Compare commits

..

1 Commits

Author SHA1 Message Date
Simon Wisselink 1bca68beec Fix TypeError for non-array static_classes in Security policy 2026-06-29 12:34:58 +02:00
6 changed files with 5 additions and 7 deletions
-5
View File
@@ -6,11 +6,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
## [5.8.4] - 2026-06-29
- Fixed a `TypeError` on PHP 8 when `Security::$static_classes` was set to a non-array value (e.g. the string `'none'`) to disable static class access; any non-array value now cleanly denies access. Use `Security::$static_classes = null` to disable access to all static classes.
- Security: the built-in `stream:` resource type now validates the nested stream wrapper against the security policy, so a template such as `stream:php://filter/...` can no longer bypass `Security::$streams` (including `Security::$streams = null`) to read local files (CWE-22)
## [5.8.3] - 2026-06-28
- fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
@@ -0,0 +1 @@
- Security: the built-in `stream:` resource type now validates the nested stream wrapper against the security policy, so a template such as `stream:php://filter/...` can no longer bypass `Security::$streams` (including `Security::$streams = null`) to read local files (CWE-22)
@@ -0,0 +1 @@
- Fixed a `TypeError` on PHP 8 when `Security::$static_classes` was set to a non-array value (e.g. the string `'none'`) to disable static class access; any non-array value now cleanly denies access. Use `Security::$static_classes = null` to disable access to all static classes.
+1
View File
@@ -1,3 +1,4 @@
version: "2"
services:
base:
build:
+1 -1
View File
@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
/**
* smarty version
*/
const SMARTY_VERSION = '5.8.4';
const SMARTY_VERSION = '5.8.3';
/**
* define caching modes
+1 -1
View File
@@ -535,7 +535,7 @@ class Template extends TemplateBase {
*/
public function getRightDelimiter()
{
return $this->right_delimiter ?? $this->getSmarty()->getRightDelimiter();
return $this->right_delimiter ?? $this->getSmarty()->getRightDelimiter();;
}
/**