add note to 'other changes' in upgrade instructions

Fixes #935

CHANGELOG.md

@@ -8,9 +8,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - PHP8.3 support [#925](https://github.com/smarty-php/smarty/issues/925)
+- Backlink to GitHub in docs
+- Explain how to do escaping and set-up auto-escaping in docs [#865](https://github.com/smarty-php/smarty/issues/865)
+- Link to variable scope page in the documentation for the assign tag [#878](https://github.com/smarty-php/smarty/issues/878)
 
 ### Fixed
 - The {debug} tag was broken in v5 [#922](https://github.com/smarty-php/smarty/issues/922)
+- Documentation on `{if $x is even by $y}` syntax
 
 ## [5.0.0-rc2] - 2023-11-11
 

README.md

@@ -7,7 +7,7 @@ Smarty is a template engine for PHP, facilitating the separation of presentation
 Read the [documentation](https://smarty-php.github.io/smarty/) to find out how to use it. 
 
 ## Requirements
-Smarty v5 can be run with PHP 7.2 to PHP 8.2.
+Smarty v5 can be run with PHP 7.2 to PHP 8.3.
 
 ## Installation
 Smarty versions 3.1.11 or later can be installed with [Composer](https://getcomposer.org/).

changelog/930.md

@@ -0,0 +1 @@
+- Fix incorrect compilation of expressions when escape_html=true [#930](https://github.com/smarty-php/smarty/pull/930)

changelog/935.md

@@ -0,0 +1 @@
+- Add template path to CompilerException to enable rich debug features [#935](https://github.com/smarty-php/smarty/issues/935)

docs/api/basics.md

@@ -89,4 +89,5 @@ Run this, and you will see:
 ```
 
 Note how the [escape modifier](../designers/language-modifiers/language-modifier-escape.md) 
-translated the `&` character into the proper HTML syntax `&`.
+translated the `&` character into the proper HTML syntax `&`.
+Read more about auto-escaping in the [next section](./configuring.md).

docs/api/configuring.md

@@ -122,6 +122,24 @@ $smarty->setCacheDir('/data/caches');
 $cacheDir = $smarty->getCacheDir();
 ```
 
+## Enabling auto-escaping
+By default, Smarty does not escape anything you render in your templates. If you use
+Smarty to render a HTML-page, this means that you will have to make sure that you do
+not render any characters that have a special meaning in HTML, such as `&`, `<` and `>`,
+or apply the [escape modifier](../designers/language-modifiers/language-modifier-escape.md) 
+to anything you want to render.
+
+If you forget to do so, you may break your HTML page, or even create a vulnerability for 
+attacks known as [XSS or Cross Site Scripting](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).
+
+Luckily, you can tell Smarty to automatically apply the escape modifier to any dynamic part of your template.
+It's like Smarty magically adds `|escape` to every variable you use on a web page.
+
+Enable auto-escaping for HTML as follows:
+```php
+$smarty->setEscapeHtml(true);
+```
+
 ## Disabling compile check
 By default, Smarty tests to see if the
 current template has changed since the last time

docs/designers/language-builtin-functions/language-function-assign.md

@@ -8,12 +8,12 @@ execution of a template**.
 |----------------|------------|-----------------------------------------------------------------------|
 | var            |            | The name of the variable being assigned                               | 
 | value          |            | The value being assigned                                              |                             
-| scope          | (optional) | The scope of the assigned variable: \'parent\',\'root\' or \'global\' | 
+| scope          | (optional) | The scope of the assigned variable: 'parent','root' or 'global' | 
 
 ## Attributes of the {$var=...} syntax
 | Attribute Name | Required   | Description                                                           |
 |----------------|------------|-----------------------------------------------------------------------|
-| scope          | (optional) | The scope of the assigned variable: \'parent\',\'root\' or \'global\' | 
+| scope          | (optional) | The scope of the assigned variable: 'parent','root' or 'global' | 
 
 ## Option Flags
 | Name    | Description                                       |
@@ -102,6 +102,8 @@ A global variable is seen by all templates.
 {$foo="bar" scope="global"}
 ```
  
+For more information on variable scope, please read the page on [variable scopes](../language-variables/language-variable-scopes.md).
+
 To access `{assign}` variables from a php script use
 [`getTemplateVars()`](../../programmers/api-functions/api-get-template-vars.md). 
 Here's the template that creates the variable `$foo`.

docs/designers/language-builtin-functions/language-function-foreach.md

@@ -252,7 +252,7 @@ iteration.
 
 ```smarty
  {foreach $myNames as $name}
-   {if $name@iteration is even by 3}
+   {if $name@index is even by 3}
      <span style="color: #000">{$name}</span>
    {else}
      <span style="color: #eee">{$name}</span>

docs/designers/language-builtin-functions/language-function-section.md

@@ -478,13 +478,13 @@ header block every five rows.
 </table>
 ```
 
-An example that uses the `iteration` property to alternate a text color every
+An example that uses the `index` property to alternate a text color every
 third row.
 
 ```smarty
 <table>
   {section name=co loop=$contacts}
-    {if $smarty.section.co.iteration is even by 3}
+    {if $smarty.section.co.index is even by 3}
       <span style="color: #ffffff">{$contacts[co].name}</span>
     {else}
       <span style="color: #dddddd">{$contacts[co].name}</span>

docs/getting-started.md

@@ -1,7 +1,7 @@
 # Getting started
 
 ## Requirements
-Smarty can be run with PHP 7.2 to PHP 8.2.
+Smarty can be run with PHP 7.2 to PHP 8.3.
 
 ## Installation
 Smarty can be installed with [Composer](https://getcomposer.org/).
@@ -86,7 +86,7 @@ needs to be located in the [`$template_dir`](./programmers/api-variables/variabl
 
 ```smarty
 {* Smarty *}
-Hello {$name}, welcome to Smarty!
+<h1>Hello {$name|escape}, welcome to Smarty!</h1>
 ```
 
 > **Note**
@@ -132,6 +132,20 @@ Now, run your PHP file. You should see *"Hello Ned, welcome to Smarty!"*
 
 You have completed the basic setup for Smarty!
 
+## Escaping
+You may have noticed that the example template above renders the `$name` variable using
+the [escape modifier](./designers/language-modifiers/language-modifier-escape.md).  This 
+modifier makes string 'safe' to use in the context of an HTML page.
+
+If you are primarily using Smarty for HTML-pages, it is recommended to enable automatic
+escaping. This way, you don't have to add `|escape` to every variable you use on a web page. 
+Smarty will handle it automatically for you!
+
+Enable auto-escaping for HTML as follows:
+```php
+$smarty->setEscapeHtml(true);
+```
+
 ## Extended Setup
 
 This is a continuation of the [basic installation](#installation), please read that first!
@@ -156,6 +170,8 @@ class My_GuestBook extends Smarty {
         $this->setCompileDir('/web/www.example.com/guestbook/templates_c/');
         $this->setConfigDir('/web/www.example.com/guestbook/configs/');
         $this->setCacheDir('/web/www.example.com/guestbook/cache/');
+        
+        $this->setEscapeHtml(true);
 
         $this->caching = Smarty::CACHING_LIFETIME_CURRENT;
         $this->assign('app_name', 'Guest Book');

docs/index.md

@@ -26,6 +26,10 @@ and 480 for $height, the result is:
 - [Features](./features.md) - or "Why do I want Smarty?"
 
 ## Help
+- [Search or create an issue](https://github.com/smarty-php/smarty/issues)
 - [Upgrading from an older version](upgrading.md)
 - [Some random tips & tricks](./appendixes/tips.md)
 - [Troubleshooting](./appendixes/troubleshooting.md)
+
+## Source code
+- [Smarty repository at GitHub](https://github.com/smarty-php/smarty)

docs/upgrading.md

@@ -117,6 +117,7 @@ The following constants have been removed to prevent global side effects.
 - Smarty now always runs in multibyte mode. Make sure you use the [PHP multibyte extension](https://www.php.net/manual/en/book.mbstring.php) in production for optimal performance.
 - Generated `<script>` tags lo longer have deprecated `type="text/javascript"` or `language="Javascript"` attributes
 - Smarty will throw a compiler exception instead of silently ignoring a modifier on a function call, like this: `{include|dot:"x-template-id" file="included.dot.tpl"}`
+- The ::getFile() method of a CompilerException will now return the full path of the template being compiled, if possible. This used to be 'file:relative_dir/filename.tpl'.
 
 ## Upgrading from v3 to v4
 

run-tests-for-all-php-versions.sh

@@ -8,7 +8,7 @@
 COMPOSE_CMD="mutagen-compose"
 
 $COMPOSE_CMD run --rm php72 ./run-tests.sh $@ && \
-$COMPOSE_CMD run --rm php74 ./run-tests.sh $@ && \
+$COMPOSE_CMD run --rm php73 ./run-tests.sh $@ && \
 $COMPOSE_CMD run --rm php74 ./run-tests.sh $@ && \
 $COMPOSE_CMD run --rm php80 ./run-tests.sh $@ && \
 $COMPOSE_CMD run --rm php81 ./run-tests.sh $@ && \

src/Compile/PrintExpressionCompiler.php

@@ -84,7 +84,7 @@ class PrintExpressionCompiler extends Base {
 				}
 
 				if ($compiler->getTemplate()->getSmarty()->escape_html) {
-					$output = "htmlspecialchars((string) {$output}, ENT_QUOTES, '" . addslashes(\Smarty\Smarty::$_CHARSET) . "')";
+					$output = "htmlspecialchars((string) ({$output}), ENT_QUOTES, '" . addslashes(\Smarty\Smarty::$_CHARSET) . "')";
 				}
 
 			}

src/Compiler/CodeFrame.php

@@ -121,6 +121,6 @@ class CodeFrame
 	 * @return string
 	 */
 	public function insertLocalVariables(): string {
-		return '$_smarty_current_dir = ' . var_export(dirname($this->_template->getSource()->getFilepath()), true) . ";\n";
+		return '$_smarty_current_dir = ' . var_export(dirname($this->_template->getSource()->getFilepath() ?? '.'), true) . ";\n";
 	}
 }

src/Compiler/Template.php

@@ -848,7 +848,7 @@ class Template extends BaseCompiler {
 		$e = new CompilerException(
 			$error_text,
 			0,
-			$this->template->getSource()->getFullResourceName(),
+			$this->template->getSource()->getFilepath() ?? $this->template->getSource()->getFullResourceName(),
 			$line
 		);
 		$e->source = trim(preg_replace('![\t\r\n]+!', ' ', $match[$line - 1]));

src/Template/Source.php

@@ -271,11 +271,11 @@ class Source {
 		return $this->type . ':' . $this->name;
 	}
 
-	public function getFilepath(): string {
+	public function getFilepath(): ?string {
 		if ($this->handler instanceof FilePlugin) {
 			return $this->handler->getFilePath($this->name, $this->smarty, $this->isConfig);
 		}
-		return '.';
+		return null;
 	}
 
 	public function isConfig(): bool {

tests/UnitTests/TemplateSource/TagTests/If/CompileIfTest.php

@@ -103,7 +103,37 @@ class CompileIfTest extends PHPUnit_Smarty
                      array('{if 6 is not even}yes{else}no{/if}', 'no', 'IsNotEven', $i ++),
                      array('{if 3 is odd}yes{else}no{/if}', 'yes', 'IsOdd', $i ++),
                      array('{if 3 is not odd}yes{else}no{/if}', 'no', 'IsNotOdd', $i ++),
-                     array('{$foo=3}{if 3 is odd by $foo}yes{else}no{/if}', 'yes', 'IsOddByVar', $i ++),
+
+                     array('{if 0 is even by 3}yes{else}no{/if}', 'yes', 'IsEvenByTest0', $i ++),
+                     array('{if 1 is even by 3}yes{else}no{/if}', 'yes', 'IsEvenByTest1', $i ++),
+                     array('{if 2 is even by 3}yes{else}no{/if}', 'yes', 'IsEvenByTest2', $i ++),
+                     array('{if 3 is even by 3}yes{else}no{/if}', 'no', 'IsEvenByTest3', $i ++),
+                     array('{if 4 is even by 3}yes{else}no{/if}', 'no', 'IsEvenByTest4', $i ++),
+                     array('{if 5 is even by 3}yes{else}no{/if}', 'no', 'IsEvenByTest5', $i ++),
+                     array('{if 6 is even by 3}yes{else}no{/if}', 'yes', 'IsEvenByTest6', $i ++),
+                     array('{if 7 is even by 3}yes{else}no{/if}', 'yes', 'IsEvenByTest7', $i ++),
+
+                     array('{if 0 is odd by 3}yes{else}no{/if}', 'no', 'IsOddByTest0', $i ++),
+                     array('{if 1 is odd by 3}yes{else}no{/if}', 'no', 'IsOddByTest1', $i ++),
+                     array('{if 2 is odd by 3}yes{else}no{/if}', 'no', 'IsOddByTest2', $i ++),
+                     array('{if 3 is odd by 3}yes{else}no{/if}', 'yes', 'IsOddByTest3', $i ++),
+                     array('{if 4 is odd by 3}yes{else}no{/if}', 'yes', 'IsOddByTest4', $i ++),
+                     array('{if 5 is odd by 3}yes{else}no{/if}', 'yes', 'IsOddByTest5', $i ++),
+                     array('{if 6 is odd by 3}yes{else}no{/if}', 'no', 'IsOddByTest6', $i ++),
+                     array('{if 7 is odd by 3}yes{else}no{/if}', 'no', 'IsOddByTest7', $i ++),
+
+                     array('{if 2 is even by 3}yes{else}no{/if}', 'yes', 'IsEvenByVal1', $i ++),
+                     array('{if 3 is even by 2}yes{else}no{/if}', 'no', 'IsEvenByVal2', $i ++),
+                     array('{if 4 is even by 3}yes{else}no{/if}', 'no', 'IsEvenByVal3', $i ++),
+                     array('{$foo=3}{if 2 is even by $foo}yes{else}no{/if}', 'yes', 'IsEvenByVar1', $i ++),
+                     array('{$foo=2}{if 3 is even by $foo}yes{else}no{/if}', 'no', 'IsEvenByVar2', $i ++),
+                     array('{$foo=3}{if 4 is even by $foo}yes{else}no{/if}', 'no', 'IsEvenByVar3', $i ++),
+                     array('{if 2 is odd by 3}yes{else}no{/if}', 'no', 'IsOddByVal1', $i ++),
+                     array('{if 3 is odd by 2}yes{else}no{/if}', 'yes', 'IsOddByVal2', $i ++),
+                     array('{if 4 is odd by 3}yes{else}no{/if}', 'yes', 'IsOddByVal3', $i ++),
+                     array('{$foo=3}{if 2 is odd by $foo}yes{else}no{/if}', 'no', 'IsOddByVar1', $i ++),
+                     array('{$foo=2}{if 3 is odd by $foo}yes{else}no{/if}', 'yes', 'IsOddByVar2', $i ++),
+                     array('{$foo=3}{if 4 is odd by $foo}yes{else}no{/if}', 'yes', 'IsOddByVar3', $i ++),
                      array('{$foo=3}{$bar=6}{if $bar is not odd by $foo}yes{else}no{/if}', 'yes', 'IsNotOddByVar', $i ++),
                      array('{$foo=3}{$bar=3}{if 3+$bar is not odd by $foo}yes{else}no{/if}', 'yes', 'ExprIsNotOddByVar', $i ++),
                      array('{$foo=2}{$bar=6}{if (3+$bar) is not odd by ($foo+1)}yes{else}no{/if}', 'no', 'ExprIsNotOddByExpr', $i ++),