +437,6 @@ class Data
*
* @return mixed variable value or or array of variables
* @throws Exception
* @link https://www.smarty.net/docs/en/api.get.config.vars.tpl
*
* @api Smarty::getConfigVars()
*/
@@ -462,7 +458,6 @@ class Data
* @returns $this
* @throws \Exception
* @link https://www.smarty.net/docs/en/api.config.load.tpl
*
* @api Smarty::configLoad()
*/
+2 -2
View File
@@ -168,7 +168,6 @@ class BCPluginsAdapter extends Base {
}
public function loadPluginsFromDir(string $path) {
foreach([
'function',
'modifier',
@@ -177,6 +176,7 @@ class BCPluginsAdapter extends Base {
'prefilter',
'postfilter',
'outputfilter',
'modifiercompiler',
] as $type) {
foreach (glob($path . $type . '.?*.php') as $filename) {
$pluginName = $this->getPluginNameFromFilename($filename);
@@ -226,4 +226,4 @@ class BCPluginsAdapter extends Base {
return $matches[1];
}
}
}
+1 -1
View File
@@ -26,7 +26,7 @@ class CallbackWrapper {
public function handle(...$params) {
try {
return call_user_func_array($this->callback, $params);
return ($this->callback)(...$params);
} catch (\ArgumentCountError $e) {
throw new Exception("Invalid number of arguments to modifier " . $this->modifierName);
}
+4 -10
View File
@@ -35,6 +35,7 @@ class DefaultExtension extends Base {
case 'lower': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\LowerModifierCompiler(); break;
case 'nl2br': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\Nl2brModifierCompiler(); break;
case 'noprint': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\NoPrintModifierCompiler(); break;
case 'raw': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\RawModifierCompiler(); break;
case 'round': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\RoundModifierCompiler(); break;
case 'str_repeat': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\StrRepeatModifierCompiler(); break;
case 'string_format': $this->modifiers[$modifier] = new \Smarty\Compile\Modifier\StringFormatModifierCompiler(); break;
@@ -113,7 +114,6 @@ class DefaultExtension extends Base {
* Name: spacify
* Purpose: add spaces between characters in a string
*
* @link https://www.smarty.net/manual/en/language.modifier.spacify.php spacify (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param string $string input string
@@ -234,7 +234,6 @@ class DefaultExtension extends Base {
* - format: strftime format for output
* - default_date: default date if $string is empty
*
* @link https://www.smarty.net/manual/en/language.modifier.date.format.php date_format (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param string $string input date string
@@ -321,7 +320,7 @@ class DefaultExtension extends Base {
break;
}
foreach ($var as $curr_key => $curr_val) {
$results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b>' . strtr($curr_key, $_replace) .
$results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b>' . htmlspecialchars(strtr($curr_key, $_replace)) .
'</b> =&gt; ' .
$this->smarty_modifier_debug_print_var($curr_val, $max, $length, ++$depth, $objects);
$depth--;
@@ -339,7 +338,7 @@ class DefaultExtension extends Base {
}
$objects[] = $var;
foreach ($object_vars as $curr_key => $curr_val) {
$results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b> -&gt;' . strtr($curr_key, $_replace) .
$results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b> -&gt;' . htmlspecialchars(strtr($curr_key, $_replace)) .
'</b> = ' . $this->smarty_modifier_debug_print_var($curr_val, $max, $length, ++$depth, $objects);
$depth--;
}
@@ -386,7 +385,6 @@ class DefaultExtension extends Base {
* Name: escape
* Purpose: escape string for output
*
* @link https://www.smarty.net/docs/en/language.modifier.escape
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param string $string input string
@@ -654,8 +652,6 @@ class DefaultExtension extends Base {
* Name: regex_replace
* Purpose: regular expression search/replace
*
* @link https://www.smarty.net/manual/en/language.modifier.regex.replace.php
* regex_replace (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param string $string input string
@@ -703,7 +699,6 @@ class DefaultExtension extends Base {
* Name: replace
* Purpose: simple search/replace
*
* @link https://www.smarty.net/manual/en/language.modifier.replace.php replace (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
* @author Uwe Tews
*
@@ -726,7 +721,6 @@ class DefaultExtension extends Base {
* optionally splitting in the middle of a word, and
* appending the $etc string or inserting $etc into the middle.
*
* @link https://www.smarty.net/manual/en/language.modifier.truncate.php truncate (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param string $string input string
@@ -760,4 +754,4 @@ class DefaultExtension extends Base {
return $string;
}
}
}
+77
View File
@@ -0,0 +1,77 @@
<?php
namespace Smarty\FunctionHandler;
use Smarty\Template;
/**
* Abstract implementation for function handlers which support custom attributes
*/
abstract class AttributeBase implements AttributeFunctionHandlerInterface
{
/**
* Array of names of required attribute required by tag
*
* @var array
*/
protected array $required_attributes = [];
/**
* Array of names of optional attribute required by tag
* use array('_any') if there is no restriction of attributes names
*
* @var array
*/
protected array $optional_attributes = [];
/**
* Shorttag attribute order defined by its names
*
* @var array
*/
protected array $shorttag_order = [];
/**
* Array of names of valid option flags
*
* @var array
*/
protected array $option_flags = [];
/**
* Return whether the output is cacheable.
* @var bool
*/
protected bool $cacheable = true;
/**
* Return whether the output is cacheable.
* @return bool
*/
public function isCacheable(): bool
{
return $this->cacheable;
}
/**
* Function body
* @param mixed $params The supplied parameters.
* @param Smarty\Template $template
* @return mixed
*/
abstract public function handle($params, Template $template): ?string;
/**
* Return the support attributes for this function.
* @return array<string, array>
*/
public function getSupportedAttributes(): array
{
return [
'required_attributes' => $this->required_attributes,
'optional_attributes' => $this->optional_attributes,
'shorttag_order' => $this->shorttag_order,
'option_flags' => $this->option_flags,
];
}
}
@@ -0,0 +1,15 @@
<?php
namespace Smarty\FunctionHandler;
/**
* Function handler interface with support for specifying supported properties
*/
interface AttributeFunctionHandlerInterface extends FunctionHandlerInterface
{
/**
* Returns an array with the supported attributes, flags, and shorttags
* @return array<string, array>
*/
public function getSupportedAttributes(): array;
}
-2
View File
@@ -13,8 +13,6 @@ use Smarty\Template;
* @param Template $template template object
*
* @return string|null
*@link https://www.smarty.net/manual/en/language.function.counter.php {counter}
* (Smarty online manual)
*
* @author Monte Ohrt <monte at ohrt dot com>
*/
-2
View File
@@ -26,8 +26,6 @@ use Smarty\Template;
* {cycle name=row values="one,two,three" reset=true}
* {cycle name=row}
*
* @link https://www.smarty.net/manual/en/language.function.cycle.php {cycle}
* (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
* @author credit to Mark Priatel <mpriatel@rogers.com>
* @author credit to Gerard <gerard@interfold.com>
+16 -3
View File
@@ -10,8 +10,6 @@ use Smarty\Template;
* Name: fetch
* Purpose: fetch file, web or ftp data and display results
*
* @link https://www.smarty.net/manual/en/language.function.fetch.php {fetch}
* (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param array $params parameters
@@ -191,7 +189,22 @@ class Fetch extends Base {
return;
}
} else {
$content = @file_get_contents($params['file']);
if ($protocol && isset($template->getSmarty()->security_policy)) {
// Remote resource (e.g. https://) reached through file_get_contents().
// isTrustedUri() only validates the initial URL, but file_get_contents()
// follows redirects by default, so an open redirect on an otherwise
// trusted host could be used to reach a non-trusted target (SSRF).
// Disable redirect-following while a security policy is in effect.
$context = stream_context_create([
'http' => [
'follow_location' => 0,
'max_redirects' => 1,
],
]);
$content = @file_get_contents($params['file'], false, $context);
} else {
$content = @file_get_contents($params['file']);
}
if ($content === false) {
throw new Exception("{fetch} cannot read resource '" . $params['file'] . "'");
}
-2
View File
@@ -27,8 +27,6 @@ use Smarty\Template;
* - assign (optional) - assign the output as an array to this variable
* - escape (optional) - escape the content (not value), defaults to true
*
* @link https://www.smarty.net/manual/en/language.function.html.checkboxes.php {html_checkboxes}
* (Smarty online manual)
* @author Christopher Kvarme <christopher.kvarme@flashjab.com>
* @author credits to Monte Ohrt <monte at ohrt dot com>
* @version 1.0
+8 -5
View File
@@ -20,8 +20,6 @@ use Smarty\Template;
* - basedir - (optional) - base directory for absolute paths, default is environment variable DOCUMENT_ROOT
* - path_prefix - prefix for path output (optional, default empty)
*
* @link https://www.smarty.net/manual/en/language.function.html.image.php {html_image}
* (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
* @author credits to Duda <duda@big.hu>
* @version 1.0
@@ -67,7 +65,7 @@ class HtmlImage extends Base {
break;
case 'link':
case 'href':
$prefix = '<a href="' . $_val . '">';
$prefix = '<a href="' . smarty_function_escape_special_chars($_val) . '">';
$suffix = '</a>';
break;
default:
@@ -145,7 +143,12 @@ class HtmlImage extends Base {
$width = round($width * $_resize);
$height = round($height * $_resize);
}
return $prefix . '<img src="' . $path_prefix . $file . '" alt="' . $alt . '" width="' . $width . '" height="' .
$height . '"' . $extra . ' />' . $suffix;
// $alt and the pass-through attributes ($extra) are already escaped above;
// escape the remaining value-context params at output time so untrusted
// values cannot break out of the attribute (CWE-79). The unescaped $file/
// $width/$height are still used for getimagesize()/DPI math above.
return $prefix . '<img src="' . smarty_function_escape_special_chars($path_prefix . $file) . '" alt="' . $alt
. '" width="' . smarty_function_escape_special_chars($width) . '" height="'
. smarty_function_escape_special_chars($height) . '"' . $extra . ' />' . $suffix;
}
}
-2
View File
@@ -19,8 +19,6 @@ use Smarty\Template;
* - id (optional) - string default not set
* - class (optional) - string default not set
*
* @link https://www.smarty.net/manual/en/language.function.html.options.php {html_image}
* (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
* @author Ralf Strehle (minor optimization) <ralf dot strehle at yahoo dot de>
*
-2
View File
@@ -27,8 +27,6 @@ use Smarty\Template;
* {html_radios values=$ids name='box' separator='<br>' output=$names}
* {html_radios values=$ids checked=$checked separator='<br>' output=$names}
*
* @link https://www.smarty.net/manual/en/language.function.html.radios.php {html_radios}
* (Smarty online manual)
* @author Christopher Kvarme <christopher.kvarme@flashjab.com>
* @author credits to Monte Ohrt <monte at ohrt dot com>
* @version 1.0
+7 -5
View File
@@ -26,8 +26,6 @@ use Smarty\Template;
* - 2.0 complete rewrite for performance,
* added attributes month_names, *_id
*
* @link https://www.smarty.net/manual/en/language.function.html.select.date.php {html_select_date}
* (Smarty online manual)
* @version 2.0
* @author Andrei Zmievski
* @author Monte Ohrt <monte at ohrt dot com>
@@ -122,9 +120,6 @@ class HtmlSelectDate extends Base {
case 'day_value_format':
case 'month_format':
case 'month_value_format':
case 'day_size':
case 'month_size':
case 'year_size':
case 'all_extra':
case 'day_extra':
case 'month_extra':
@@ -142,6 +137,13 @@ class HtmlSelectDate extends Base {
case 'year_id':
$$_key = (string)$_value;
break;
case 'day_size':
case 'month_size':
case 'year_size':
// numeric HTML size attribute; cast to int (consistent with
// html_select_time) so it cannot break out of size="…" (CWE-79)
$$_key = (int)$_value;
break;
case 'display_days':
case 'display_months':
case 'display_years':
-2
View File
@@ -9,8 +9,6 @@ use Smarty\Template;
* Name: html_select_time
* Purpose: Prints the dropdowns for time selection
*
* @link https://www.smarty.net/manual/en/language.function.html.select.time.php {html_select_time}
* (Smarty online manual)
* @author Roberto Berto <roberto@berto.net>
* @author Monte Ohrt <monte AT ohrt DOT com>
*
-2
View File
@@ -37,8 +37,6 @@ use Smarty\Template;
* @return string
*@author credit to boots <boots dot smarty at yahoo dot com>
* @version 1.1
* @link https://www.smarty.net/manual/en/language.function.html.table.php {html_table}
* (Smarty online manual)
*
* @author Monte Ohrt <monte at ohrt dot com>
* @author credit to Messju Mohr <messju at lammfellpuschen dot de>
-2
View File
@@ -35,8 +35,6 @@ use Smarty\Template;
* {mailto address="me@domain.com" cc="you@domain.com,they@domain.com"}
* {mailto address="me@domain.com" extra='class="mailto"'}
*
* @link https://www.smarty.net/manual/en/language.function.mailto.php {mailto}
* (Smarty online manual)
* @version 1.2
* @author Monte Ohrt <monte at ohrt dot com>
* @author credits to Jason Sweat (added cc, bcc and subject functionality)
-2
View File
@@ -10,8 +10,6 @@ use Smarty\Template;
* Name: math
* Purpose: handle math computations in template
*
* @link https://www.smarty.net/manual/en/language.function.math.php {math}
* (Smarty online manual)
* @author Monte Ohrt <monte at ohrt dot com>
*
* @param array $params parameters
+44 -38
View File
@@ -160,6 +160,7 @@ class TemplateLexer
'LOGOP' => '"<", "==" ... logical operator',
'TLOGOP' => '"lt", "eq" ... logical operator; "is div by" ... if condition',
'SCOND' => '"is even" ... if condition',
'MATCHES' => '"matches" regex operator',
);
/**
@@ -567,7 +568,7 @@ class TemplateLexer
public function yylex3()
{
if (!isset($this->yy_global_pattern3)) {
$this->yy_global_pattern3 = $this->replace("/\G(\\s*SMARTYrdel)|\G((SMARTYldel)SMARTYal)|\G([\"])|\G('[^'\\\\]*(?:\\\\.[^'\\\\]*)*')|\G([$][0-9]*[a-zA-Z_]\\w*)|\G([$])|\G(\\s+is\\s+(not\\s+)?in\\s+)|\G(\\s+as\\s+)|\G(\\s+to\\s+)|\G(\\s+step\\s+)|\G(\\s+instanceof\\s+)|\G(\\s*([!=][=]{1,2}|[<][=>]?|[>][=]?|[&|]{2})\\s*)|\G(\\s+(eq|ne|neq|gt|ge|gte|lt|le|lte|mod|and|or|xor)\\s+)|\G(\\s+is\\s+(not\\s+)?(odd|even|div)\\s+by\\s+)|\G(\\s+is\\s+(not\\s+)?(odd|even))|\G([!]\\s*|not\\s+)|\G([(](int(eger)?|bool(ean)?|float|double|real|string|binary|array|object)[)]\\s*)|\G(\\s*[(]\\s*)|\G(\\s*[)])|\G(\\[\\s*)|\G(\\s*\\])|\G(\\s*[-][>]\\s*)|\G(\\s*[=][>]\\s*)|\G(\\s*[=]\\s*)|\G(([+]|[-]){2})|\G(\\s*([+]|[-])\\s*)|\G(\\s*([*]{1,2}|[%\/^&]|[<>]{2})\\s*)|\G([@])|\G(array\\s*[(]\\s*)|\G([#])|\G(\\s+[0-9]*[a-zA-Z_][a-zA-Z0-9_\-:]*\\s*[=]\\s*)|\G(([0-9]*[a-zA-Z_]\\w*)?(\\\\[0-9]*[a-zA-Z_]\\w*)+)|\G([0-9]*[a-zA-Z_]\\w*)|\G(\\d+)|\G([`])|\G([|][@]?)|\G([.])|\G(\\s*[,]\\s*)|\G(\\s*[;]\\s*)|\G([:]{2})|\G(\\s*[:]\\s*)|\G(\\s*[?]\\s*)|\G(0[xX][0-9a-fA-F]+)|\G(\\s+)|\G([\S\s])/isS");
$this->yy_global_pattern3 = $this->replace("/\G(\\s*SMARTYrdel)|\G((SMARTYldel)SMARTYal)|\G([\"])|\G('[^'\\\\]*(?:\\\\.[^'\\\\]*)*')|\G([$][0-9]*[a-zA-Z_]\\w*)|\G([$])|\G(\\s+is\\s+(not\\s+)?in\\s+)|\G(\\s+matches\\s+)|\G(\\s+as\\s+)|\G(\\s+to\\s+)|\G(\\s+step\\s+)|\G(\\s+instanceof\\s+)|\G(\\s*([!=][=]{1,2}|[<][=>]?|[>][=]?|[&|]{2})\\s*)|\G(\\s+(eq|ne|neq|gt|ge|gte|lt|le|lte|mod|and|or|xor)\\s+)|\G(\\s+is\\s+(not\\s+)?(odd|even|div)\\s+by\\s+)|\G(\\s+is\\s+(not\\s+)?(odd|even))|\G([!]\\s*|not\\s+)|\G([(](int(eger)?|bool(ean)?|float|double|real|string|binary|array|object)[)]\\s*)|\G(\\s*[(]\\s*)|\G(\\s*[)])|\G(\\[\\s*)|\G(\\s*\\])|\G(\\s*[-][>]\\s*)|\G(\\s*[=][>]\\s*)|\G(\\s*[=]\\s*)|\G(([+]|[-]){2})|\G(\\s*([+]|[-])\\s*)|\G(\\s*([*]{1,2}|[%\/^&]|[<>]{2})\\s*)|\G([@])|\G(array\\s*[(]\\s*)|\G([#])|\G(\\s+[0-9]*[a-zA-Z_][a-zA-Z0-9_\-:]*\\s*[=]\\s*)|\G(([0-9]*[a-zA-Z_]\\w*)?(\\\\[0-9]*[a-zA-Z_]\\w*)+)|\G([0-9]*[a-zA-Z_]\\w*)|\G(\\d+)|\G([`])|\G([|][@]?)|\G([.])|\G(\\s*[,]\\s*)|\G(\\s*[;]\\s*)|\G([:]{2})|\G(\\s*[:]\\s*)|\G(\\s*[?]\\s*)|\G(0[xX][0-9a-fA-F]+)|\G(\\s+)|\G([\S\s])/isS");
}
if (!isset($this->dataLength)) {
$this->dataLength = strlen($this->data);
@@ -662,119 +663,124 @@ class TemplateLexer
public function yy_r3_10()
{
$this->token = \Smarty\Parser\TemplateParser::TP_AS;
$this->token = \Smarty\Parser\TemplateParser::TP_MATCHES;
}
public function yy_r3_11()
{
$this->token = \Smarty\Parser\TemplateParser::TP_TO;
$this->token = \Smarty\Parser\TemplateParser::TP_AS;
}
public function yy_r3_12()
{
$this->token = \Smarty\Parser\TemplateParser::TP_STEP;
$this->token = \Smarty\Parser\TemplateParser::TP_TO;
}
public function yy_r3_13()
{
$this->token = \Smarty\Parser\TemplateParser::TP_INSTANCEOF;
$this->token = \Smarty\Parser\TemplateParser::TP_STEP;
}
public function yy_r3_14()
{
$this->token = \Smarty\Parser\TemplateParser::TP_INSTANCEOF;
}
public function yy_r3_15()
{
$this->token = \Smarty\Parser\TemplateParser::TP_LOGOP;
}
public function yy_r3_16()
public function yy_r3_17()
{
$this->token = \Smarty\Parser\TemplateParser::TP_SLOGOP;
}
public function yy_r3_18()
public function yy_r3_19()
{
$this->token = \Smarty\Parser\TemplateParser::TP_TLOGOP;
}
public function yy_r3_21()
public function yy_r3_22()
{
$this->token = \Smarty\Parser\TemplateParser::TP_SINGLECOND;
}
public function yy_r3_24()
public function yy_r3_25()
{
$this->token = \Smarty\Parser\TemplateParser::TP_NOT;
}
public function yy_r3_25()
public function yy_r3_26()
{
$this->token = \Smarty\Parser\TemplateParser::TP_TYPECAST;
}
public function yy_r3_29()
public function yy_r3_30()
{
$this->token = \Smarty\Parser\TemplateParser::TP_OPENP;
}
public function yy_r3_30()
public function yy_r3_31()
{
$this->token = \Smarty\Parser\TemplateParser::TP_CLOSEP;
}
public function yy_r3_31()
public function yy_r3_32()
{
$this->token = \Smarty\Parser\TemplateParser::TP_OPENB;
}
public function yy_r3_32()
public function yy_r3_33()
{
$this->token = \Smarty\Parser\TemplateParser::TP_CLOSEB;
}
public function yy_r3_33()
public function yy_r3_34()
{
$this->token = \Smarty\Parser\TemplateParser::TP_PTR;
}
public function yy_r3_34()
public function yy_r3_35()
{
$this->token = \Smarty\Parser\TemplateParser::TP_APTR;
}
public function yy_r3_35()
public function yy_r3_36()
{
$this->token = \Smarty\Parser\TemplateParser::TP_EQUAL;
}
public function yy_r3_36()
public function yy_r3_37()
{
$this->token = \Smarty\Parser\TemplateParser::TP_INCDEC;
}
public function yy_r3_38()
public function yy_r3_39()
{
$this->token = \Smarty\Parser\TemplateParser::TP_UNIMATH;
}
public function yy_r3_40()
public function yy_r3_41()
{
$this->token = \Smarty\Parser\TemplateParser::TP_MATH;
}
public function yy_r3_42()
public function yy_r3_43()
{
$this->token = \Smarty\Parser\TemplateParser::TP_AT;
}
public function yy_r3_43()
public function yy_r3_44()
{
$this->token = \Smarty\Parser\TemplateParser::TP_ARRAYOPEN;
}
public function yy_r3_44()
public function yy_r3_45()
{
$this->token = \Smarty\Parser\TemplateParser::TP_HATCH;
}
public function yy_r3_45()
public function yy_r3_46()
{
// resolve conflicts with shorttag and right_delimiter starting with '='
@@ -786,73 +792,73 @@ class TemplateLexer
$this->token = \Smarty\Parser\TemplateParser::TP_ATTR;
}
}
public function yy_r3_46()
public function yy_r3_47()
{
$this->token = \Smarty\Parser\TemplateParser::TP_NAMESPACE;
}
public function yy_r3_49()
public function yy_r3_50()
{
$this->token = \Smarty\Parser\TemplateParser::TP_ID;
}
public function yy_r3_50()
public function yy_r3_51()
{
$this->token = \Smarty\Parser\TemplateParser::TP_INTEGER;
}
public function yy_r3_51()
public function yy_r3_52()
{
$this->token = \Smarty\Parser\TemplateParser::TP_BACKTICK;
$this->yypopstate();
}
public function yy_r3_52()
public function yy_r3_53()
{
$this->token = \Smarty\Parser\TemplateParser::TP_VERT;
}
public function yy_r3_53()
public function yy_r3_54()
{
$this->token = \Smarty\Parser\TemplateParser::TP_DOT;
}
public function yy_r3_54()
public function yy_r3_55()
{
$this->token = \Smarty\Parser\TemplateParser::TP_COMMA;
}
public function yy_r3_55()
public function yy_r3_56()
{
$this->token = \Smarty\Parser\TemplateParser::TP_SEMICOLON;
}
public function yy_r3_56()
public function yy_r3_57()
{
$this->token = \Smarty\Parser\TemplateParser::TP_DOUBLECOLON;
}
public function yy_r3_57()
public function yy_r3_58()
{
$this->token = \Smarty\Parser\TemplateParser::TP_COLON;
}
public function yy_r3_58()
public function yy_r3_59()
{
$this->token = \Smarty\Parser\TemplateParser::TP_QMARK;
}
public function yy_r3_59()
public function yy_r3_60()
{
$this->token = \Smarty\Parser\TemplateParser::TP_HEX;
}
public function yy_r3_60()
public function yy_r3_61()
{
$this->token = \Smarty\Parser\TemplateParser::TP_SPACE;
}
public function yy_r3_61()
public function yy_r3_62()
{
$this->token = \Smarty\Parser\TemplateParser::TP_TEXT;
+5
View File
@@ -160,6 +160,7 @@ class TemplateLexer
'LOGOP' => '"<", "==" ... logical operator',
'TLOGOP' => '"lt", "eq" ... logical operator; "is div by" ... if condition',
'SCOND' => '"is even" ... if condition',
'MATCHES' => '"matches" regex operator',
);
/**
@@ -325,6 +326,7 @@ class TemplateLexer
tlop = ~\s+is\s+(not\s+)?(odd|even|div)\s+by\s+~
scond = ~\s+is\s+(not\s+)?(odd|even)~
isin = ~\s+is\s+(not\s+)?in\s+~
matches = ~\s+matches\s+~
as = ~\s+as\s+~
to = ~\s+to\s+~
step = ~\s+step\s+~
@@ -469,6 +471,9 @@ class TemplateLexer
isin {
$this->token = \Smarty\Parser\TemplateParser::TP_ISIN;
}
matches {
$this->token = \Smarty\Parser\TemplateParser::TP_MATCHES;
}
as {
$this->token = \Smarty\Parser\TemplateParser::TP_AS;
}
+3 -3
View File
@@ -47,18 +47,18 @@ class Dq extends Base
if ($subtree instanceof Code) {
$this->subtrees[ $last_subtree ]->data =
$parser->compiler->appendCode(
$this->subtrees[ $last_subtree ]->data,
(string) $this->subtrees[ $last_subtree ]->data,
'<?php echo ' . $subtree->data . ';?>'
);
} elseif ($subtree instanceof DqContent) {
$this->subtrees[ $last_subtree ]->data =
$parser->compiler->appendCode(
$this->subtrees[ $last_subtree ]->data,
(string) $this->subtrees[ $last_subtree ]->data,
'<?php echo "' . $subtree->data . '";?>'
);
} else {
$this->subtrees[ $last_subtree ]->data =
$parser->compiler->appendCode($this->subtrees[ $last_subtree ]->data, $subtree->data);
$parser->compiler->appendCode((string) $this->subtrees[ $last_subtree ]->data, (string) $subtree->data);
}
} else {
$this->subtrees[] = $subtree;
+2 -2
View File
@@ -62,9 +62,9 @@ class Tag extends Base
public function assign_to_var(\Smarty\Parser\TemplateParser $parser)
{
$var = $parser->compiler->getNewPrefixVariable();
$tmp = $parser->compiler->appendCode('<?php ob_start();?>', $this->data);
$tmp = $parser->compiler->appendCode('<?php ob_start();?>', (string) $this->data);
$tmp = $parser->compiler->appendCode($tmp, "<?php {$var}=ob_get_clean();?>");
$parser->compiler->appendPrefixCode((string) $tmp);
$parser->compiler->appendPrefixCode($tmp);
return $var;
}
}

Some files were not shown because too many files have changed in this diff Show More