Merge branch 'release/5.3.1'

Fixes #1034

CHANGELOG.md

@@ -6,6 +6,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.3.1] - 2024-06-16
+- Fixed error when using section with nocache [#1034](https://github.com/smarty-php/smarty/issues/1034)
+
+
+## [5.3.0] - 2024-05-30
+- Fix warning when calling hasVariable for an undefined variable [#977](https://github.com/smarty-php/smarty/issues/977)
+- Added `$smarty->prependTemplateDir()` method [#1022](https://github.com/smarty-php/smarty/issues/1022)
+
+
+## [5.2.0] - 2024-05-28
+- Fixed a code injection vulnerability in extends-tag. This addresses CVE-2024-35226.
+- Added `$smarty->setCacheModifiedCheck()` setter for cache_modified_check
+- Added a PSR-4 loading script to allow Smarty to be used without Composer [#1017](https://github.com/smarty-php/smarty/pull/1017)
+
+
 ## [5.1.0] - 2024-04-22
 - Prevent deprecation notices during compilation in PHP8.3 [#996](https://github.com/smarty-php/smarty/issues/996)
 - Fix that getTemplateVars would return an array of objects instead of the assigned variables values [#994](https://github.com/smarty-php/smarty/issues/994)
@@ -16,16 +31,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Internal compiler classes always return a string (the internal has_code flag has been removed for simplicity) [#918](https://github.com/smarty-php/smarty/pull/918)
 - Fix invalid classnames in Runtime code for foreach [#1000](https://github.com/smarty-php/smarty/issues/1000)
 
+## [5.0.2] - 2024-03-28
+- Fix Smarty::assign() not returning $this when called with an array as first parameter [#972](https://github.com/smarty-php/smarty/pull/972)
 
 ## [5.0.1] - 2024-03-27
 - Fix error in Smarty\Smarty::compileAllTemplates() by including missing FilesystemIterator class [#966](https://github.com/smarty-php/smarty/issues/966)  
 
-
 ## [5.0.0] - 2024-03-25
 - Fixed that scoped variables would overwrite parent scope [#952](https://github.com/smarty-php/smarty/issues/952)
 - Removed publicly accessible `$tpl->_var_stack` variable
 
-
 ### Fixed
 - Too many shorthand attributes error when using a modifier as a function with more than 3 parameters in an expression [#949](https://github.com/smarty-php/smarty/issues/949)
 

docs/api/configuring.md

@@ -12,24 +12,27 @@ Use `getTemplateDir()` to retrieve the configured paths.
 <?php
 
  // set a single directory where the config files are stored
-$smarty->setTemplateDir('./config');
+$smarty->setTemplateDir('./templates');
 
-// set multiple directories where config files are stored
-$smarty->setTemplateDir(['./config', './config_2', './config_3']);
+// set multiple directories where templates are stored
+$smarty->setTemplateDir(['./templates', './templates_2', './templates_3']);
 
-// add directory where config files are stored to the current list of dirs
-$smarty->addTemplateDir('./config_1');
+// add directory where templates files are stored to the current list of dirs
+$smarty->addTemplateDir('./templates_1');
 
 // add multiple directories to the current list of dirs
 $smarty->addTemplateDir([
-    './config_2',
-    './config_3',
+    './templates_2',
+    './templates_3',
 ]);
 
 // chaining of method calls
-$smarty->setTemplateDir('./config')
-       ->addTemplateDir('./config_1')
-       ->addTemplateDir('./config_2');
+$smarty->setTemplateDir('./templates')
+       ->addTemplateDir('./templates_1')
+       ->addTemplateDir('./templates_2');
+
+// insert a template dir before exising template dirs
+$smarty->prependTemplateDir('./more_important_templates')
 
 // get all directories where config files are stored
 $template_dirs = $smarty->getTemplateDir();

docs/getting-started.md

@@ -25,9 +25,17 @@ Here's how you create an instance of Smarty in your PHP scripts:
 ```php
 <?php
 
+// Instantiated via composer
 require 'vendor/autoload.php';
 use Smarty\Smarty;
 $smarty = new Smarty();
+
+// or ...
+
+// Instantiated directly
+require("/path/to/smarty/libs/Smarty.class.php");
+use Smarty\Smarty;
+$smarty = new Smarty();
 ```
 
 Now that the library files are in place, it's time to set up the Smarty

docs/img/smarty.svg

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generator: Adobe Illustrator 25.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" style="enable-background:new 0 0 1000 1000;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#F5E0B4;}
+	.st1{fill:#383535;}
+	.st2{fill:#FBDE3D;}
+	.st3{fill:#8C919F;}
+	.st4{fill:#CACED5;}
+	.st5{fill:#FFFFFF;}
+</style>
+<g>
+	<polygon class="st0" points="782.2,925.8 733.4,643.2 996.4,532.7 745.7,396.4 823.6,120.2 560.7,232.2 391.6,0 313.7,274.7    26.5,260.1 194.4,491.3 3.6,705.5 289.4,721.3 340.5,1000 529.1,787  "/>
+	<path class="st1" d="M706.9,493.4c0-126-102.2-228.2-228.2-228.2c-126,0-228.2,102.2-228.2,228.2c0,81.8,43.1,153.6,107.8,193.8   v202.6l43.5,43.5l0.2-0.2h150.6l0.2,0.2l43.5-43.5V689C662.6,649,706.9,576.4,706.9,493.4z"/>
+	<path class="st2" d="M682.2,492.9c0-112.7-91.3-204-204-204s-204,91.3-204,204c0,78,43.8,145.8,108.1,180.1v93.6h191.7V673   C638.4,638.7,682.2,571,682.2,492.9z"/>
+	<g>
+		<polygon class="st3" points="382.7,790.4 382.7,881.1 412,910.3 544.9,910.3 574.1,881.1 574.1,790.4   "/>
+		<polygon class="st4" points="540,813.2 540,866.5 527,879.5 540.4,892.9 558.7,874.6 558.9,874.6 558.9,813.2   "/>
+	</g>
+	<path class="st5" d="M478.3,310.4c-5,0-9.1,4.1-9.1,9.1c0,5,4.1,9.1,9.1,9.1c90.7,0,164.3,73.5,164.3,164.3c0,5,4.1,9.1,9.1,9.1   s9.1-4.1,9.1-9.1C660.8,392.1,579.1,310.4,478.3,310.4z"/>
+</g>
+</svg>

libs/Smarty.class.php

@@ -0,0 +1,42 @@
+<?php
+
+/////////////////////////////////////////////////////////////////////
+// This is a stub PSR-4 loading script that gets all the pieces of //
+// Smarty 5.x loaded without requiring the use of composer. It's   //
+// not really a 'class' file, but the name is used so we're        //
+// backwards compatible with previous versions of Smarty.          //
+//                                                                 //
+// Example:                                                        //
+// require_once("/path/to/smarty/libs/Smarty.class.php");          //
+//                                                                 //
+// $smarty = new Smarty\Smarty;                                    //
+// $smarty->testInstall();                                         //
+/////////////////////////////////////////////////////////////////////
+
+define('__SMARTY_DIR', __DIR__ . '/../src/');
+
+// Global function declarations
+require_once(__SMARTY_DIR . "/functions.php");
+
+spl_autoload_register(function ($class) {
+	// Class prefix
+	$prefix = 'Smarty\\';
+
+	// Does the class use the namespace prefix?
+	$len = strlen($prefix);
+	if (strncmp($prefix, $class, $len) !== 0) {
+		// If not, move to the next registered autoloader
+		return;
+	}
+
+	// Hack off the prefix part
+	$relative_class = substr($class, $len);
+
+	// Build a path to the include file
+	$file = __SMARTY_DIR . str_replace('\\', '/', $relative_class) . '.php';
+
+	// If the file exists, require it
+	if (file_exists($file)) {
+		require_once($file);
+	}
+});

src/Compile/Tag/ExtendsTag.php

@@ -32,7 +32,7 @@ class ExtendsTag extends Inheritance {
 	 *
 	 * @var array
 	 */
-	protected $optional_attributes = ['extends_resource'];
+	protected $optional_attributes = [];
 
 	/**
 	 * Attribute definition: Overwrites base class.
@@ -64,29 +64,7 @@ class ExtendsTag extends Inheritance {
 		}
 		// add code to initialize inheritance
 		$this->registerInit($compiler, true);
-		$file = trim($_attr['file'], '\'"');
-		if (strlen($file) > 8 && substr($file, 0, 8) === 'extends:') {
-			// generate code for each template
-			$files = array_reverse(explode('|', substr($file, 8)));
-			$i = 0;
-			foreach ($files as $file) {
-				if ($file[0] === '"') {
-					$file = trim($file, '".');
-				} else {
-					$file = "'{$file}'";
-				}
-				$i++;
-				if ($i === count($files) && isset($_attr['extends_resource'])) {
-					$this->compileEndChild($compiler);
-				}
-				$this->compileInclude($compiler, $file);
-			}
-			if (!isset($_attr['extends_resource'])) {
-				$this->compileEndChild($compiler);
-			}
-		} else {
-			$this->compileEndChild($compiler, $_attr['file']);
-		}
+		$this->compileEndChild($compiler, $_attr['file']);
 		return '';
 	}
 
@@ -106,42 +84,4 @@ class ExtendsTag extends Inheritance {
 			(isset($template) ?	", {$template}, \$_smarty_current_dir" : '') . ");\n?>"
 		);
 	}
-
-	/**
-	 * Add code for including subtemplate to end of template
-	 *
-	 * @param \Smarty\Compiler\Template $compiler
-	 * @param string $template subtemplate name
-	 *
-	 * @throws \Smarty\CompilerException
-	 * @throws \Smarty\Exception
-	 */
-	private function compileInclude(\Smarty\Compiler\Template $compiler, $template) {
-		$compiler->getParser()->template_postfix[] = new \Smarty\ParseTree\Tag(
-			$compiler->getParser(),
-			$compiler->compileTag(
-				'include',
-				[
-					$template,
-					['scope' => 'parent'],
-				]
-			)
-		);
-	}
-
-	/**
-	 * Create source code for {extends} from source components array
-	 *
-	 * @param \Smarty\Template $template
-	 *
-	 * @return string
-	 */
-	public static function extendsSourceArrayCode(\Smarty\Template $template) {
-		$resources = [];
-		foreach ($template->getSource()->components as $source) {
-			$resources[] = $source->resource;
-		}
-		return $template->getLeftDelimiter() . 'extends file=\'extends:' . join('|', $resources) .
-			'\' extends_resource=true' . $template->getRightDelimiter();
-	}
 }

src/Compile/Tag/Section.php

@@ -99,7 +99,7 @@ class Section extends ForeachSection {
 
 		if ($compiler->tag_nocache) {
 			// push a {nocache} tag onto the stack to prevent caching of this block
-			$this->openTag('nocache');
+			$this->openTag($compiler, 'nocache');
 		}
 
 		$this->openTag($compiler, 'section', ['section', $compiler->tag_nocache]);

src/Compile/Tag/SectionClose.php

@@ -33,7 +33,7 @@ class SectionClose extends Base {
 
 		if ($nocache_pushed) {
 			// pop the pushed virtual nocache tag
-			$this->closeTag('nocache');
+			$this->closeTag($compiler, 'nocache');
 		}
 
 		$output = "<?php\n";

src/Compiler/Template.php

@@ -403,21 +403,37 @@ class Template extends BaseCompiler {
 			}
 			// get template source
 			if (!empty($this->template->getSource()->components)) {
-				// we have array of inheritance templates by extends: resource
-				// generate corresponding source code sequence
-				$_content =
-					ExtendsTag::extendsSourceArrayCode($this->template);
+
+				$_compiled_code = '<?php $_smarty_tpl->getInheritance()->init($_smarty_tpl, true); ?>';
+
+				$i = 0;
+				$reversed_components = array_reverse($this->template->getSource()->components);
+				foreach ($reversed_components as $source) {
+					$i++;
+					if ($i === count($reversed_components)) {
+						$_compiled_code .= '<?php $_smarty_tpl->getInheritance()->endChild($_smarty_tpl); ?>';
+					}
+					$_compiled_code .= $this->compileTag(
+						'include',
+						[
+							var_export($source->resource, true),
+							['scope' => 'parent'],
+						]
+					);
+				}
+				$_compiled_code = $this->smarty->runPostFilters($_compiled_code, $this->template);
 			} else {
 				// get template source
 				$_content = $this->template->getSource()->getContent();
+				$_compiled_code = $this->smarty->runPostFilters(
+					$this->doCompile(
+						$this->smarty->runPreFilters($_content, $this->template),
+						true
+					),
+					$this->template
+				);
 			}
-			$_compiled_code = $this->smarty->runPostFilters(
-				$this->doCompile(
-					$this->smarty->runPreFilters($_content, $this->template),
-					true
-				),
-				$this->template
-			);
+
 		} catch (\Exception $e) {
 			if ($this->smarty->debugging) {
 				$this->smarty->getDebug()->end_compile($this->template);

src/Data.php

@@ -290,7 +290,7 @@ class Data
 	 * @return bool
 	 */
 	public function hasVariable($varName): bool {
-		return !($this->getVariable($varName) instanceof UndefinedVariable);
+		return !($this->getVariable($varName, true, false) instanceof UndefinedVariable);
 	}
 
 	/**

src/Smarty.php

@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
 	/**
 	 * smarty version
 	 */
-	const SMARTY_VERSION = '5.1.0';
+	const SMARTY_VERSION = '5.3.1';
 
 	/**
 	 * define caching modes
@@ -684,6 +684,21 @@ class Smarty extends \Smarty\TemplateBase {
 		return $this;
 	}
 
+	/**
+	 * Adds a template directory before any existing directoires
+	 *
+	 * @param string $new_template_dir directory of template sources
+	 * @param bool $is_config true for config_dir
+	 *
+	 * @return static current Smarty instance for chaining
+	 */
+	public function prependTemplateDir($new_template_dir, $is_config = false) {
+		$current_template_dirs = $is_config ? $this->config_dir : $this->template_dir;
+		array_unshift($current_template_dirs, $new_template_dir);
+		$this->setTemplateDir($current_template_dirs, $is_config);
+		return $this;
+	}
+
 	/**
 	 * Add config directory(s)
 	 *
@@ -2211,5 +2226,14 @@ class Smarty extends \Smarty\TemplateBase {
 		return $template;
 	}
 
+	/**
+	 * Sets if Smarty should check If-Modified-Since headers to determine cache validity.
+	 * @param bool $cache_modified_check
+	 * @return void
+	 */
+	public function setCacheModifiedCheck($cache_modified_check): void {
+		$this->cache_modified_check = (bool) $cache_modified_check;
+	}
+
 }
 

tests/UnitTests/ResourceTests/FileIndexed/FileResourceIndexedTest.php

@@ -91,4 +91,13 @@ class FileResourceIndexedTest extends PHPUnit_Smarty
 
 	    $this->assertNotEquals($tpl->getCached()->filepath, $tpl2->getCached()->filepath);
     }
+
+	public function testPrependTemplatePath()
+	{
+		$this->smarty->setTemplateDir(__DIR__ . '/templates');
+		$this->smarty->prependTemplateDir(__DIR__ . '/templates_4');
+		$tpl = $this->smarty->createTemplate('dirname.tpl');
+		$this->assertEquals('templates_4', $this->smarty->fetch($tpl));
+	}
+
 }

tests/UnitTests/SmartyMethodsTests/GetTemplateVars/cache/.gitignore

@@ -1,2 +0,0 @@
-# Ignore anything in here, but keep this directory
-*

tests/UnitTests/SmartyMethodsTests/GetTemplateVars/templates_c/.gitignore

@@ -1,2 +0,0 @@
-# Ignore anything in here, but keep this directory
-*

tests/UnitTests/SmartyMethodsTests/TemplateVars/HasVariableTest.php

@@ -0,0 +1,32 @@
+<?php
+
+/**
+ * Tests the ::hasVariable method
+ */
+class HasVariableTest extends PHPUnit_Smarty
+{
+	public function setUp(): void
+	{
+		$this->setUpSmarty(__DIR__);
+	}
+
+
+	public function testInit()
+	{
+		$this->cleanDirs();
+	}
+
+	public function testSimpleTrue()
+	{
+		$this->smarty->assign('foo', 'bar');
+		$this->assertTrue($this->smarty->hasVariable('foo'));
+	}
+
+
+	public function testSimpleFalse()
+	{
+		$this->smarty->assign('foo', 'bar');
+		$this->assertFalse($this->smarty->hasVariable('foox'));
+	}
+
+}

tests/UnitTests/TemplateSource/TagTests/BockExtend/CompileBlockExtendsTest.php

@@ -1193,8 +1193,38 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
         );
     }
 
-	public function testBlockWithAssign() {
-		$this->assertEquals('Captured content is: Content with lots of html here', $this->smarty->fetch('038_child.tpl'));
-	}
+    public function testBlockWithAssign() {
+        $this->assertEquals('Captured content is: Content with lots of html here', $this->smarty->fetch('038_child.tpl'));
+    }
+
+    /**
+     * Test escaping of file parameter
+     */
+    public function testEscaping()
+    {
+        $this->expectException(\Smarty\Exception::class);
+        $this->expectExceptionMessageMatches('/Unable to load.*/');
+        $this->assertEquals('hello world', $this->smarty->fetch('escaping.tpl'));
+    }
+
+    /**
+     * Test escaping of file parameter 2
+     */
+    public function testEscaping2()
+    {
+        $this->expectException(\Smarty\Exception::class);
+        $this->expectExceptionMessageMatches('/Unable to load.*/');
+        $this->assertEquals('hello world', $this->smarty->fetch('escaping2.tpl'));
+    }
+
+    /**
+     * Test escaping of file parameter 3
+     */
+    public function testEscaping3()
+    {
+        $this->expectException(\Smarty\Exception::class);
+        $this->expectExceptionMessageMatches('/Unable to load.*/');
+        $this->assertEquals('hello world', $this->smarty->fetch('escaping3.tpl'));
+    }
 
 }

tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping.tpl

@@ -0,0 +1 @@
+{extends "extends:helloworld.tpl', var_dump(shell_exec('ls')), 1, 2, 3);}}?>"}

tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping2.tpl

@@ -0,0 +1 @@
+{extends 'extends:"helloworld.tpl\', var_dump(shell_exec(\'ls\')), 1, 2, 3);}}?>'}

tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping3.tpl

@@ -0,0 +1 @@
+{extends file='extends:"helloworld.tpl'|cat:"', var_dump(shell_exec('ls')), 1, 2, 3);}}?>"}

tests/UnitTests/TemplateSource/TagTests/Include/CompileIncludeTest.php

@@ -82,6 +82,18 @@ class CompileIncludeTest extends PHPUnit_Smarty
         $this->assertEquals('I1I2I3', $content, $text);
     }
 
+    /**
+     * test template name escaping
+     */
+    public function testIncludeFilenameEscaping()
+    {
+        $this->expectException(\Smarty\Exception::class);
+        $this->expectExceptionMessageMatches('/Unable to load.*/');
+        $tpl = $this->smarty->createTemplate('test_include_security.tpl');
+        $content = $this->smarty->fetch($tpl);
+        $this->assertEquals("hello world", $content);
+    }
+
     /**
      * test standard output
      *

tests/UnitTests/TemplateSource/TagTests/Include/templates/test_include_security.tpl

@@ -0,0 +1 @@
+{include file="helloworld.tpl', var_dump(shell_exec('ls')), 1, 2, 3);}}?>"}

tests/UnitTests/TemplateSource/TagTests/Section/CompileSectionTest.php

@@ -148,4 +148,10 @@ class CompileSectionTest extends PHPUnit_Smarty
         );
     }
 
+    public function testSectionWithNocache()
+    {
+        $source = 'string:{section name=module start=0 loop=1 nocache}{/section}';
+        $this->assertEquals('', $this->smarty->fetch($source));
+    }
+
 }

tests/UnitTests/TemplateSource/_Issues/419/ExtendsIssue419Test.php

@@ -32,4 +32,11 @@ class ExtendsIssue419Test extends PHPUnit_Smarty
         $this->assertEquals('child', $this->smarty->fetch('extends:001_parent.tpl|001_child.tpl'));
     }
 
+    public function testextendsSecurity()
+    {
+        $this->expectException(\Smarty\Exception::class);
+        $this->expectExceptionMessageMatches('/Unable to load.*/');
+        $this->assertEquals('child', $this->smarty->fetch('string:{include "001_parent.tpl\', var_dump(shell_exec(\'ls\')), 1, 2, 3);}}?>"}'));
+    }
+
 }