Brought lexer source functionally up-to-date with compiled version

Fixes #621

.gitattributes

@@ -12,6 +12,7 @@
 /.gitattributes export-ignore
 /.gitignore export-ignore
 /.travis.yml export-ignore
+/error_reporting.ini export-ignore
 /make-release.sh export-ignore
 /phpunit.sh export-ignore
 /phpunit.xml export-ignore

CHANGELOG.md

@@ -6,25 +6,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Changed
-- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649
-
-### Fixed
-- Fixed render crash when using inline include with a string template https://github.com/smarty-php/smarty/issues/639
-
-## [3.1.39] - 2021-02-17
-
-### Security
-- Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
-- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120.
-
-## [3.1.38] - 2021-01-08
-
-### Fixed
-- Smarty::SMARTY_VERSION wasn't updated https://github.com/smarty-php/smarty/issues/628
-
-## [3.1.37] - 2021-01-07
-
 ### Changed
 - Changed error handlers and handling of undefined constants for php8-compatibility (set $errcontext argument optional) https://github.com/smarty-php/smarty/issues/605
 - Changed expected error levels in unit tests for php8-compatibility

SECURITY.md

@@ -1,19 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Smarty currently supports the latest minor version of Smarty 3 and Smarty 4. (Smarty 4 has not been released yet.)
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 4.0.x   | :white_check_mark: |
-| 3.1.x   | :white_check_mark: |
-| < 3.1   | :x:                |
-
-## Reporting a Vulnerability
-
- If you have discovered a security issue with Smarty, please contact us at mail [at] simonwisselink.nl. Do not 
- disclose your findings publicly and PLEASE PLEASE do not file an Issue.
- 
-We will try to confirm the vulnerability and develop a fix if appropriate. When we release the fix, we will publish 
-a security release. Please let us know if you want to be credited.

error_reporting.ini

@@ -0,0 +1 @@
+error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT

libs/Smarty.class.php

@@ -27,6 +27,7 @@
  * @author    Uwe Tews   <uwe dot tews at gmail dot com>
  * @author    Rodney Rehm
  * @package   Smarty
+ * @version   3.1.36
  */
 /**
  * set SMARTY_DIR to absolute path to Smarty library files.
@@ -111,7 +112,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.39';
+    const SMARTY_VERSION = '3.1.36';
     /**
      * define variable scopes
      */

libs/plugins/modifier.escape.php

@@ -250,7 +250,6 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
             }
             return $return;
         default:
-            trigger_error("escape: unsupported type: $esc_type - returning unmodified string", E_USER_NOTICE);
             return $string;
     }
 }

libs/sysplugins/smarty_internal_compile_function.php

@@ -58,11 +58,6 @@ class Smarty_Internal_Compile_Function extends Smarty_Internal_CompileBase
         }
         unset($_attr[ 'nocache' ]);
         $_name = trim($_attr[ 'name' ], '\'"');
-
-        if (!preg_match('/^[a-zA-Z0-9_\x80-\xff]+$/', $_name)) {
-	        $compiler->trigger_template_error("Function name contains invalid characters: {$_name}", null, true);
-        }
-
         $compiler->parent_compiler->tpl_function[ $_name ] = array();
         $save = array(
             $_attr, $compiler->parser->current_buffer, $compiler->template->compiled->has_nocache_code,

libs/sysplugins/smarty_internal_compile_private_special_variable.php

@@ -81,10 +81,6 @@ class Smarty_Internal_Compile_Private_Special_Variable extends Smarty_Internal_C
                 case 'template':
                     return 'basename($_smarty_tpl->source->filepath)';
                 case 'template_object':
-                    if (isset($compiler->smarty->security_policy)) {
-                        $compiler->trigger_template_error("(secure mode) template_object not permitted");
-                        break;
-                    }
                     return '$_smarty_tpl';
                 case 'current_dir':
                     return 'dirname($_smarty_tpl->source->filepath)';

libs/sysplugins/smarty_internal_config_file_compiler.php

@@ -115,7 +115,7 @@ class Smarty_Internal_Config_File_Compiler
             $this->smarty->_debug->start_compile($this->template);
         }
         // init the lexer/parser to compile the config file
-        /* @var Smarty_Internal_ConfigFileLexer $this->lex */
+        /* @var Smarty_Internal_ConfigFileLexer $this ->lex */
         $this->lex = new $this->lexer_class(
             str_replace(
                 array(
@@ -127,7 +127,7 @@ class Smarty_Internal_Config_File_Compiler
             ) . "\n",
             $this
         );
-        /* @var Smarty_Internal_ConfigFileParser $this->parser */
+        /* @var Smarty_Internal_ConfigFileParser $this ->parser */
         $this->parser = new $this->parser_class($this->lex, $this);
         if (function_exists('mb_internal_encoding')
             && function_exists('ini_get')

libs/sysplugins/smarty_internal_template.php

@@ -317,7 +317,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
                 $tpl->template_resource = $template;
                 $tpl->cache_id = $cache_id;
                 $tpl->compile_id = $compile_id;
-                if (isset($uid) && isset($tpl->compiled->file_dependency[ $uid ])) {
+                if (isset($uid)) {
                     // for inline templates we can get all resource information from file dependency
                     list($filepath, $timestamp, $type) = $tpl->compiled->file_dependency[ $uid ];
                     $tpl->source = new Smarty_Template_Source($smarty, $filepath, $type, $filepath);

make-release.sh

@@ -14,6 +14,6 @@ git pull
 git merge --no-ff "release/$1"
 git branch -d "release/$1"
 git tag -a "v$1" -m "Release $1"
+git push --follow-tags
 
 printf 'Done creating release %s\n' "$1"
-printf 'Run `git push --follow-tags origin` to publish it.\n'

tests/UnitTests/CacheResourceTests/_shared/CacheResourceTestCommon.php

@@ -339,10 +339,6 @@ class CacheResourceTestCommon extends PHPUnit_Smarty
         $this->assertNull($tpl->cached->handler->getCachedContent($tpl3));
         $this->assertEquals('hello world', $tpl->cached->handler->getCachedContent($tpl4));
     }
-
-    /**
-     * @group slow
-     */
    public function testClearCacheExpired()
     {
         $this->smarty->caching = true;
@@ -403,7 +399,7 @@ class CacheResourceTestCommon extends PHPUnit_Smarty
      * @runInSeparateProcess
      * @preserveGlobalState disabled
      * @dataProvider data
-     * @group slow
+     *
      */
     public function testCache($lockTime, $lockTimeout, $compile_id, $cache_id, $isCached, $tmin, $tmax, $forceCompile, $forceCache, $update, $testNumber, $compileTestNumber, $renderTestNumber, $testName)
     {

tests/UnitTests/ResourceTests/Extends/ExtendsResourceTest.php

@@ -125,7 +125,7 @@ class ExtendsResourceTest extends PHPUnit_Smarty
      * test  grandchild/child/parent dependency test2
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
+     *
      */
     public function testCompileBlockGrandChildMustCompile_021_2()
     {
@@ -193,7 +193,7 @@ class ExtendsResourceTest extends PHPUnit_Smarty
      * test  grandchild/child/parent dependency test4
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
+     *
      */
     public function testCompileBlockGrandChildMustCompile_021_4()
     {

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -382,15 +382,6 @@ class SecurityTest extends PHPUnit_Smarty
         $this->smarty->security_policy->trusted_uri = array();
         $this->assertContains('<title>Preface | Smarty</title>', $this->smarty->fetch('string:{fetch file="https://www.smarty.net/docs/en/preface.tpl"}'));
     }
-
-    /**
-     * In security mode, accessing $smarty.template_object should be illegal.
-     * @expectedException SmartyCompilerException
-     */
-    public function testSmartyTemplateObject() {
-        $this->smarty->display('string:{$smarty.template_object}');
-    }
-
 }
 
 class mysecuritystaticclass

tests/UnitTests/TemplateSource/TagTests/BockExtend/CompileBlockExtendsTest.php

@@ -610,7 +610,7 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
      *
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
+     *
      */
     public function testCompileBlockGrandChildMustCompile_021_2()
     {
@@ -645,7 +645,7 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
      *
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
+     *
      */
     public function testCompileBlockGrandChildMustCompile_021_3()
     {
@@ -670,7 +670,7 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
      *
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
+     *
      */
     public function testCompileBlockGrandChildMustCompile_021_32()
     {
@@ -692,7 +692,6 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
      *
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
      */
     public function testCompileBlockGrandChildMustCompile_021_4()
     {
@@ -717,7 +716,6 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
      *
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
      */
     public function testCompileBlockGrandChildMustCompile_021_42()
     {

tests/UnitTests/TemplateSource/TagTests/Include/CompileIncludeTest.php

@@ -324,12 +324,4 @@ class CompileIncludeTest extends PHPUnit_Smarty
                      array("A{include file='include_spacing3.tpl'}B\nC", "AbarB\nC", '3_Newline3', $i++),
         );
     }
-
-	/**
-	 * Test Inline Include with string template
-	 */
-	public function testInlineStringInclude()
-	{
-		$this->assertEquals('include-inline', $this->smarty->fetch('inline_string_include.tpl'));
-	}
 }

tests/UnitTests/TemplateSource/TagTests/Include/templates/inline_string_include.tpl

@@ -1 +0,0 @@
-{include "string:include-inline" inline}

tests/UnitTests/TemplateSource/TagTests/Insert/CompileInsertTest.php

@@ -210,7 +210,6 @@ class CompileInsertTest extends PHPUnit_Smarty
      * test insert plugin caching 2
      * @runInSeparateProcess
      * @preserveGlobalState disabled
-     * @group slow
      */
     public function testInsertPluginCaching3_2()
     {

tests/UnitTests/TemplateSource/TagTests/TemplateFunction/CompileFunctionTest.php

@@ -431,14 +431,5 @@ class CompileFunctionTest extends PHPUnit_Smarty
                      array("{function name=simple}A{\$foo}\nC{/function}{call name='simple'}", "Abar\nC", 'T14', $i++),
                      array("{function name=simple}A\n{\$foo}\nC{/function}{call name='simple'}", "A\nbar\nC", 'T15', $i++),
         );
-    }
-
-    /**
-     * Test handling of function names that are a security risk
-     * @expectedException        SmartyCompilerException
-     */
-    public function testIllegalFunctionName() {
-	    $this->smarty->fetch('string:{function name=\'rce(){};echo "hi";function \'}{/function}');
-    }
-
+            }
 }

tests/UnitTests/TemplateSource/ValueTests/SmartySpecialVars/Now/SmartyNowTest.php

@@ -35,7 +35,7 @@ class SmartyNowTest extends PHPUnit_Smarty
     }
     /**
      * test {$smarty.now nocache}
-     * @group slow
+     *
      */
     public function testSmartyNowNocache() {
         $this->smarty->setCaching(true);

tests/UnitTests/TemplateSource/ValueTests/Variables/Stream/StreamVariableTest.php

@@ -59,7 +59,7 @@ class StreamVariableTest extends PHPUnit_Smarty
         }
     */
     /**
-     * test no existent stream variable
+     * test no existant stream variable
      */
     //    public function testStreamVariable2()
     //    {