Compare commits

...

5 Commits

Author SHA1 Message Date
Simon Wisselink 44e00cf7c0 muteUndefinedOrNullWarnings() now also mutes PHP8 warnings for undefined properties 2023-07-19 12:05:45 +02:00
Simon Wisselink e28cb0915b Merge branch 'release/4.3.1' 2023-03-28 21:47:03 +02:00
Simon Wisselink fe7817c301 version bump 2023-03-28 21:47:01 +02:00
Simon Wisselink 685662466f Merge branch 'js_escape_security_fix' 2023-03-28 21:46:46 +02:00
takaram 5512d64521 Upgrade actions/checkout and actions/cache (#870) 2023-03-25 15:38:18 +01:00
4 changed files with 21 additions and 3 deletions
+2 -2
View File
@@ -49,7 +49,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: Override PHP ini values for JIT compiler
if: matrix.compiler == 'jit'
@@ -68,7 +68,7 @@ jobs:
- name: Cache Composer packages
id: composer-cache
uses: actions/cache@v2
uses: actions/cache@v3
with:
path: vendor
key: ${{ runner.os }}-php-${{ matrix.php-version }}-${{ hashFiles('**/composer.lock') }}
+5
View File
@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
### Fixed
- `$smarty->muteUndefinedOrNullWarnings()` now also mutes PHP8 warnings for undefined properties
## [4.3.1] - 2023-03-28
### Security
- Fixed Cross site scripting vulnerability in Javascript escaping. This addresses CVE-2023-28447.
+1 -1
View File
@@ -107,7 +107,7 @@ class Smarty extends Smarty_Internal_TemplateBase
/**
* smarty version
*/
const SMARTY_VERSION = '4.3.0';
const SMARTY_VERSION = '4.3.1';
/**
* define variable scopes
*/
@@ -17,6 +17,12 @@ class Smarty_Internal_ErrorHandler
*/
public $allowUndefinedVars = true;
/**
* Allows {$foo->propName} where propName is undefined.
* @var bool
*/
public $allowUndefinedProperties = true;
/**
* Allows {$foo.bar} where bar is unset and {$foo.bar1.bar2} where either bar1 or bar2 is unset.
* @var bool
@@ -80,6 +86,13 @@ class Smarty_Internal_ErrorHandler
return; // suppresses this error
}
if ($this->allowUndefinedProperties && preg_match(
'/^(Undefined property)/',
$errstr
)) {
return; // suppresses this error
}
if ($this->allowUndefinedArrayKeys && preg_match(
'/^(Undefined index|Undefined array key|Trying to access array offset on value of type)/',
$errstr