mirror of
https://github.com/smarty-php/smarty.git
synced 2026-08-06 21:44:17 +02:00
Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 042dff64a9 | |||
| 1830aa7a12 | |||
| b83ffdd2d6 | |||
| ac27e1e5b6 |
@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
## [5.8.3] - 2026-06-28
|
||||
- fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
|
||||
|
||||
|
||||
## [5.8.2] - 2026-06-24
|
||||
- Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
|
||||
- Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
# Python dependencies for building/previewing the docs.
|
||||
#
|
||||
# pip install -r docs/requirements.txt
|
||||
# mkdocs serve # local preview
|
||||
# mike deploy 5.x # publish
|
||||
#
|
||||
# pymdown-extensions must be >=11: earlier releases pass filename=None to
|
||||
# Pygments, and Pygments >=2.19 then crashes with
|
||||
# "'NoneType' object has no attribute 'replace'" on any untitled code block.
|
||||
mkdocs>=1.6
|
||||
mkdocs-material>=9.7
|
||||
pymdown-extensions>=11
|
||||
Pygments>=2.19
|
||||
mike>=2.2
|
||||
@@ -5,7 +5,7 @@
|
||||
# - ./run-tests-for-all-php-versions.sh --group 20221124
|
||||
# - ./run-tests-for-all-php-versions.sh --exclude-group slow
|
||||
|
||||
COMPOSE_CMD="mutagen-compose"
|
||||
COMPOSE_CMD="docker compose"
|
||||
|
||||
$COMPOSE_CMD run --rm php72 ./run-tests.sh $@ && \
|
||||
$COMPOSE_CMD run --rm php73 ./run-tests.sh $@ && \
|
||||
|
||||
@@ -69,12 +69,8 @@ class InheritanceRuntime {
|
||||
* @param array $blockNames outer level block name
|
||||
*/
|
||||
public function init(Template $tpl, $initChild, $blockNames = []) {
|
||||
// if called while executing parent template it must be a sub-template with new inheritance root.
|
||||
// A new root is started either by a child template ($initChild) or by a sub-template included
|
||||
// outside of any block rendering (empty source stack); the latter must not inherit the leftover
|
||||
// block overrides of a previously completed inheritance tree (see issue #1189).
|
||||
if (($initChild || empty($this->sourceStack)) && $this->state === 3
|
||||
&& (strpos($tpl->template_resource, 'extendsall') === false)) {
|
||||
// if called while executing parent template it must be a sub-template with new inheritance root
|
||||
if ($initChild && $this->state === 3 && (strpos($tpl->template_resource, 'extendsall') === false)) {
|
||||
$tpl->setInheritance(clone $tpl->getSmarty()->getRuntime('Inheritance'));
|
||||
$tpl->getInheritance()->init($tpl, $initChild, $blockNames);
|
||||
return;
|
||||
|
||||
+1
-1
@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
|
||||
/**
|
||||
* smarty version
|
||||
*/
|
||||
const SMARTY_VERSION = '5.8.2';
|
||||
const SMARTY_VERSION = '5.8.3';
|
||||
|
||||
/**
|
||||
* define caching modes
|
||||
|
||||
+5
-1
@@ -260,7 +260,11 @@ class Template extends TemplateBase {
|
||||
|
||||
$tpl = $this->smarty->doCreateTemplate($template_name, $cache_id, $compile_id, $this, $caching, $cache_lifetime);
|
||||
|
||||
$tpl->inheritance = $this->getInheritance(); // re-use the same Inheritance object inside the inheritance tree
|
||||
// Re-use the same Inheritance object only inside an active inheritance tree, i.e. when this
|
||||
// (including) template already has one. A template outside any inheritance tree has no
|
||||
// Inheritance object (null); sub-templates it {include}s must then start with their own, so an
|
||||
// {include}d template that uses {block}/{extends} creates a fresh root via getInheritance().
|
||||
$tpl->inheritance = $this->inheritance;
|
||||
|
||||
if ($scope) {
|
||||
$tpl->defaultScope = $scope;
|
||||
|
||||
Reference in New Issue
Block a user