whitespace

Fixes #813

.gitattributes

@@ -7,11 +7,10 @@
 
 # exclude from git export
 /tests export-ignore
-/demo export-ignore
-/docs export-ignore
 /utilities export-ignore
 /docker-compose.yml export-ignore
 /.github export-ignore
+/run_tests_for_all_php_versions.sh export-ignore
 /.gitattributes export-ignore
 /.gitignore export-ignore
 /make-release.sh export-ignore

.github/workflows/ci.yml

@@ -1,8 +1,10 @@
 # https://help.github.com/en/categories/automating-your-workflow-with-github-actions
 
 on:
-  - pull_request
-  - push
+  pull_request:
+  push:
+    branches:
+      - 'master'
 
 name: CI
 
@@ -69,9 +71,5 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-php-${{ matrix.php-version }}-
 
-    - name: Install dependencies
-      if: steps.composer-cache.outputs.cache-hit != 'true'
-      run: composer install --prefer-dist --no-progress --no-suggest
-
     - name: Run tests with phpunit
-      run: ./phpunit.sh
+      run: ./run-tests.sh

CHANGELOG.md

@@ -6,9 +6,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Include docs and demo in the releases [#799](https://github.com/smarty-php/smarty/issues/799)
+- Using PHP functions as modifiers now triggers a deprecation notice because we will drop support for this in the next major release [#813](https://github.com/smarty-php/smarty/issues/813) 
+
 ### Fixed
-- Fixed PHP8.1 deprecation errors in modifiers (upper, explode, number_format and replace) [#755](https://github.com/smarty-php/smarty/pull/755) and [#788](https://github.com/smarty-php/smarty/pull/788)
+- Output buffer is now cleaned for internal PHP errors as well, not just for Exceptions [#514](https://github.com/smarty-php/smarty/issues/514)
+- Fixed recursion and out of memory errors when caching in complicated template set-ups using inheritance and includes [#801](https://github.com/smarty-php/smarty/pull/801)
+- Fixed PHP8.1 deprecation errors in strip_tags 
+- Fix Variable Usage in Exception message when unable to load subtemplate [#808](https://github.com/smarty-php/smarty/pull/808)
+- Fixed PHP8.1 deprecation notices for strftime [#672](https://github.com/smarty-php/smarty/issues/672)
+- Fixed PHP8.1 deprecation errors passing null to parameter in trim [#807](https://github.com/smarty-php/smarty/pull/807)
+
+## [4.2.1] - 2022-09-14
+
+### Security
+- Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks [#454](https://github.com/smarty-php/smarty/issues/454)
+
+### Fixed
+- Fixed PHP8.1 deprecation notices in modifiers (upper, explode, number_format and replace) [#755](https://github.com/smarty-php/smarty/pull/755) and [#788](https://github.com/smarty-php/smarty/pull/788)
+- Fixed PHP8.1 deprecation notices in capitalize modifier [#789](https://github.com/smarty-php/smarty/issues/789)
 - Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794)
+- Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-php/smarty/issues/395)
 
 ## [4.2.0] - 2022-08-01
 

docker-compose.yml

@@ -3,10 +3,11 @@ services:
   base:
     build:
       context: .
+      dockerfile: ./utilities/testrunners/php71/Dockerfile
     volumes:
       - .:/app
     working_dir: /app
-    entrypoint: sh ./utilities/testrunners/run-test.sh
+    entrypoint: sh ./run-tests.sh
   php71:
     extends:
       service: base

libs/Smarty.class.php

@@ -98,7 +98,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.2.0';
+    const SMARTY_VERSION = '4.2.1';
     /**
      * define variable scopes
      */

libs/plugins/function.html_select_date.php

@@ -101,6 +101,7 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
     $field_separator = "\n";
     $option_separator = "\n";
     $time = null;
+
     // $all_empty = null;
     // $day_empty = null;
     // $month_empty = null;
@@ -113,17 +114,7 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
     foreach ($params as $_key => $_value) {
         switch ($_key) {
             case 'time':
-                if (!is_array($_value) && $_value !== null) {
-                    $template->_checkPlugins(
-                        array(
-                            array(
-                                'function' => 'smarty_make_timestamp',
-                                'file'     => SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'
-                            )
-                        )
-                    );
-                    $time = smarty_make_timestamp($_value);
-                }
+                $$_key = $_value; // we'll handle conversion below
                 break;
             case 'month_names':
                 if (is_array($_value) && count($_value) === 12) {
@@ -178,43 +169,59 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
     }
     // Note: date() is faster than strftime()
     // Note: explode(date()) is faster than date() date() date()
-    if (isset($params[ 'time' ]) && is_array($params[ 'time' ])) {
-        if (isset($params[ 'time' ][ $prefix . 'Year' ])) {
+
+    if (isset($time) && is_array($time)) {
+        if (isset($time[$prefix . 'Year'])) {
             // $_REQUEST[$field_array] given
-            foreach (array(
-                'Y' => 'Year',
-                'm' => 'Month',
-                'd' => 'Day'
-            ) as $_elementKey => $_elementName) {
+            foreach ([
+                         'Y' => 'Year',
+                         'm' => 'Month',
+                         'd' => 'Day'
+                     ] as $_elementKey => $_elementName) {
                 $_variableName = '_' . strtolower($_elementName);
                 $$_variableName =
-                    isset($params[ 'time' ][ $prefix . $_elementName ]) ? $params[ 'time' ][ $prefix . $_elementName ] :
+                    isset($time[$prefix . $_elementName]) ? $time[$prefix . $_elementName] :
                         date($_elementKey);
             }
-        } elseif (isset($params[ 'time' ][ $field_array ][ $prefix . 'Year' ])) {
+        } elseif (isset($time[$field_array][$prefix . 'Year'])) {
             // $_REQUEST given
-            foreach (array(
-                'Y' => 'Year',
-                'm' => 'Month',
-                'd' => 'Day'
-            ) as $_elementKey => $_elementName) {
+            foreach ([
+                         'Y' => 'Year',
+                         'm' => 'Month',
+                         'd' => 'Day'
+                     ] as $_elementKey => $_elementName) {
                 $_variableName = '_' . strtolower($_elementName);
-                $$_variableName = isset($params[ 'time' ][ $field_array ][ $prefix . $_elementName ]) ?
-                    $params[ 'time' ][ $field_array ][ $prefix . $_elementName ] : date($_elementKey);
+                $$_variableName = isset($time[$field_array][$prefix . $_elementName]) ?
+                    $time[$field_array][$prefix . $_elementName] : date($_elementKey);
             }
         } else {
             // no date found, use NOW
-            list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d'));
+            [$_year, $_month, $_day] = explode('-', date('Y-m-d'));
         }
+    } elseif (isset($time) && preg_match("/(\d*)-(\d*)-(\d*)/", $time, $matches)) {
+        $_year = $_month = $_day = null;
+        if ($matches[1] > '') $_year = (int) $matches[1];
+        if ($matches[2] > '') $_month = (int) $matches[2];
+        if ($matches[3] > '') $_day = (int) $matches[3];
     } elseif ($time === null) {
         if (array_key_exists('time', $params)) {
-            $_year = $_month = $_day = $time = null;
+            $_year = $_month = $_day = null;
         } else {
-            list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d'));
+            [$_year, $_month, $_day] = explode('-', date('Y-m-d'));
         }
     } else {
-        list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d', $time));
+        $template->_checkPlugins(
+            array(
+                array(
+                    'function' => 'smarty_make_timestamp',
+                    'file'     => SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'
+                )
+            )
+        );
+        $time = smarty_make_timestamp($time);
+        [$_year, $_month, $_day] = explode('-', date('Y-m-d', $time));
     }
+
     // make syntax "+N" or "-N" work with $start_year and $end_year
     // Note preg_match('!^(\+|\-)\s*(\d+)$!', $end_year, $match) is slower than trim+substr
     foreach (array(
@@ -309,8 +316,8 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
         for ($i = 1; $i <= 12; $i++) {
             $_val = sprintf('%02d', $i);
             $_text = isset($month_names) ? smarty_function_escape_special_chars($month_names[ $i ]) :
-                ($month_format === '%m' ? $_val : strftime($month_format, $_month_timestamps[ $i ]));
-            $_value = $month_value_format === '%m' ? $_val : strftime($month_value_format, $_month_timestamps[ $i ]);
+                ($month_format === '%m' ? $_val : @strftime($month_format, $_month_timestamps[ $i ]));
+            $_value = $month_value_format === '%m' ? $_val : @strftime($month_value_format, $_month_timestamps[ $i ]);
             $_html_months .= '<option value="' . $_value . '"' . ($_val == $_month ? ' selected="selected"' : '') .
                              '>' . $_text . '</option>' . $option_separator;
         }

libs/plugins/function.mailto.php

@@ -48,8 +48,13 @@
  */
 function smarty_function_mailto($params)
 {
-    static $_allowed_encoding =
-        array('javascript' => true, 'javascript_charcode' => true, 'hex' => true, 'none' => true);
+    static $_allowed_encoding = [
+        'javascript' => true,
+        'javascript_charcode' => true,
+        'hex' => true,
+        'none' => true
+    ];
+
     $extra = '';
     if (empty($params[ 'address' ])) {
         trigger_error("mailto: missing 'address' parameter", E_USER_WARNING);
@@ -57,19 +62,19 @@ function smarty_function_mailto($params)
     } else {
         $address = $params[ 'address' ];
     }
+
     $text = $address;
+
     // netscape and mozilla do not decode %40 (@) in BCC field (bug?)
     // so, don't encode it.
-    $search = array('%40', '%2C');
-    $replace = array('@', ',');
-    $mail_parms = array();
+    $mail_parms = [];
     foreach ($params as $var => $value) {
         switch ($var) {
             case 'cc':
             case 'bcc':
             case 'followupto':
                 if (!empty($value)) {
-                    $mail_parms[] = $var . '=' . str_replace($search, $replace, rawurlencode($value));
+                    $mail_parms[] = $var . '=' . str_replace(['%40', '%2C'], ['@', ','], rawurlencode($value));
                 }
                 break;
             case 'subject':
@@ -83,6 +88,7 @@ function smarty_function_mailto($params)
             default:
         }
     }
+
     if ($mail_parms) {
         $address .= '?' . join('&', $mail_parms);
     }
@@ -94,19 +100,21 @@ function smarty_function_mailto($params)
         );
         return;
     }
+
+    $string = '<a href="mailto:' . htmlspecialchars($address, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, Smarty::$_CHARSET) .
+        '" ' . $extra . '>' . htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, Smarty::$_CHARSET) . '</a>';
+
     if ($encode === 'javascript') {
-	    $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
         $js_encode = '';
         for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
             $js_encode .= '%' . bin2hex($string[ $x ]);
         }
         return '<script type="text/javascript">document.write(unescape(\'' . $js_encode . '\'))</script>';
     } elseif ($encode === 'javascript_charcode') {
-        $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
         for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
             $ord[] = ord($string[ $x ]);
         }
-	    return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
+        return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
     } elseif ($encode === 'hex') {
         preg_match('!^(.*)(\?.*)$!', $address, $match);
         if (!empty($match[ 2 ])) {
@@ -129,6 +137,6 @@ function smarty_function_mailto($params)
         return '<a href="' . $mailto . $address_encode . '" ' . $extra . '>' . $text_encode . '</a>';
     } else {
         // no encoding
-        return '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
+        return $string;
     }
 }

libs/plugins/modifier.capitalize.php

@@ -22,6 +22,8 @@
  */
 function smarty_modifier_capitalize($string, $uc_digits = false, $lc_rest = false)
 {
+    $string = (string) $string;
+
     if (Smarty::$_MBSTRING) {
         if ($lc_rest) {
             // uppercase (including hyphenated words)

libs/plugins/modifier.count.php

@@ -0,0 +1,36 @@
+<?php
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifier
+ */
+/**
+ * Smarty count modifier plugin
+ * Type:     modifier
+ * Name:     count
+ * Purpose:  counts all elements in an array or in a Countable object
+ * Input:
+ *          - Countable|array: array or object to count
+ *          - mode: int defaults to 0 for normal count mode, if set to 1 counts recursive
+  *
+ * @param mixed $arrayOrObject  input array/object
+ * @param int $mode       count mode
+ *
+ * @return int
+ */
+function smarty_modifier_count($arrayOrObject, $mode = 0)
+{
+    /*
+     * @see https://www.php.net/count
+     * > Prior to PHP 8.0.0, if the parameter was neither an array nor an object that implements the Countable interface,
+     * > 1 would be returned, unless value was null, in which case 0 would be returned.
+     */
+
+    if ($arrayOrObject instanceof Countable || is_array($arrayOrObject)) {
+        return count($arrayOrObject, (int) $mode);
+    } elseif ($arrayOrObject === null) {
+        return 0;
+    }
+    return 1;
+}

libs/plugins/modifier.date_format.php

@@ -78,7 +78,8 @@ function smarty_modifier_date_format($string, $format = null, $default_date = ''
             }
             $format = str_replace($_win_from, $_win_to, $format);
         }
-        return strftime($format, $timestamp);
+        // @ to suppress deprecation errors when running in PHP8.1 or higher.
+        return @strftime($format, $timestamp);
     } else {
         return date($format, $timestamp);
     }

libs/plugins/modifiercompiler.nl2br.php

@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifierCompiler
+ */
+/**
+ * Smarty nl2br modifier plugin
+ * Type:     modifier
+ * Name:     nl2br
+ * Purpose:  insert HTML line breaks before all newlines in a string
+ *
+ * @link   https://www.smarty.net/docs/en/language.modifier.nl2br.tpl nl2br (Smarty online manual)
+  *
+ * @param array $params parameters
+ *
+ * @return string with compiled code
+ */
+function smarty_modifiercompiler_nl2br($params) {
+    return 'nl2br((string) ' . $params[0] . ', (bool) ' . ($params[1] ?? true) . ')';
+}

libs/plugins/modifiercompiler.round.php

@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifierCompiler
+ */
+/**
+ * Smarty round modifier plugin
+ * Type:     modifier
+ * Name:     round
+ * Purpose:  Returns the rounded value of num to specified precision (number of digits after the decimal point)
+ *
+ * @link   https://www.smarty.net/docs/en/language.modifier.round.tpl round (Smarty online manual)
+  *
+ * @param array $params parameters
+ *
+ * @return string with compiled code
+ */
+function smarty_modifiercompiler_round($params) {
+    return 'round((float) ' . $params[0] . ', (int) ' . ($params[1] ?? 0) . ', (int) ' . ($params[2] ?? PHP_ROUND_HALF_UP) . ')';
+}

libs/plugins/modifiercompiler.str_repeat.php

@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifierCompiler
+ */
+/**
+ * Smarty str_repeat modifier plugin
+ * Type:     modifier
+ * Name:     str_repeat
+ * Purpose:  returns string repeated times times
+ *
+ * @link   https://www.smarty.net/docs/en/language.modifier.str_repeat.tpl str_repeat (Smarty online manual)
+ *
+ * @param array $params parameters
+ *
+ * @return string with compiled code
+ */
+function smarty_modifiercompiler_str_repeat($params) {
+    return 'str_repeat((string) ' . $params[0] . ', (int) ' . $params[1] . ')';
+}

libs/plugins/modifiercompiler.strip_tags.php

@@ -21,8 +21,8 @@
 function smarty_modifiercompiler_strip_tags($params)
 {
     if (!isset($params[ 1 ]) || $params[ 1 ] === true || trim($params[ 1 ], '"') === 'true') {
-        return "preg_replace('!<[^>]*?>!', ' ', {$params[0]})";
+        return "preg_replace('!<[^>]*?>!', ' ', {$params[0]} ?: '')";
     } else {
-        return 'strip_tags(' . $params[ 0 ] . ')';
+        return 'strip_tags((string) ' . $params[ 0 ] . ')';
     }
 }

libs/plugins/modifiercompiler.strlen.php

@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifierCompiler
+ */
+/**
+ * Smarty strlen modifier plugin
+ * Type:     modifier
+ * Name:     strlen
+ * Purpose:  return the length of the given string
+ *
+ * @link   https://www.smarty.net/docs/en/language.modifier.strlen.tpl strlen (Smarty online manual)
+  *
+ * @param array $params parameters
+ *
+ * @return string with compiled code
+ */
+function smarty_modifiercompiler_strlen($params) {
+    return 'strlen((string) ' . $params[0] . ')';
+}

libs/sysplugins/smarty_cacheresource_keyvaluestore.php

@@ -244,7 +244,7 @@ abstract class Smarty_CacheResource_KeyValueStore extends Smarty_CacheResource
      */
     protected function sanitize($string)
     {
-        $string = trim($string, '|');
+        $string = trim((string)$string, '|');
         if (!$string) {
             return '';
         }
@@ -428,7 +428,7 @@ abstract class Smarty_CacheResource_KeyValueStore extends Smarty_CacheResource
             $t[] = 'IVK#COMPILE' . $_compile;
         }
         $_name .= '#';
-        $cid = trim($cache_id, '|');
+        $cid = trim((string)$cache_id, '|');
         if (!$cid) {
             return $t;
         }

libs/sysplugins/smarty_internal_compile_private_modifier.php

@@ -109,6 +109,9 @@ class Smarty_Internal_Compile_Private_Modifier extends Smarty_Internal_CompileBa
                             if (!is_object($compiler->smarty->security_policy)
                                 || $compiler->smarty->security_policy->isTrustedPhpModifier($modifier, $compiler)
                             ) {
+                                trigger_error('Using php-function "' . $modifier . '" as a modifier is deprecated and will be ' .
+                                    'removed in a future release. Use Smarty::registerPlugin to explicitly register ' .
+                                    'a custom modifier.', E_USER_DEPRECATED);
                                 $output = "{$modifier}({$params})";
                             }
                             $compiler->known_modifier_type[ $modifier ] = $type;

libs/sysplugins/smarty_internal_method_mustcompile.php

@@ -32,7 +32,7 @@ class Smarty_Internal_Method_MustCompile
     {
         if (!$_template->source->exists) {
             if ($_template->_isSubTpl()) {
-                $parent_resource = " in '$_template->parent->template_resource}'";
+                $parent_resource = " in '{$_template->parent->template_resource}'";
             } else {
                 $parent_resource = '';
             }

libs/sysplugins/smarty_internal_template.php

@@ -292,7 +292,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
         $smarty = &$this->smarty;
         $_templateId = $smarty->_getTemplateId($template, $cache_id, $compile_id, $caching, $tpl);
         // recursive call ?
-        if (isset($tpl->templateId) ? $tpl->templateId : $tpl->_getTemplateId() !== $_templateId) {
+        if ((isset($tpl->templateId) ? $tpl->templateId : $tpl->_getTemplateId()) !== $_templateId) {
             // already in template cache?
             if (isset(self::$tplObjCache[ $_templateId ])) {
                 // copy data from cached object
@@ -358,7 +358,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
         }
         if ($tpl->caching === 9999) {
             if (!isset($tpl->compiled)) {
-                $this->loadCompiled(true);
+                $tpl->loadCompiled(true);
             }
             if ($tpl->compiled->has_nocache_code) {
                 $this->cached->hashes[ $tpl->compiled->nocache_hash ] = true;

libs/sysplugins/smarty_internal_templatebase.php

@@ -257,7 +257,7 @@ abstract class Smarty_Internal_TemplateBase extends Smarty_Internal_Data
                 error_reporting($_smarty_old_error_level);
             }
             return $result;
-        } catch (Exception $e) {
+        } catch (Throwable $e) {
             while (ob_get_level() > $level) {
                 ob_end_clean();
             }

libs/sysplugins/smarty_security.php

@@ -105,7 +105,7 @@ class Smarty_Security
      *
      * @var array
      */
-    public $php_modifiers = array('escape', 'count', 'nl2br',);
+    public $php_modifiers = array('escape', 'count', 'sizeof', 'nl2br',);
 
     /**
      * This is an array of allowed tags.
@@ -328,7 +328,7 @@ class Smarty_Security
      *
      * @param string $modifier_name
      * @param object $compiler compiler object
-     *
+     * @deprecated
      * @return boolean                 true if modifier is trusted
      */
     public function isTrustedPhpModifier($modifier_name, $compiler)

phpunit.sh

@@ -1,2 +0,0 @@
-#! /bin/bash
-vendor/phpunit/phpunit/phpunit

run-tests-for-all-php-versions.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+Help()
+{
+   # Display Help
+   echo "Runs PHPUnit tests for all PHP versions supported by this version of Smarty."
+   echo
+   echo "Syntax: $0 [-e|h]"
+   echo "options:"
+   echo "e     Exclude a group of unit tests, e.g. -e 'slow'"
+   echo "h     Print this Help."
+   echo
+}
+
+Exclude=""
+
+# Get the options
+while getopts ":he:" option; do
+   case $option in
+      e) # Exclude
+        echo $OPTARG
+         Exclude=$OPTARG;;
+      h) # display Help
+         Help
+         exit;;
+     \?) # Invalid option
+         echo "Error: Invalid option"
+         exit;;
+   esac
+done
+
+if [ -z $Exclude ];
+then
+  Entrypoint="./run-tests.sh"
+else
+   Entrypoint="./run-tests.sh $Exclude"
+fi
+
+# Runs tests for all supported PHP versions
+docker-compose run --entrypoint "$Entrypoint" php71 && \
+docker-compose run --entrypoint "$Entrypoint" php72 && \
+docker-compose run --entrypoint "$Entrypoint" php73 && \
+docker-compose run --entrypoint "$Entrypoint" php74 && \
+docker-compose run --entrypoint "$Entrypoint" php80 && \
+docker-compose run --entrypoint "$Entrypoint" php81

run-tests.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+composer update
+
+php -r 'echo "\nPHP version " . phpversion() . ". ";';
+
+if [ -z $1 ];
+then
+  echo "Running all unit tests.\n"
+  php ./vendor/phpunit/phpunit/phpunit
+else
+  echo "Running all unit tests, except tests marked with @group $1.\n"
+  php ./vendor/phpunit/phpunit/phpunit --exclude-group $1
+fi

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -52,7 +52,7 @@ class SecurityTest extends PHPUnit_Smarty
  */
     public function testTrustedPHPFunction()
     {
-        $this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{count($foo)}'));
+        $this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{sizeof($foo)}'));
     }
 
 /**
@@ -63,9 +63,9 @@ class SecurityTest extends PHPUnit_Smarty
     public function testNotTrustedPHPFunction()
     {
         $this->expectException('SmartyException');
-        $this->expectExceptionMessage('PHP function \'count\' not allowed by security setting');
+        $this->expectExceptionMessage('PHP function \'sizeof\' not allowed by security setting');
         $this->smarty->security_policy->php_functions = array('null');
-        $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{count($foo)}');
+        $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{sizeof($foo)}');
     }
 
 /**
@@ -75,38 +75,41 @@ class SecurityTest extends PHPUnit_Smarty
     {
         $this->smarty->security_policy->php_functions = array('null');
         $this->smarty->disableSecurity();
-        $this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{count($foo)}'));
+        $this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{sizeof($foo)}'));
     }
 
 /**
  * test trusted modifier
+ * @deprecated
  */
     public function testTrustedModifier()
     {
-        $this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{$foo|@count}'));
+        $this->assertEquals("5", @$this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{$foo|@sizeof}'));
     }
 
 /**
  * test not trusted modifier
   * @runInSeparateProcess
   * @preserveGlobalState disabled
+ *  @deprecated
  */
     public function testNotTrustedModifier()
     {
         $this->expectException('SmartyException');
-        $this->expectExceptionMessage('modifier \'count\' not allowed by security setting');
+        $this->expectExceptionMessage('modifier \'sizeof\' not allowed by security setting');
         $this->smarty->security_policy->php_modifiers = array('null');
-        $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{$foo|@count}');
+        @$this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{$foo|@sizeof}');
     }
 
 /**
  * test not trusted modifier at disabled security
+ * @deprecated
  */
     public function testDisabledTrustedModifier()
     {
         $this->smarty->security_policy->php_modifiers = array('null');
         $this->smarty->disableSecurity();
-        $this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{$foo|@count}'));
+        @$this->assertEquals("5", $this->smarty->fetch('string:{assign var=foo value=[1,2,3,4,5]}{$foo|@sizeof}'));
     }
 
 /**

tests/UnitTests/SmartyMethodsTests/RegisterBlock/RegisterBlockTest.php

@@ -40,14 +40,14 @@ class RegisterBlockTest extends PHPUnit_Smarty
     {
         $this->smarty->registerPlugin(Smarty::PLUGIN_BLOCK, 'testblock', 'myblock');
         $this->smarty->assign('value', 1);
-        $this->assertEquals(strtoupper('function hello world 1 1 function hello world 1 2 function hello world 1 3 '), $this->smarty->fetch('eval:{testblock}hello world {$value}{/testblock|strtoupper}'));
+        $this->assertEquals(strtoupper('function hello world 1 1 function hello world 1 2 function hello world 1 3 '), $this->smarty->fetch('eval:{testblock}hello world {$value}{/testblock|upper}'));
     }
 
     public function testRegisterBlockFunctionModifier2()
     {
         $this->smarty->registerPlugin(Smarty::PLUGIN_BLOCK, 'testblock', 'myblock');
         $this->smarty->assign('value', 1);
-        $this->assertEquals(strtoupper('function hello world 1 1 function hello world 1 2 function hello world 1 3 '), $this->smarty->fetch('eval:{testblock}hello world {$value}{/testblock|default:""|strtoupper}'));
+        $this->assertEquals(strtoupper('function hello world 1 1 function hello world 1 2 function hello world 1 3 '), $this->smarty->fetch('eval:{testblock}hello world {$value}{/testblock|default:""|upper}'));
     }
 
     public function testRegisterBlockFunctionWrapper()

tests/UnitTests/SmartyMethodsTests/RegisterObject/CompileRegisteredObjectFunctionTest.php

@@ -60,13 +60,13 @@ class CompileRegisteredObjectFunctionTest extends PHPUnit_Smarty
 
     public function testRegisteredObjectBlockFunctionModifier1()
     {
-        $tpl = $this->smarty->createTemplate('eval:{objecttest->myblock}hello world{/objecttest->myblock|strtoupper}');
+        $tpl = $this->smarty->createTemplate('eval:{objecttest->myblock}hello world{/objecttest->myblock|upper}');
         $this->assertEquals(strtoupper('block test'), $this->smarty->fetch($tpl));
     }
 
     public function testRegisteredObjectBlockFunctionModifier2()
     {
-        $tpl = $this->smarty->createTemplate('eval:{objecttest->myblock}hello world{/objecttest->myblock|default:""|strtoupper}');
+        $tpl = $this->smarty->createTemplate('eval:{objecttest->myblock}hello world{/objecttest->myblock|default:""|upper}');
         $this->assertEquals(strtoupper('block test'), $this->smarty->fetch($tpl));
     }
     // TODO

tests/UnitTests/TemplateSource/TagTests/Append/CompileAppendTest.php

@@ -21,6 +21,7 @@ class CompileAppendTest extends PHPUnit_Smarty
         $this->smarty->addPluginsDir("../../../__shared/PHPunitplugins/");
         $this->smarty->addTemplateDir("../../../__shared/templates/");
         $this->smarty->addTemplateDir("./templates_tmp");
+        $this->smarty->registerPlugin('modifier', 'var_export', 'var_export');
     }
 
     public function testInit()

tests/UnitTests/TemplateSource/TagTests/Assign/CompileAssignTest.php

@@ -21,6 +21,7 @@ class CompileAssignTest extends PHPUnit_Smarty
         $this->smarty->addPluginsDir("../../../__shared/PHPunitplugins/");
         $this->smarty->addTemplateDir("../../../__shared/templates/");
         $this->smarty->addTemplateDir("./templates_tmp");
+        $this->smarty->registerPlugin('modifier', 'var_export', 'var_export');
     }
 
     public function testInit()

tests/UnitTests/TemplateSource/TagTests/If/CompileIfTest.php

@@ -21,6 +21,7 @@ class CompileIfTest extends PHPUnit_Smarty
         $this->smarty->addPluginsDir("../../../__shared/PHPunitplugins/");
         $this->smarty->addTemplateDir("../../../__shared/templates/");
         $this->smarty->addTemplateDir("./templates_tmp");
+        $this->smarty->registerPlugin('modifier', 'var_export', 'var_export');
     }
 
     public function testInit()

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionHtmlSelectDateTest.php

@@ -210,7 +210,7 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
     public function setUp(): void
     {
         $this->setUpSmarty(dirname(__FILE__));
-	    $this->smarty->setErrorReporting(E_ALL & ~E_DEPRECATED);
+        $this->smarty->setErrorReporting(E_ALL & ~E_DEPRECATED);
 
         $year = date('Y');
         $this->now = mktime(15, 0, 0, 2, 20, $year);
@@ -239,6 +239,7 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
 
         $this->years['default'] = "<option value=\"{$year}\" selected=\"selected\">{$year}</option>";
         $this->years['none'] = "<option value=\"{$year}\">{$year}</option>";
+
     }
 
     protected function reverse($string)
@@ -395,6 +396,33 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
         $this->assertEquals($result, $tpl->fetch());
     }
 
+    public function testEmptyDayWithDateString() {
+        $n = "\n";
+        $result = '<select name="Date_Month">' . $n . $this->months['default'] . $n . '</select>'
+            . $n . '<select name="Date_Day">' . $n . '<option value="">day</option>' . $n . $this->days['none'] . $n . '</select>'
+            . $n . '<select name="Date_Year">' . $n . $this->years['start_2005'] . $n . '</select>';
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time="2022-02-" day_empty="day" start_year=2005}');
+        $this->assertEquals($result, $tpl->fetch());
+    }
+
+    public function testEmptyMonthWithDateStrings() {
+        $n = "\n";
+        $result = '<select name="Date_Month">' . $n . '<option value="">month</option>' . $n . $this->months['none'] . $n . '</select>'
+            . $n . '<select name="Date_Day">' . $n . $this->days['default'] . $n . '</select>'
+            . $n . '<select name="Date_Year">' . $n . $this->years['start_2005'] . $n . '</select>';
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time="2022--20" month_empty="month" start_year=2005}');
+        $this->assertEquals($result, $tpl->fetch());
+    }
+
+    public function testEmptyYearWithDateStrings() {
+        $n = "\n";
+        $result = '<select name="Date_Month">' . $n . $this->months['default'] . $n . '</select>'
+            . $n . '<select name="Date_Day">' . $n . $this->days['default'] . $n . '</select>'
+            . $n . '<select name="Date_Year">' . $n . '<option value="">year</option>' . $n . $this->years['none'] . $n . '</select>';
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time="-02-20" year_empty="year"}');
+        $this->assertEquals($result, $tpl->fetch());
+    }
+
     public function testId()
     {
         $n = "\n";

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php

@@ -150,7 +150,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
 
     public function testUmlauts()
     {
-        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
+        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&amp;subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me+smtpext@example.com" cc="you@example.com,they@example.com" subject="hällo wörld"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
     }
@@ -158,9 +158,26 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
     public function testUmlautsWithoutMbstring()
     {
         Smarty::$_MBSTRING = false;
-        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
+        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&amp;subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me+smtpext@example.com" cc="you@example.com,they@example.com" subject="hällo wörld"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;
     }
+
+	public function testJavascriptChars()
+	{
+		$result = '<script type="text/javascript">document.write(unescape(\'%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%71%75%6f%74%3b%26%67%74%3b%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%23%30%33%39%3b%29%3b%20%61%6c%65%72%74%28%26%71%75%6f%74%3b%69%6e%6a%65%63%74%69%6f%6e%26%71%75%6f%74%3b%29%3b%20%2f%2f%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%71%75%6f%74%3b%26%67%74%3b%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%23%30%33%39%3b%29%3b%20%61%6c%65%72%74%28%26%71%75%6f%74%3b%69%6e%6a%65%63%74%69%6f%6e%26%71%75%6f%74%3b%29%3b%20%2f%2f%3c%2f%61%3e\'))</script>';
+		$this->smarty->assign('address', 'me@example.com">me@example.com\'); alert("injection"); //');
+		$tpl = $this->smarty->createTemplate('eval:{mailto address=$address encode=javascript}');
+		$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
+	}
+
+	public function testHtmlChars()
+	{
+		$result = '<a href="mailto:me@example.com&quot;&gt;&lt;h1&gt;" class="email">me@example.com&quot;&gt;&lt;h1&gt;</a>';
+		$this->smarty->assign('address', 'me@example.com"><h1>');
+		$tpl = $this->smarty->createTemplate('eval:{mailto address=$address extra=\'class="email"\'}');
+		$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
+	}
+
 }

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierCountTest.php

@@ -0,0 +1,48 @@
+<?php
+/**
+ * Smarty PHPunit tests of modifier
+ */
+
+/**
+ * class for modifier tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState    disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginModifierCountTest extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(dirname(__FILE__));
+    }
+
+    public function testArray()
+    {
+        $tpl = $this->smarty->createTemplate('string:count:{$v|count}');
+        $tpl->assign("v", array(1, 2, 3));
+        $this->assertEquals("count:3", $this->smarty->fetch($tpl));
+    }
+
+    public function testEmptyArray()
+    {
+        $tpl = $this->smarty->createTemplate('string:count:{$v|count}');
+        $tpl->assign("v", array());
+        $this->assertEquals("count:0", $this->smarty->fetch($tpl));
+    }
+
+    public function testNull()
+    {
+        $tpl = $this->smarty->createTemplate('string:count:{$v|count}');
+        $tpl->assign("v", null);
+        $this->assertEquals("count:0", $this->smarty->fetch($tpl));
+    }
+
+    public function testString()
+    {
+        $tpl = $this->smarty->createTemplate('string:count:{$v|count}');
+        $tpl->assign("v", "string");
+        $this->assertEquals("count:1", $this->smarty->fetch($tpl));
+    }
+
+}

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierExplodeTest.php

@@ -14,6 +14,7 @@ class PluginModifierExplodeTest extends \PHPUnit_Smarty
     public function setUp(): void
     {
         $this->setUpSmarty(__DIR__);
+        $this->smarty->registerPlugin('modifier', 'json_encode', 'json_encode');
     }
 
     /**

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierNl2brTest.php

@@ -0,0 +1,33 @@
+<?php
+/**
+ * Smarty PHPunit tests of modifier
+ */
+
+/**
+ * class for modifier tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState    disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginModifierNl2brTest extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(dirname(__FILE__));
+    }
+
+    public function testDefault()
+    {
+        $tpl = $this->smarty->createTemplate('string:{$v|nl2br}');
+        $tpl->assign("v", "Line1\nLine2");
+        $this->assertEquals("Line1<br />\nLine2", $this->smarty->fetch($tpl));
+    }
+
+    public function testNoXHTML()
+    {
+        $tpl = $this->smarty->createTemplate('string:{$v|nl2br:false}');
+        $tpl->assign("v", "Line1\nLine2");
+        $this->assertEquals("Line1<br>\nLine2", $this->smarty->fetch($tpl));
+    }
+}

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierStrRepeatTest.php

@@ -0,0 +1,33 @@
+<?php
+/**
+ * Smarty PHPunit tests of modifier
+ */
+
+/**
+ * class for modifier tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState    disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginModifierStrRepeatTest extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(dirname(__FILE__));
+    }
+
+    public function testDefault()
+    {
+        $tpl = $this->smarty->createTemplate('string:{$v|str_repeat:2}');
+        $tpl->assign("v", "foo");
+        $this->assertEquals("foofoo", $this->smarty->fetch($tpl));
+    }
+
+    public function testZeroTimes()
+    {
+        $tpl = $this->smarty->createTemplate('string:{$v|str_repeat:0}');
+        $tpl->assign("v", "foo");
+        $this->assertEquals("", $this->smarty->fetch($tpl));
+    }
+}

tests/UnitTests/TemplateSource/ValueTests/Math/MathTest.php

@@ -18,6 +18,7 @@ class MathTest extends PHPUnit_Smarty
     public function setUp(): void
     {
         $this->setUpSmarty(dirname(__FILE__));
+        $this->smarty->registerPlugin('modifier', 'sin', 'sin');
     }
 
     public function testInit()
@@ -104,7 +105,7 @@ class MathTest extends PHPUnit_Smarty
     {
         $this->smarty->disableSecurity();
         $expected = "22.00 -- 4.10";
-        $tpl = $this->smarty->createTemplate('eval:{$x = 4}{$y = 5.5}{$z = $x * $y}{"%0.2f"|sprintf:$z} -- {$x = 20.5}{$y = 5}{$z = $x / $y}{"%0.2f"|sprintf:$z}');
+        $tpl = $this->smarty->createTemplate('eval:{$x = 4}{$y = 5.5}{$z = $x * $y}{$z|string_format:"%0.2f"} -- {$x = 20.5}{$y = 5}{$z = $x / $y}{$z|string_format:"%0.2f"}');
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
 
@@ -120,7 +121,7 @@ class MathTest extends PHPUnit_Smarty
     {
         $this->smarty->disableSecurity();
         $expected = "22.00 -- 4.10";
-        $tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{$z = $x * $y}{"%0.2f"|sprintf:$z} -- {$x = "20.5"}{$y = "5"}{$z = $x / $y}{"%0.2f"|sprintf:$z}');
+        $tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{$z = $x * $y}{$z|string_format:"%0.2f"} -- {$x = "20.5"}{$y = "5"}{$z = $x / $y}{$z|string_format:"%0.2f"}');
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
 
@@ -132,36 +133,36 @@ class MathTest extends PHPUnit_Smarty
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
 
-	public function testBackticksIllegal()
-	{
-		$this->expectException(PHPUnit\Framework\Error\Warning::class);
-		$expected = "22.00";
-		$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="`ls` x * y" x=$x y=$y}');
-		$this->assertEquals($expected, $this->smarty->fetch($tpl));
-	}
+    public function testBackticksIllegal()
+    {
+        $this->expectException(PHPUnit\Framework\Error\Warning::class);
+        $expected = "22.00";
+        $tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="`ls` x * y" x=$x y=$y}');
+        $this->assertEquals($expected, $this->smarty->fetch($tpl));
+    }
 
-	public function testDollarSignsIllegal()
-	{
-		$this->expectException(PHPUnit\Framework\Error\Warning::class);
-		$expected = "22.00";
-		$tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="$" x=$x y=$y}');
-		$this->assertEquals($expected, $this->smarty->fetch($tpl));
-	}
+    public function testDollarSignsIllegal()
+    {
+        $this->expectException(PHPUnit\Framework\Error\Warning::class);
+        $expected = "22.00";
+        $tpl = $this->smarty->createTemplate('eval:{$x = "4"}{$y = "5.5"}{math equation="$" x=$x y=$y}');
+        $this->assertEquals($expected, $this->smarty->fetch($tpl));
+    }
 
-	public function testBracketsIllegal()
-	{
-		$this->expectException(PHPUnit\Framework\Error\Warning::class);
-		$expected = "I";
-		$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{$y = "1"}{math equation="((y/x).(x))[x]" x=$x y=$y}');
-		$this->assertEquals($expected, $this->smarty->fetch($tpl));
-	}
+    public function testBracketsIllegal()
+    {
+        $this->expectException(PHPUnit\Framework\Error\Warning::class);
+        $expected = "I";
+        $tpl = $this->smarty->createTemplate('eval:{$x = "0"}{$y = "1"}{math equation="((y/x).(x))[x]" x=$x y=$y}');
+        $this->assertEquals($expected, $this->smarty->fetch($tpl));
+    }
 
-	public function testRand()
-	{
-		$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{math equation="x * rand()" x=$x}');
-		// this assertion may seem silly, but it serves to prove that using rand() without a parameter
-		// will not trigger a security error (see https://github.com/smarty-php/smarty/issues/794)
-		$this->assertEquals("0", $this->smarty->fetch($tpl));
-	}
+    public function testRand()
+    {
+        $tpl = $this->smarty->createTemplate('eval:{$x = "0"}{math equation="x * rand()" x=$x}');
+        // this assertion may seem silly, but it serves to prove that using rand() without a parameter
+        // will not trigger a security error (see https://github.com/smarty-php/smarty/issues/794)
+        $this->assertEquals("0", $this->smarty->fetch($tpl));
+    }
 
 }

tests/UnitTests/TemplateSource/_Issues/327/ModifierIssue327Test.php

@@ -18,6 +18,7 @@ class ModifierIssue327Test extends PHPUnit_Smarty
     public function setUp(): void
     {
         $this->setUpSmarty(dirname(__FILE__));
+        $this->smarty->registerPlugin('modifier', 'substr', 'substr');
     }
 
     public function testInit()

utilities/testrunners/run-test.sh

@@ -1,2 +0,0 @@
-#!/bin/sh
-composer update && php ./vendor/phpunit/phpunit/phpunit