Compare commits

...

4 Commits

Author SHA1 Message Date
Simon Wisselink 042dff64a9 Merge branch 'release/5.8.3' 2026-06-29 00:15:09 +02:00
Simon Wisselink 1830aa7a12 version bump 2026-06-29 00:15:07 +02:00
Simon Wisselink b83ffdd2d6 requirements for building docs, switched test-runner from mutagen to basic docker compose 2026-06-29 00:14:40 +02:00
Simon Wisselink ac27e1e5b6 fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent
Fixes #1192
2026-06-29 00:12:45 +02:00
6 changed files with 27 additions and 9 deletions
+4
View File
@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
## [5.8.3] - 2026-06-28
- fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
## [5.8.2] - 2026-06-24
- Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
- Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
+14
View File
@@ -0,0 +1,14 @@
# Python dependencies for building/previewing the docs.
#
# pip install -r docs/requirements.txt
# mkdocs serve # local preview
# mike deploy 5.x # publish
#
# pymdown-extensions must be >=11: earlier releases pass filename=None to
# Pygments, and Pygments >=2.19 then crashes with
# "'NoneType' object has no attribute 'replace'" on any untitled code block.
mkdocs>=1.6
mkdocs-material>=9.7
pymdown-extensions>=11
Pygments>=2.19
mike>=2.2
+1 -1
View File
@@ -5,7 +5,7 @@
# - ./run-tests-for-all-php-versions.sh --group 20221124
# - ./run-tests-for-all-php-versions.sh --exclude-group slow
COMPOSE_CMD="mutagen-compose"
COMPOSE_CMD="docker compose"
$COMPOSE_CMD run --rm php72 ./run-tests.sh $@ && \
$COMPOSE_CMD run --rm php73 ./run-tests.sh $@ && \
+2 -6
View File
@@ -69,12 +69,8 @@ class InheritanceRuntime {
* @param array $blockNames outer level block name
*/
public function init(Template $tpl, $initChild, $blockNames = []) {
// if called while executing parent template it must be a sub-template with new inheritance root.
// A new root is started either by a child template ($initChild) or by a sub-template included
// outside of any block rendering (empty source stack); the latter must not inherit the leftover
// block overrides of a previously completed inheritance tree (see issue #1189).
if (($initChild || empty($this->sourceStack)) && $this->state === 3
&& (strpos($tpl->template_resource, 'extendsall') === false)) {
// if called while executing parent template it must be a sub-template with new inheritance root
if ($initChild && $this->state === 3 && (strpos($tpl->template_resource, 'extendsall') === false)) {
$tpl->setInheritance(clone $tpl->getSmarty()->getRuntime('Inheritance'));
$tpl->getInheritance()->init($tpl, $initChild, $blockNames);
return;
+1 -1
View File
@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
/**
* smarty version
*/
const SMARTY_VERSION = '5.8.2';
const SMARTY_VERSION = '5.8.3';
/**
* define caching modes
+5 -1
View File
@@ -260,7 +260,11 @@ class Template extends TemplateBase {
$tpl = $this->smarty->doCreateTemplate($template_name, $cache_id, $compile_id, $this, $caching, $cache_lifetime);
$tpl->inheritance = $this->getInheritance(); // re-use the same Inheritance object inside the inheritance tree
// Re-use the same Inheritance object only inside an active inheritance tree, i.e. when this
// (including) template already has one. A template outside any inheritance tree has no
// Inheritance object (null); sub-templates it {include}s must then start with their own, so an
// {include}d template that uses {block}/{extends} creates a fresh root via getInheritance().
$tpl->inheritance = $this->inheritance;
if ($scope) {
$tpl->defaultScope = $scope;