Changelog

Merge branch 'master' of github.com:JonisoftGermany/smarty into JonisoftGermany-master
Do not use obsolete smarty properties '_dir_perms', '_file_perms', 'plugin_search_order' in our own code. (#772 )
2026-08-13 17:01:41 +02:00 · 2022-07-17 00:54:20 +02:00 · 2022-07-17 00:53:25 +02:00 · 2022-07-17 00:13:57 +02:00 · 2022-07-14 23:51:26 +02:00 · 2022-07-14 23:50:22 +02:00
19 changed files with 173 additions and 45 deletions
@@ -10,8 +10,8 @@
 /demo export-ignore
 /docs export-ignore
 /utilities export-ignore
 /docker-compose.yml export-ignore
 /.github export-ignore
 /.gitattributes export-ignore
 /.gitignore export-ignore
 /make-release.sh export-ignore
@@ -5,7 +5,6 @@
 lexer/*.php
 lexer/*.php.bak
 lexer/*.out
 utilies/*.php
 # Dev
 phpunit*
@@ -6,8 +6,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 ### Changed
 - Updated HTML of the debug template [#599](https://github.com/smarty-php/smarty/pull/599)
 ## [4.1.1] - 2022-05-17
 ### Security
- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-
+- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221
 ### Fixed
 - Exclude docs and demo from export and composer [#751](https://github.com/smarty-php/smarty/pull/751)
@@ -0,0 +1,39 @@
 version: "2"
 services:
  base:
    build:
      context: .
    volumes:
      - .:/app
    working_dir: /app
    entrypoint: sh ./utilities/testrunners/run-test.sh
  php71:
    extends:
      service: base
    build:
      dockerfile: ./utilities/testrunners/php71/Dockerfile
  php72:
    extends:
      service: base
    build:
      dockerfile: ./utilities/testrunners/php72/Dockerfile
  php73:
    extends:
      service: base
    build:
      dockerfile: ./utilities/testrunners/php73/Dockerfile
  php74:
    extends:
      service: base
    build:
      dockerfile: ./utilities/testrunners/php74/Dockerfile
  php80:
    extends:
      service: base
    build:
      dockerfile: ./utilities/testrunners/php80/Dockerfile
  php81:
    extends:
      service: base
    build:
      dockerfile: ./utilities/testrunners/php81/Dockerfile
@@ -3,7 +3,7 @@
 Setting `$escape_html` to TRUE will escape all template variable output
 by wrapping it in
-`htmlspecialchars({$output}, ENT_QUOTES, SMARTY_RESOURCE_CHAR_SET);`,
+`htmlspecialchars({$output}, ENT_QUOTES, $char_set);`,
 which is the same as `{$variable|escape:"html"}`.
 Template designers can choose to selectively disable this feature by
@@ -5,10 +5,10 @@ Charset Encoding {#charset.encoding}
 ================
 There are a variety of encodings for textual data, ISO-8859-1 (Latin1)
-and UTF-8 being the most popular. Unless specified otherwise with the
+and UTF-8 being the most popular. Unless you change `Smarty::$_CHARSET`, 
-`SMARTY_RESOURCE_CHAR_SET` constant, Smarty recognizes `UTF-8` as the
+Smarty recognizes `UTF-8` as the internal charset if 
-internal charset if [Multibyte String](https://www.php.net/mbstring) is
+[Multibyte String](https://www.php.net/mbstring) is available, 
-available, `ISO-8859-1` if not.
+`ISO-8859-1` if not.
 > **Note**
 >
@@ -36,8 +36,9 @@ available, `ISO-8859-1` if not.
    if (function_exists('mb_internal_charset')) {
      mb_internal_charset('EUC-JP');
    }
-    define('SMARTY_RESOURCE_CHAR_SET', 'EUC-JP');
+
    require_once 'libs/Smarty.class.php';
    Smarty::$_CHARSET = 'EUC-JP';
    $smarty = new Smarty();
@@ -98,7 +98,7 @@ class Smarty extends Smarty_Internal_TemplateBase
    /**
     * smarty version
     */
-    const SMARTY_VERSION = '4.1.0';
+    const SMARTY_VERSION = '4.1.1';
    /**
     * define variable scopes
     */
@@ -1,9 +1,9 @@
 {capture name='_smarty_debug' assign=debug_output}
-    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+    <!DOCTYPE html>
-    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+    <html lang="en">
    <head>
        <title>Smarty Debug Console</title>
-        <style type="text/css">
+        <style>
            {literal}
            body, h1, h2, h3, td, th, p {
                font-family: sans-serif;
@@ -31,6 +31,7 @@
                padding: 2px;
                border-top: 1px solid black;
            }
            h3 {
                text-align: left;
                font-weight: bold;
@@ -67,11 +68,11 @@
                color: green;
            }
-            .odd {
+            tr:nth-child(odd) {
                background-color: #eeeeee;
            }
-            .even {
+            tr:nth-child(even) {
                background-color: #fafafa;
            }
@@ -84,13 +85,16 @@
                color: black;
                font-weight: bold;
            }
            #blue h3 {
                color: blue;
            }
            #normal div {
                color: black;
                font-weight: normal;
            }
            #table_assigned_vars th {
                color: blue;
                font-weight: bold;
@@ -99,7 +103,6 @@
            #table_config_vars th {
                color: maroon;
            }
            {/literal}
        </style>
    </head>
@@ -112,11 +115,11 @@
        <h2>included templates &amp; config files (load time in seconds)</h2>
        <div>
            {foreach $template_data as $template}
-                <font color=brown>{$template.name}</font>
+                <span style="color: brown;">{$template.name}</span>
-                <br />&nbsp;&nbsp;<span class="exectime">
+                <br>&nbsp;&nbsp;<span class="exectime">
                (compile {$template['compile_time']|string_format:"%.5f"}) (render {$template['render_time']|string_format:"%.5f"}) (cache {$template['cache_time']|string_format:"%.5f"})
                 </span>
-                <br />
+                <br>
            {/foreach}
        </div>
    {/if}
@@ -125,13 +128,22 @@
    <table id="table_assigned_vars">
        {foreach $assigned_vars as $vars}
-            <tr class="{if $vars@iteration % 2 eq 0}odd{else}even{/if}">
+            <tr>
-                <td><h3><font color=blue>${$vars@key}</font></h3>
+                <td>
-                    {if isset($vars['nocache'])}<b>Nocache</b><br />{/if}
+                    <h3 style="color: blue;">${$vars@key}</h3>
-                    {if isset($vars['scope'])}<b>Origin:</b> {$vars['scope']|debug_print_var nofilter}{/if}
+                    {if isset($vars['nocache'])}<strong>Nocache</strong><br>{/if}
                    {if isset($vars['scope'])}<strong>Origin:</strong> {$vars['scope']|debug_print_var nofilter}{/if}
                </td>
                <td>
                    <h3>Value</h3>
                    {$vars['value']|debug_print_var:10:80 nofilter}
                </td>
                <td>
                    {if isset($vars['attributes'])}
                        <h3>Attributes</h3>
                        {$vars['attributes']|debug_print_var nofilter}
                    {/if}
                </td>
                <td><h3>Value</h3>{$vars['value']|debug_print_var:10:80 nofilter}</td>
                <td>{if isset($vars['attributes'])}<h3>Attributes</h3>{$vars['attributes']|debug_print_var nofilter} {/if}</td>
         {/foreach}
    </table>
@@ -139,11 +151,14 @@
    <table id="table_config_vars">
        {foreach $config_vars as $vars}
-            <tr class="{if $vars@iteration % 2 eq 0}odd{else}even{/if}">
+            <tr>
-                <td><h3><font color=blue>#{$vars@key}#</font></h3>
+                <td>
-                    {if isset($vars['scope'])}<b>Origin:</b> {$vars['scope']|debug_print_var nofilter}{/if}
+                    <h3 style="color: blue;">#{$vars@key}#</h3>
                    {if isset($vars['scope'])}<strong>Origin:</strong> {$vars['scope']|debug_print_var nofilter}{/if}
                </td>
                <td>
                    {$vars['value']|debug_print_var:10:80 nofilter}
                </td>
                <td>{$vars['value']|debug_print_var:10:80 nofilter}</td>
            </tr>
        {/foreach}
@@ -93,7 +93,7 @@ class Smarty_Internal_Compile_Private_Print_Expression extends Smarty_Internal_C
                }
                // autoescape html
                if ($compiler->template->smarty->escape_html) {
-                    $output = "htmlspecialchars({$output}, ENT_QUOTES, '" . addslashes(Smarty::$_CHARSET) . "')";
+                    $output = "htmlspecialchars((string) {$output}, ENT_QUOTES, '" . addslashes(Smarty::$_CHARSET) . "')";
                }
                // loop over registered filters
                if (!empty($compiler->template->smarty->registered_filters[ Smarty::FILTER_VARIABLE ])) {
@@ -29,12 +29,7 @@ class Smarty_Internal_Runtime_WriteFile
    {
        $_error_reporting = error_reporting();
        error_reporting($_error_reporting & ~E_NOTICE & ~E_WARNING);
-        $_file_perms = property_exists($smarty, '_file_perms') ? $smarty->_file_perms : 0644;
+        $old_umask = umask(0);
        $_dir_perms =
            property_exists($smarty, '_dir_perms') ? (isset($smarty->_dir_perms) ? $smarty->_dir_perms : 0777) : 0771;
        if ($_file_perms !== null) {
            $old_umask = umask(0);
        }
        $_dirpath = dirname($_filepath);
        // if subdirs, create dir structure
        if ($_dirpath !== '.') {
@@ -42,7 +37,7 @@ class Smarty_Internal_Runtime_WriteFile
            // loop if concurrency problem occurs
            // see https://bugs.php.net/bug.php?id=35326
            while (!is_dir($_dirpath)) {
-                if (@mkdir($_dirpath, $_dir_perms, true)) {
+                if (@mkdir($_dirpath, 0771, true)) {
                    break;
                }
                clearstatcache();
@@ -89,11 +84,9 @@ class Smarty_Internal_Runtime_WriteFile
            error_reporting($_error_reporting);
            throw new SmartyException("unable to write file {$_filepath}");
        }
-        if ($_file_perms !== null) {
+        // set file permissions
-            // set file permissions
+        chmod($_filepath, 0644);
-            chmod($_filepath, $_file_perms);
+        umask($old_umask);
            umask($old_umask);
        }
        error_reporting($_error_reporting);
        return true;
    }
@@ -422,9 +422,6 @@ abstract class Smarty_Internal_TemplateCompilerBase
        try {
            // save template object in compiler class
            $this->template = $template;
            if (property_exists($this->template->smarty, 'plugin_search_order')) {
                $this->plugin_search_order = $this->template->smarty->plugin_search_order;
            }
            if ($this->smarty->debugging) {
                if (!isset($this->smarty->_debug)) {
                    $this->smarty->_debug = new Smarty_Internal_Debug();
@@ -0,0 +1,10 @@
 FROM php:7.1-cli
 ## Basic utilities
 RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
 ## Composer
 COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
 WORKDIR /root
 RUN sh ./install-composer.sh
 RUN mv ./composer.phar /usr/local/bin/composer
@@ -0,0 +1,10 @@
 FROM php:7.2-cli
 ## Basic utilities
 RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
 ## Composer
 COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
 WORKDIR /root
 RUN sh ./install-composer.sh
 RUN mv ./composer.phar /usr/local/bin/composer
@@ -0,0 +1,10 @@
 FROM php:7.3-cli
 ## Basic utilities
 RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
 ## Composer
 COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
 WORKDIR /root
 RUN sh ./install-composer.sh
 RUN mv ./composer.phar /usr/local/bin/composer
@@ -0,0 +1,10 @@
 FROM php:7.4-cli
 ## Basic utilities
 RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
 ## Composer
 COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
 WORKDIR /root
 RUN sh ./install-composer.sh
 RUN mv ./composer.phar /usr/local/bin/composer
@@ -0,0 +1,10 @@
 FROM php:8.0-cli
 ## Basic utilities
 RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
 ## Composer
 COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
 WORKDIR /root
 RUN sh ./install-composer.sh
 RUN mv ./composer.phar /usr/local/bin/composer
@@ -0,0 +1,10 @@
 FROM php:8.1-cli
 ## Basic utilities
 RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
 ## Composer
 COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
 WORKDIR /root
 RUN sh ./install-composer.sh
 RUN mv ./composer.phar /usr/local/bin/composer
@@ -0,0 +1,2 @@
 #!/bin/sh
 composer update && php ./vendor/phpunit/phpunit/phpunit
@@ -0,0 +1,17 @@
 #!/bin/sh
 EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
 php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
 ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
 if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
 then
    >&2 echo 'ERROR: Invalid installer checksum'
    rm composer-setup.php
    exit 1
 fi
 php composer-setup.php --quiet
 RESULT=$?
 rm composer-setup.php
 exit $RESULT
Author	SHA1	Message	Date
Simon Wisselink	cb95216671	Changelog	2022-07-17 00:54:20 +02:00
Simon Wisselink	d6ac3297df	Merge branch 'master' of github.com:JonisoftGermany/smarty into JonisoftGermany-master	2022-07-17 00:53:25 +02:00
Simon WisselinkandGitHub	560475a2f2	Do not use obsolete smarty properties '_dir_perms', '_file_perms', 'plugin_search_order' in our own code. (#772 )	2022-07-17 00:13:57 +02:00
Gunnar KreitzandGitHub	382d66305d	Fix PHP 8.1 htmlspecialchars deprecation (#766 )	2022-07-14 23:51:26 +02:00
Simon WisselinkandGitHub	44bac8d58c	add local testrunners for all supported PHP versions using docker. (#770 )	2022-07-14 23:50:22 +02:00
Simon Wisselink	f8e1ba76f7	Replaced outdated references to SMARTY_RESOURCE_CHAR_SET in docs with Smarty::$_CHARSET.	2022-06-15 22:12:38 +02:00
Simon Wisselink	629504485f	Add CVE to changelog	2022-05-17 14:58:05 +02:00
Simon Wisselink	71036be8be	Merge branch 'release/4.1.1'	2022-05-17 14:56:28 +02:00
Simon Wisselink	78f0cf5f65	version bump	2022-05-17 14:56:26 +02:00
Simon Wisselink	64ad6442ca	Merge branch 'security/blockfunctioninjection'	2022-05-17 14:55:47 +02:00
Stoll, Jonathan	dff1955cd5	Update to HTML5-syntax in debug template * Replace deprecated tags * Use CSS3 selectors * Update html-frame * Remove deprecated syntax * Harmonize syntax in general	2020-06-19 21:20:46 +02:00
		`@@ -0,0 +1,2 @@`
							`#!/bin/sh`
							`composer update && php ./vendor/phpunit/phpunit/phpunit`