Fixed logic error in this changed if statement

CHANGELOG.md

@@ -6,56 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Fixes
-- Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794)
-
-## [3.1.46] - 2022-08-01
-
-### Fixed
-- Fixed problems with smarty_mb_str_replace [#549](https://github.com/smarty-php/smarty/issues/549)
-- Fixed second parameter of unescape modifier not working [#777](https://github.com/smarty-php/smarty/issues/777)
-
-## [3.1.45] - 2022-05-17
-
-### Security
-- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221
-
-### Fixed
-- Math equation `max(x, y)` didn't work anymore [#721](https://github.com/smarty-php/smarty/issues/721)
-
-## [3.1.44] - 2022-01-18
-
-### Fixed
-- Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-php/smarty/issues/702)
-
-## [3.1.43] - 2022-01-10
-
-### Security
-- Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408
-
-## [3.1.42] - 2022-01-10
-
-### Security
-- Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This addresses CVE-2021-29454
-
-## [3.1.41] - 2022-01-09
-
-### Security
-- Rewrote the mailto function to not use `eval` when encoding with javascript
-
-## [3.1.40] - 2021-10-13
-
-### Changed
-- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649
-
-### Security
-- More advanced javascript escaping to handle https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks to m-haritonov
-
 ## [3.1.39] - 2021-02-17
 
 ### Security
-- Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
-- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120.
+- Prevent access to `$smarty.template_object` in sandbox mode
+- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}` 
 
 ## [3.1.38] - 2021-01-08
 

README.md

@@ -18,7 +18,7 @@ Smarty can be run with PHP 5.2 to PHP 7.4.
 
 > Read the NEW_FEATURES and INHERITANCE_RELEASE_NOTES file for recent extensions to Smarty 3.1 functionality
 
-Smarty versions 3.1.11 or later are now on GitHub and can be installed with Composer.
+Smarty versions 3.1.11 or later are now on github and can be installed with Composer.
 
 
 The "smarty/smarty" package will start at libs/....   subfolder.

SECURITY.md

@@ -1,19 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Smarty currently supports the latest minor version of Smarty 3 and Smarty 4. (Smarty 4 has not been released yet.)
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 4.0.x   | :white_check_mark: |
-| 3.1.x   | :white_check_mark: |
-| < 3.1   | :x:                |
-
-## Reporting a Vulnerability
-
- If you have discovered a security issue with Smarty, please contact us at mail [at] simonwisselink.nl. Do not 
- disclose your findings publicly and PLEASE PLEASE do not file an Issue.
- 
-We will try to confirm the vulnerability and develop a fix if appropriate. When we release the fix, we will publish 
-a security release. Please let us know if you want to be credited.

lexer/smarty_internal_templateparser.y

@@ -758,9 +758,6 @@ value(res)       ::= doublequoted_with_quotes(s). {
 
 
 value(res)    ::= varindexed(vi) DOUBLECOLON static_class_access(r). {
-    if ($this->security && $this->security->static_classes !== array()) {
-        $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
-    }
     $prefixVar = $this->compiler->getNewPrefixVariable();
     if (vi['var'] === '\'smarty\'') {
         $this->compiler->appendPrefixCode("<?php {$prefixVar} = ". $this->compiler->compileTag('private_special_variable',array(),vi['smarty_internal_index']).';?>');

libs/Smarty.class.php

@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.46';
+    const SMARTY_VERSION = '3.1.39';
     /**
      * define variable scopes
      */

libs/plugins/function.mailto.php

@@ -94,19 +94,22 @@ function smarty_function_mailto($params)
         );
         return;
     }
+    // FIXME: (rodneyrehm) document.write() excues me what? 1998 has passed!
     if ($encode === 'javascript') {
-	    $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
+        $string = 'document.write(\'<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>\');';
         $js_encode = '';
         for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
             $js_encode .= '%' . bin2hex($string[ $x ]);
         }
-        return '<script type="text/javascript">document.write(unescape(\'' . $js_encode . '\'))</script>';
+        return '<script type="text/javascript">eval(unescape(\'' . $js_encode . '\'))</script>';
     } elseif ($encode === 'javascript_charcode') {
         $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
-        for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
+        for ($x = 0, $y = strlen($string); $x < $y; $x++) {
             $ord[] = ord($string[ $x ]);
         }
-	    return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
+        $_ret = "<script type=\"text/javascript\" language=\"javascript\">\n" . "{document.write(String.fromCharCode(" .
+                implode(',', $ord) . "))" . "}\n" . "</script>\n";
+        return $_ret;
     } elseif ($encode === 'hex') {
         preg_match('!^(.*)(\?.*)$!', $address, $match);
         if (!empty($match[ 2 ])) {

libs/plugins/function.math.php

@@ -28,12 +28,7 @@ function smarty_function_math($params, $template)
             'int'   => true,
             'abs'   => true,
             'ceil'  => true,
-            'acos'   => true,
-            'acosh'   => true,
             'cos'   => true,
-            'cosh'   => true,
-            'deg2rad'   => true,
-            'rad2deg'   => true,
             'exp'   => true,
             'floor' => true,
             'log'   => true,
@@ -44,51 +39,27 @@ function smarty_function_math($params, $template)
             'pow'   => true,
             'rand'  => true,
             'round' => true,
-            'asin'   => true,
-            'asinh'   => true,
             'sin'   => true,
-            'sinh'   => true,
             'sqrt'  => true,
             'srand' => true,
-            'atan'   => true,
-            'atanh'   => true,
-            'tan'   => true,
-            'tanh'   => true
+            'tan'   => true
         );
-
     // be sure equation parameter is present
     if (empty($params[ 'equation' ])) {
         trigger_error("math: missing equation parameter", E_USER_WARNING);
         return;
     }
     $equation = $params[ 'equation' ];
-
-    // Remove whitespaces
-    $equation = preg_replace('/\s+/', '', $equation);
-
-    // Adapted from https://www.php.net/manual/en/function.eval.php#107377
-    $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
-    $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
-    $operators = '[,+\/*\^%-]'; // Allowed math operators
-    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)*\)|\((?1)*\)))(?:'.$operators.'(?1))?)+$/';
-
-    if (!preg_match($regexp, $equation)) {
-        trigger_error("math: illegal characters", E_USER_WARNING);
-        return;
-    }
-
     // make sure parenthesis are balanced
     if (substr_count($equation, '(') !== substr_count($equation, ')')) {
         trigger_error("math: unbalanced parenthesis", E_USER_WARNING);
         return;
     }
-
     // disallow backticks
     if (strpos($equation, '`') !== false) {
         trigger_error("math: backtick character not allowed in equation", E_USER_WARNING);
         return;
     }
-
     // also disallow dollar signs
     if (strpos($equation, '$') !== false) {
         trigger_error("math: dollar signs not allowed in equation", E_USER_WARNING);
@@ -125,7 +96,6 @@ function smarty_function_math($params, $template)
     }
     $smarty_math_result = null;
     eval("\$smarty_math_result = " . $equation . ";");
-
     if (empty($params[ 'format' ])) {
         if (empty($params[ 'assign' ])) {
             return $smarty_math_result;

libs/plugins/modifier.escape.php

@@ -184,11 +184,7 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
                     '"'  => '\\"',
                     "\r" => '\\r',
                     "\n" => '\\n',
-                    '</' => '<\/',
-                    // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
-                    '<!--' => '<\!--',
-                    '<s'   => '<\s',
-                    '<S'   => '<\S'
+                    '</' => '<\/'
                 )
             );
         case 'mail':
@@ -254,7 +250,6 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
             }
             return $return;
         default:
-            trigger_error("escape: unsupported type: $esc_type - returning unmodified string", E_USER_NOTICE);
             return $string;
     }
 }

libs/plugins/modifiercompiler.escape.php

@@ -89,10 +89,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
                 return 'preg_replace("%(?<!\\\\\\\\)\'%", "\\\'",' . $params[ 0 ] . ')';
             case 'javascript':
                 // escape quotes and backslashes, newlines, etc.
-                // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                 return 'strtr(' .
                        $params[ 0 ] .
-                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/" ))';
         }
     } catch (SmartyException $e) {
         // pass through to regular plugin fallback

libs/plugins/modifiercompiler.unescape.php

@@ -14,28 +14,20 @@
  * @author Rodney Rehm
  *
  * @param array $params parameters
- * @param Smarty_Internal_TemplateCompilerBase $compiler
  *
  * @return string with compiled code
  */
-function smarty_modifiercompiler_unescape($params, Smarty_Internal_TemplateCompilerBase $compiler)
+function smarty_modifiercompiler_unescape($params)
 {
-    $compiler->template->_checkPlugins(
-        array(
-            array(
-                'function' => 'smarty_literal_compiler_param',
-                'file'     => SMARTY_PLUGINS_DIR . 'shared.literal_compiler_param.php'
-            )
-        )
-    );
-
-    $esc_type = smarty_literal_compiler_param($params, 1, 'html');
-
+    if (!isset($params[ 1 ])) {
+        $params[ 1 ] = 'html';
+    }
     if (!isset($params[ 2 ])) {
         $params[ 2 ] = '\'' . addslashes(Smarty::$_CHARSET) . '\'';
+    } else {
+        $params[ 2 ] = "'{$params[ 2 ]}'";
     }
-
-    switch ($esc_type) {
+    switch (trim($params[ 1 ], '"\'')) {
         case 'entity':
         case 'htmlall':
             if (Smarty::$_MBSTRING) {

libs/plugins/shared.mb_str_replace.php

@@ -44,43 +44,9 @@ if (!function_exists('smarty_mb_str_replace')) {
                 }
             }
         } else {
-            $mb_reg_charset = mb_regex_encoding();
-            // Check if mbstring regex is using UTF-8
-            $reg_is_unicode = !strcasecmp($mb_reg_charset, "UTF-8");
-            if(!$reg_is_unicode) {
-                // ...and set to UTF-8 if not
-                mb_regex_encoding("UTF-8");
-            }
-
-            // See if charset used by Smarty is matching one used by regex...
-            $current_charset = mb_regex_encoding();
-            $convert_result = (bool)strcasecmp(Smarty::$_CHARSET, $current_charset);
-            if($convert_result) {
-                // ...convert to it if not.
-                $subject = mb_convert_encoding($subject, $current_charset, Smarty::$_CHARSET);
-                $search = mb_convert_encoding($search, $current_charset, Smarty::$_CHARSET);
-                $replace = mb_convert_encoding($replace, $current_charset, Smarty::$_CHARSET);
-            }
-
             $parts = mb_split(preg_quote($search), $subject);
-            // If original regex encoding was not unicode...
-            if(!$reg_is_unicode) {
-                // ...restore original regex encoding to avoid breaking the system.
-                mb_regex_encoding($mb_reg_charset);
-            }
-            if($parts === false) {
-                // This exception is thrown if call to mb_split failed.
-                // Usually it happens, when $search or $replace are not valid for given mb_regex_encoding().
-                // There may be other cases for it to fail, please file an issue if you find a reproducible one.
-                throw new SmartyException("Source string is not a valid $current_charset sequence (probably)");
-            }
-
             $count = count($parts) - 1;
             $subject = implode($replace, $parts);
-            // Convert results back to charset used by Smarty, if needed.
-            if($convert_result) {
-                $subject = mb_convert_encoding($subject, Smarty::$_CHARSET, $current_charset);
-            }
         }
         return $subject;
     }

libs/sysplugins/smarty_internal_compile_block.php

@@ -125,7 +125,7 @@ class Smarty_Internal_Compile_Blockclose extends Smarty_Internal_Compile_Shared_
         // setup buffer for template function code
         $compiler->parser->current_buffer = new Smarty_Internal_ParseTree_Template();
         $output = "<?php\n";
-        $output .= $compiler->cStyleComment(" {block {$_name}} ") . "\n";
+        $output .= "/* {block {$_name}} */\n";
         $output .= "class {$_className} extends Smarty_Internal_Block\n";
         $output .= "{\n";
         foreach ($_block as $property => $value) {
@@ -155,7 +155,7 @@ class Smarty_Internal_Compile_Blockclose extends Smarty_Internal_Compile_Shared_
         }
         $output .= "}\n";
         $output .= "}\n";
-        $output .= $compiler->cStyleComment(" {/block {$_name}} ") . "\n\n";
+        $output .= "/* {/block {$_name}} */\n\n";
         $output .= "?>\n";
         $compiler->parser->current_buffer->append_subtree(
             $compiler->parser,

libs/sysplugins/smarty_internal_compile_function.php

@@ -134,7 +134,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
         if ($compiler->template->compiled->has_nocache_code) {
             $compiler->parent_compiler->tpl_function[ $_name ][ 'call_name_caching' ] = $_funcNameCaching;
             $output = "<?php\n";
-            $output .= $compiler->cStyleComment(" {$_funcNameCaching} ") . "\n";
+            $output .= "/* {$_funcNameCaching} */\n";
             $output .= "if (!function_exists('{$_funcNameCaching}')) {\n";
             $output .= "function {$_funcNameCaching} (Smarty_Internal_Template \$_smarty_tpl,\$params) {\n";
             $output .= "ob_start();\n";
@@ -159,7 +159,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
             $output .= "/*/%%SmartyNocache:{$compiler->template->compiled->nocache_hash}%%*/\";\n?>";
             $output .= "<?php echo str_replace('{$compiler->template->compiled->nocache_hash}', \$_smarty_tpl->compiled->nocache_hash, ob_get_clean());\n";
             $output .= "}\n}\n";
-            $output .= $compiler->cStyleComment("/ {$_funcName}_nocache ") . "\n\n";
+            $output .= "/*/ {$_funcName}_nocache */\n\n";
             $output .= "?>\n";
             $compiler->parser->current_buffer->append_subtree(
                 $compiler->parser,
@@ -179,7 +179,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
         }
         $compiler->parent_compiler->tpl_function[ $_name ][ 'call_name' ] = $_funcName;
         $output = "<?php\n";
-        $output .= $compiler->cStyleComment(" {$_funcName} ") . "\n";
+        $output .= "/* {$_funcName} */\n";
         $output .= "if (!function_exists('{$_funcName}')) {\n";
         $output .= "function {$_funcName}(Smarty_Internal_Template \$_smarty_tpl,\$params) {\n";
         $output .= $_paramsCode;
@@ -196,7 +196,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
         );
         $compiler->parser->current_buffer->append_subtree($compiler->parser, $_functionCode);
         $output = "<?php\n}}\n";
-        $output .= $compiler->cStyleComment("/ {$_funcName} ") . "\n\n";
+        $output .= "/*/ {$_funcName} */\n\n";
         $output .= "?>\n";
         $compiler->parser->current_buffer->append_subtree(
             $compiler->parser,

libs/sysplugins/smarty_internal_compile_include.php

@@ -318,14 +318,14 @@ class Smarty_Internal_Compile_Include extends Smarty_Internal_CompileBase
             }
             // get compiled code
             $compiled_code = "<?php\n\n";
-            $compiled_code .= $compiler->cStyleComment(" Start inline template \"{$sourceInfo}\" =============================") . "\n";
+            $compiled_code .= "/* Start inline template \"{$sourceInfo}\" =============================*/\n";
             $compiled_code .= "function {$tpl->compiled->unifunc} (Smarty_Internal_Template \$_smarty_tpl) {\n";
             $compiled_code .= "?>\n" . $tpl->compiler->compileTemplateSource($tpl, null, $compiler->parent_compiler);
             $compiled_code .= "<?php\n";
             $compiled_code .= "}\n?>\n";
             $compiled_code .= $tpl->compiler->postFilter($tpl->compiler->blockOrFunctionCode);
             $compiled_code .= "<?php\n\n";
-            $compiled_code .= $compiler->cStyleComment(" End inline template \"{$sourceInfo}\" =============================") . "\n";
+            $compiled_code .= "/* End inline template \"{$sourceInfo}\" =============================*/\n";
             $compiled_code .= '?>';
             unset($tpl->compiler);
             if ($tpl->compiled->has_nocache_code) {

libs/sysplugins/smarty_internal_config_file_compiler.php

@@ -157,12 +157,10 @@ class Smarty_Internal_Config_File_Compiler
             $this->smarty->_debug->end_compile($this->template);
         }
         // template header code
-        $template_header = sprintf(
-            "<?php /* Smarty version %s, created on %s\n         compiled from '%s' */ ?>\n",
-            Smarty::SMARTY_VERSION,
-            date("Y-m-d H:i:s"),
-            str_replace('*/', '* /' , $this->template->source->filepath)
-        );
+        $template_header =
+            "<?php /* Smarty version " . Smarty::SMARTY_VERSION . ", created on " . strftime("%Y-%m-%d %H:%M:%S") .
+            "\n";
+        $template_header .= "         compiled from '{$this->template->source->filepath}' */ ?>\n";
         $code = '<?php $_smarty_tpl->smarty->ext->configLoad->_loadConfigVars($_smarty_tpl, ' .
                 var_export($this->config_data, true) . '); ?>';
         return $template_header . $this->template->smarty->ext->_codeFrame->create($this->template, $code);

libs/sysplugins/smarty_internal_resource_file.php

@@ -37,7 +37,8 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
                 $source->filepath . ($source->isConfig ? $source->smarty->_joined_config_dir :
                     $source->smarty->_joined_template_dir)
             );
-            $source->timestamp = filemtime($source->filepath);
+            // When not doing compile_check, set timestamp to true
+            $source->timestamp = $source->smarty->compile_check ? filemtime($source->filepath) : true;
         } else {
             $source->timestamp = $source->exists = false;
         }
@@ -50,6 +51,10 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
      */
     public function populateTimestamp(Smarty_Template_Source $source)
     {
+        if (!$source->smarty->compile_check) {
+            $source->timestamp =  $source->exists = true;
+            return;
+        }
         if (!$source->exists) {
             $source->timestamp = $source->exists = is_file($source->filepath);
         }
@@ -68,13 +73,15 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
      */
     public function getContent(Smarty_Template_Source $source)
     {
-        if ($source->exists) {
-            return file_get_contents($source->filepath);
+        if (($source->smarty->compile_check && !$source->exists)
+            || false === ($content = file_get_contents($source->filepath))
+        ) {
+            throw new SmartyException(
+                'Unable to read ' . ($source->isConfig ? 'config' : 'template') .
+                " {$source->type} '{$source->name}'"
+            );
         }
-        throw new SmartyException(
-            'Unable to read ' . ($source->isConfig ? 'config' : 'template') .
-            " {$source->type} '{$source->name}'"
-        );
+        return $content;
     }
 
     /**
@@ -126,6 +133,17 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
             $file = str_replace(DIRECTORY_SEPARATOR === '/' ? '\\' : '/', DIRECTORY_SEPARATOR, $file);
         }
         $_directories = $source->smarty->getTemplateDir(null, $source->isConfig);
+
+        // If possible, assume the file exists when compile_check = false;
+        if (!$source->smarty->compile_check
+            && count($_directories) == 1    // if there are multiple directories, we'll have to scan them
+            && $file[ 0 ] !== '['           // template_dir index
+            && !$source->smarty->use_include_path // cannot optimize when we need to use include path
+        ) {
+            $path = reset($_directories) . $file;
+            return (strpos($path, '.' . DIRECTORY_SEPARATOR) !== false) ? $source->smarty->_realpath($path) : $path;
+        }
+
         // template_dir index?
         if ($file[ 0 ] === '[' && preg_match('#^\[([^\]]+)\](.+)$#', $file, $fileMatch)) {
             $file = $fileMatch[ 2 ];
@@ -157,6 +175,7 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
                 $_directories = $_index_dirs;
             }
         }
+
         // relative file name?
         foreach ($_directories as $_directory) {
             $path = $_directory . $file;

libs/sysplugins/smarty_internal_runtime_codeframe.php

@@ -44,12 +44,9 @@ class Smarty_Internal_Runtime_CodeFrame
             $properties[ 'file_dependency' ] = $_template->cached->file_dependency;
             $properties[ 'cache_lifetime' ] = $_template->cache_lifetime;
         }
-        $output = sprintf(
-            "<?php\n/* Smarty version %s, created on %s\n  from '%s' */\n\n",
-            $properties[ 'version' ],
-            date("Y-m-d H:i:s"),
-            str_replace('*/', '* /', $_template->source->filepath)
-        );
+        $output = "<?php\n";
+        $output .= "/* Smarty version {$properties[ 'version' ]}, created on " . strftime("%Y-%m-%d %H:%M:%S") .
+                   "\n  from '" . str_replace('*/', '* /', $_template->source->filepath) . "' */\n\n";
         $output .= "/* @var Smarty_Internal_Template \$_smarty_tpl */\n";
         $dec = "\$_smarty_tpl->_decodeProperties(\$_smarty_tpl, " . var_export($properties, true) . ',' .
                ($cache ? 'true' : 'false') . ')';

libs/sysplugins/smarty_internal_templatecompilerbase.php

@@ -1455,10 +1455,6 @@ abstract class Smarty_Internal_TemplateCompilerBase
      */
     abstract protected function doCompile($_content, $isTemplateSource = false);
 
-    public function cStyleComment($string) {
-        return '/*' . str_replace('*/', '* /' , $string) . '*/';
-    }
-
     /**
      * Compile Tag
      *

libs/sysplugins/smarty_internal_templateparser.php

@@ -2837,10 +2837,6 @@ class Smarty_Internal_Templateparser
     // line 765 "../smarty/lexer/smarty_internal_templateparser.y"
     public function yy_r95()
     {
-        if ($this->security && $this->security->static_classes !== array()) {
-            $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
-        }
-
         $prefixVar = $this->compiler->getNewPrefixVariable();
         if ($this->yystack[ $this->yyidx + -2 ]->minor[ 'var' ] === '\'smarty\'') {
             $this->compiler->appendPrefixCode("<?php {$prefixVar} = " .

libs/sysplugins/smarty_template_compiled.php

@@ -74,9 +74,14 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
             $this->filepath .= '.cache';
         }
         $this->filepath .= '.php';
-        $this->timestamp = $this->exists = is_file($this->filepath);
-        if ($this->exists) {
-            $this->timestamp = filemtime($this->filepath);
+
+        if ($smarty->compile_check) {
+            $this->timestamp = $this->exists = is_file($this->filepath);
+            if ($this->exists) {
+                $this->timestamp = filemtime($this->filepath);
+            }
+        } else {
+            $this->timestamp = $this->exists = true;
         }
     }
 
@@ -135,8 +140,9 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
         if ($source->handler->recompiled) {
             $source->handler->process($_smarty_tpl);
         } elseif (!$source->handler->uncompiled) {
-            if (!$this->exists || $smarty->force_compile
-                || ($_smarty_tpl->compile_check && $source->getTimeStamp() > $this->getTimeStamp())
+            if (
+                $smarty->force_compile ||
+                ($_smarty_tpl->compile_check && (!$this->exists || ($source->getTimeStamp() > $this->getTimeStamp())))
             ) {
                 $this->compileTemplateSource($_smarty_tpl);
                 $compileCheck = $_smarty_tpl->compile_check;

make-release.sh

@@ -1,11 +1,6 @@
 #!/bin/bash
 
-if [[ "$1" =~ ^3\.[0-9\.-rc]+$ ]]; then
-   printf 'Creating release %s\n' "$1"
-else
-   echo "Invalid version number: $1. This script can only make v3.x.x releases."
-   exit 1;
-fi
+printf 'Creating release %s\n' "$1"
 
 git checkout -b "release/$1"
 sed -i "s/## \\[Unreleased\\]/## \\[Unreleased\\]\\n\\n## \\[$1\\] - $(date +%Y-%m-%d)/" CHANGELOG.md
@@ -14,13 +9,11 @@ sed -i "s/const SMARTY_VERSION = '[^']\+';/const SMARTY_VERSION = '$1';/" libs/S
 git add CHANGELOG.md libs/Smarty.class.php
 git commit -m "version bump"
 
-git checkout support/3.1
+git checkout master
 git pull
 git merge --no-ff "release/$1"
 git branch -d "release/$1"
 git tag -a "v$1" -m "Release $1"
 
 printf 'Done creating release %s\n' "$1"
-
-# shellcheck disable=SC2016
 printf 'Run `git push --follow-tags origin` to publish it.\n'

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -298,38 +298,18 @@ class SecurityTest extends PHPUnit_Smarty
         $this->assertEquals('25', $this->smarty->fetch($tpl));
     }
 
-	/**
-	 * test not trusted PHP function
-	 * @expectedException        SmartyException
-	 * @expectedExceptionMessage   access to static class 'mysecuritystaticclass' not allowed by security setting
-	 */
-	public function testNotTrustedStaticClass()
-	{
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
-	}
-
-	/**
-	 * test not trusted PHP function
-	 * @expectedException        SmartyException
-	 * @expectedExceptionMessage   dynamic static class not allowed by security setting
-	 */
-	public function testNotTrustedStaticClassEval()
-	{
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{$test = "mysecuritystaticclass"}{$test::square(5)}');
-	}
-
-	/**
-	 * test not trusted PHP function
-	 * @expectedException        SmartyException
-	 * @expectedExceptionMessage   dynamic static class not allowed by security setting
-	 */
-	public function testNotTrustedStaticClassSmartyVar()
-	{
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{$smarty.template_object::square(5)}');
-	}
+/**
+ * test not trusted PHP function
+  * @expectedException        SmartyException
+  * @expectedExceptionMessage   access to static class 'mysecuritystaticclass' not allowed by security setting
+  * @runInSeparateProcess
+  * @preserveGlobalState disabled
+  */
+    public function testNotTrustedStaticClass()
+    {
+        $this->smarty->security_policy->static_classes = array('null');
+            $this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
+    }
 
     public function testChangedTrustedDirectory()
     {

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php

@@ -54,7 +54,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
 
     public function testEncodeJavascript()
     {
-        $result = '<script type="text/javascript">document.write(unescape(\'%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e\'))</script>';
+        $result = '<script type="text/javascript">eval(unescape(\'%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e%27%29%3b\'))</script>';
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
     }
@@ -62,7 +62,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
     public function testEncodeJavascriptWithoutMbstring()
     {
         Smarty::$_MBSTRING = false;
-        $result = '<script type="text/javascript">document.write(unescape(\'%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e\'))</script>';
+        $result = '<script type="text/javascript">eval(unescape(\'%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%3c%2f%61%3e%27%29%3b\'))</script>';
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;
@@ -70,7 +70,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
 
     public function testEncodeJavascriptCharcode()
     {
-        $result = '<script type="text/javascript">document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))</script>';
+        $result = "<script type=\"text/javascript\" language=\"javascript\">\n{document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))}\n</script>\n";
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript_charcode"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
     }
@@ -78,7 +78,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
     public function testEncodeJavascriptCharcodeWithoutMbstring()
     {
         Smarty::$_MBSTRING = false;
-        $result = '<script type="text/javascript">document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))</script>';
+        $result = "<script type=\"text/javascript\" language=\"javascript\">\n{document.write(String.fromCharCode(60,97,32,104,114,101,102,61,34,109,97,105,108,116,111,58,109,101,64,101,120,97,109,112,108,101,46,99,111,109,34,32,62,109,101,64,101,120,97,109,112,108,101,46,99,111,109,60,47,97,62))}\n</script>\n";
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me@example.com" encode="javascript_charcode"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierUnescapeTest.php

@@ -63,11 +63,6 @@ class PluginModifierUnescapeTest extends PHPUnit_Smarty
         $tpl = $this->smarty->createTemplate('string:{"' . $encoded . '"|unescape:"url"}');
         $this->assertEquals($result, $this->smarty->fetch($tpl));
     }
-
-    public function testCharset()
-    {
-        $tpl = $this->smarty->createTemplate("string:{''Stiff Opposition Expected to Casketless Funeral Plan''|unescape:'htmlall':'utf-8'}");
-        $this->assertEquals("'Stiff Opposition Expected to Casketless Funeral Plan'", $this->smarty->fetch($tpl));
-    }
-
 }
+
+?>

tests/UnitTests/TemplateSource/ValueTests/Math/MathTest.php

@@ -44,30 +44,6 @@ class MathTest extends PHPUnit_Smarty
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
 
-    public function testMultipleOperators()
-    {
-        $this->smarty->disableSecurity();
-        $expected = "2 -- 2";
-        $tpl = $this->smarty->createTemplate('eval:{$x = 5}{$y = 4}{math equation="x - y + 1" x=$x y=$y} -- {math equation="5 - 4 + 1"}');
-        $this->assertEquals($expected, $this->smarty->fetch($tpl));
-    }
-
-    public function testMathMaxFunctionParameters()
-    {
-        $this->smarty->disableSecurity();
-        $expected = max(0, 2) . ' -- ' . max(0, 2, 3);
-        $tpl = $this->smarty->createTemplate('eval:{$x = 0}{$y = 2}{$z = 3}{math equation="max(x, y)" x=$x y=$y} -- {math equation="max(x, y, z)" x=$x y=$y z=$z}');
-        $this->assertEquals($expected, $this->smarty->fetch($tpl));
-    }
-
-    public function testMathMinFunctionParameters()
-    {
-        $this->smarty->disableSecurity();
-        $expected = min(1, 2) . ' -- ' . min(1, 2, 0);
-        $tpl = $this->smarty->createTemplate('eval:{$x = 1}{$y = 2}{$z = 0}{math equation="min(x, y)" x=$x y=$y} -- {math equation="min(x, y, z)" x=$x y=$y z=$z}');
-        $this->assertEquals($expected, $this->smarty->fetch($tpl));
-    }
-
     public function testSyntaxSin()
     {
         $this->smarty->disableSecurity();
@@ -131,43 +107,4 @@ class MathTest extends PHPUnit_Smarty
         $tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="x * y" x=$x y=$y format="%0.2f"} -- {math equation="20.5 / 5" format="%0.2f"}');
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
-
-	/**
-	 * @expectedException PHPUnit_Framework_Error_Warning
-	 */
-	public function testBackticksIllegal()
-	{
-		$expected = "22.00";
-		$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="`ls` x * y" x=$x y=$y}');
-		$this->assertEquals($expected, $this->smarty->fetch($tpl));
-	}
-
-	/**
-	 * @expectedException PHPUnit_Framework_Error_Warning
-	 */
-	public function testDollarSignsIllegal()
-	{
-		$expected = "22.00";
-		$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="$" x=$x y=$y}');
-		$this->assertEquals($expected, $this->smarty->fetch($tpl));
-	}
-
-	/**
-	 * @expectedException PHPUnit_Framework_Error_Warning
-	 */
-	public function testBracketsIllegal()
-	{
-		$expected = "I";
-		$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{$y = "1"}{math equation="((y/x).(x))[x]" x=$x y=$y}');
-		$this->assertEquals($expected, $this->smarty->fetch($tpl));
-	}
-
-	public function testRand()
-	{
-		$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{math equation="x * rand()" x=$x}');
-		// this assertion may seem silly, but it serves to prove that using rand() without a parameter
-		// will not trigger a security error (see https://github.com/smarty-php/smarty/issues/794)
-		$this->assertEquals("0", $this->smarty->fetch($tpl));
-	}
-
 }

tests/UnitTests/TemplateSource/_Issues/549/MbSplitEncodingIssue549Test.php

@@ -1,77 +0,0 @@
-<?php
-/**
- * Smarty PHPunit tests - issue #549 regression tests
- *
- * @package PHPunit
- * @author  Andrey Repin <anrdaemon@yandex.ru>
- */
-
-/**
- * class for compiler tests
- *
- * @runTestsInSeparateProcess
- * @preserveGlobalState    disabled
- * @backupStaticAttributes enabled
- *
- * mb_split breaks if Smarty encoding is not the same as mbstring regex encoding.
- */
-class MbSplitEncodingIssue549Test extends PHPUnit_Smarty
-{
-    /** @var string Saved Smarty charset */
-    private $charset;
-
-    /** @var array Source data for tests, hexed to protect from accidental reencoding */
-    private $data = array(
-        "subject" => '4772c3bc6e6577616c64', // "Grünewald"
-        "pattern" => '77616c64', // "wald"
-        "replacement" => '7374c3bc726d', // "stürm"
-        "result" => '4772c3bc6e657374c3bc726d', // "Grünestürm"
-    );
-
-    public function setUp()
-    {
-        if(!\Smarty::$_MBSTRING)
-        {
-            return $this->markTestSkipped("mbstring extension is not in use by Smarty");
-        }
-
-        $this->charset = \Smarty::$_CHARSET;
-        $this->setUpSmarty(dirname(__FILE__));
-    }
-
-    public function tearDown()
-    {
-        \Smarty::$_CHARSET = $this->charset ?: \Smarty::$_CHARSET;
-        $this->cleanDirs();
-    }
-
-    /** Provider for testReplaceModifier
-     */
-    public function encodingPairsProvider()
-    {
-        return array(
-            "with non-UNICODE src/non-UNICODE regex (PHP < 5.6 default)" => array("Windows-1252", "EUC-JP"),
-            "with UTF-8 src/non-UNICODE regex (PHP < 5.6 default)" => array("UTF-8", "EUC-JP"),
-            "with UTF-8 src/UTF-8 regex (PHP >= 5.6)" => array("UTF-8", "UTF-8"),
-            "with non-UNICODE src/UTF-8 regex" => array("Windows-1252", "UTF-8"),
-        );
-    }
-
-    /** Test behavior of `replace` modifier with different source and regex encodings
-     *
-     * @dataProvider encodingPairsProvider
-     */
-    public function testReplaceModifier($mb_int_encoding, $mb_regex_encoding)
-    {
-        $data = $this->data;
-        \array_walk($data, function(&$value, $key) use($mb_int_encoding) {
-            $value = \mb_convert_encoding(pack("H*", $value), $mb_int_encoding, "UTF-8");
-        });
-        \extract($data, \EXTR_SKIP);
-
-        \mb_regex_encoding($mb_regex_encoding);
-        \Smarty::$_CHARSET = $mb_int_encoding;
-        $this->assertEquals($result, $this->smarty->fetch("string:{\"$subject\"|replace:\"$pattern\":\"$replacement\"}"));
-    }
-
-}

tests/UnitTests/TemplateSource/_Issues/549/cache/.gitignore

@@ -1,2 +0,0 @@
-# Ignore anything in here, but keep this directory
-*

tests/UnitTests/TemplateSource/_Issues/549/templates_c/.gitignore

@@ -1,2 +0,0 @@
-# Ignore anything in here, but keep this directory
-*