Added some unit test to study consistent behavior on passing argument by reference.

* clean output buffer for Throwable instead of just Exception

.gitattributes

@@ -8,7 +8,9 @@
 # exclude from git export
 /tests export-ignore
 /utilities/ export-ignore
-
+/docker-compose.yml export-ignore
+/.github export-ignore
+/run_tests_for_all_php_versions.sh export-ignore
 /.gitattributes export-ignore
 /.gitignore export-ignore
 /.travis.yml export-ignore

.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+# https://help.github.com/en/categories/automating-your-workflow-with-github-actions
+
+on:
+  pull_request:
+  push:
+    branches:
+      - 'support/3.1'
+
+name: CI
+
+jobs:
+  tests:
+    name: Tests
+
+    runs-on: ${{ matrix.os }}
+
+    env:
+      PHP_EXTENSIONS: dom, json, libxml, mbstring, pdo_sqlite, soap, xml, xmlwriter
+      PHP_INI_VALUES: assert.exception=1, zend.assertions=1
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+
+        php-version:
+          - "5.3"
+          - "5.4"
+          - "5.5"
+          - "5.6"          
+          - "7.1"
+          - "7.2"
+          - "7.3"
+          - "7.4"
+
+        compiler:
+          - default
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    - name: Override PHP ini values for JIT compiler
+      if: matrix.compiler == 'jit'
+      run: echo "PHP_INI_VALUES::assert.exception=1, zend.assertions=1, opcache.enable=1, opcache.enable_cli=1, opcache.optimization_level=-1, opcache.jit=1255, opcache.jit_buffer_size=32M" >> $GITHUB_ENV
+
+    - name: Install PHP with extensions
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ matrix.php-version }}
+        coverage: pcov
+        extensions: ${{ env.PHP_EXTENSIONS }}
+        ini-values: ${{ env.PHP_INI_VALUES }}
+
+    - name: Validate composer.json and composer.lock
+      run: composer validate
+
+    - name: Cache Composer packages
+      id: composer-cache
+      uses: actions/cache@v2
+      with:
+        path: vendor
+        key: Smartyv3-${{ runner.os }}-php-${{ matrix.php-version }}-${{ hashFiles('**/composer.lock') }}
+        restore-keys: |
+          Smartyv3-${{ runner.os }}-php-${{ matrix.php-version }}-
+
+    - name: Run tests with phpunit
+      run: ./run-tests.sh

CHANGELOG.md

@@ -6,8 +6,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.1.48] - 2023-03-28
+
 ### Security
-- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-
+- Fixed Cross site scripting vulnerability in Javascript escaping.  This addresses CVE-2023-28447.
+
+### Fixed
+- Output buffer is now cleaned for internal PHP errors as well, not just for Exceptions [#514](https://github.com/smarty-php/smarty/issues/514)
+
+## [3.1.47] - 2022-09-14
+
+### Security
+- Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks [#454](https://github.com/smarty-php/smarty/issues/454)
+
+### Fixed
+- Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794)
+- Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-php/smarty/issues/395)
+- Updated requirement contraint for 'php' in composer.json to correctly reflect that Smarty3 does not support PHP8. Please upgrade to Smarty4 to use PHP8. 
+ 
+## [3.1.46] - 2022-08-01
+
+### Fixed
+- Fixed problems with smarty_mb_str_replace [#549](https://github.com/smarty-php/smarty/issues/549)
+- Fixed second parameter of unescape modifier not working [#777](https://github.com/smarty-php/smarty/issues/777)
+
+## [3.1.45] - 2022-05-17
+
+### Security
+- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221
 
 ### Fixed
 - Math equation `max(x, y)` didn't work anymore [#721](https://github.com/smarty-php/smarty/issues/721)

composer.json

@@ -27,7 +27,7 @@
         "forum": "http://www.smarty.net/forums/"
     },
     "require": {
-        "php": ">=5.2"
+        "php": "^5.2 || ^7.0"
     },
     "autoload": {
         "classmap": [

docker-compose.yml

@@ -0,0 +1,51 @@
+version: "2"
+services:
+  base:
+    build:
+      context: .
+      dockerfile: ./utilities/testrunners/php54/Dockerfile
+    volumes:
+      - .:/app
+    working_dir: /app
+    entrypoint: sh ./run-tests.sh
+  php54:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php54/Dockerfile
+  php55:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php55/Dockerfile
+  php56:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php56/Dockerfile
+  php70:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php70/Dockerfile
+  php71:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php71/Dockerfile
+  php72:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php72/Dockerfile
+  php73:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php73/Dockerfile
+  php74:
+    extends:
+      service: base
+    build:
+      dockerfile: ./utilities/testrunners/php74/Dockerfile
+

libs/Smarty.class.php

@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.44';
+    const SMARTY_VERSION = '3.1.48';
     /**
      * define variable scopes
      */

libs/plugins/function.html_select_date.php

@@ -101,6 +101,7 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
     $field_separator = "\n";
     $option_separator = "\n";
     $time = null;
+
     // $all_empty = null;
     // $day_empty = null;
     // $month_empty = null;
@@ -113,17 +114,7 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
     foreach ($params as $_key => $_value) {
         switch ($_key) {
             case 'time':
-                if (!is_array($_value) && $_value !== null) {
-                    $template->_checkPlugins(
-                        array(
-                            array(
-                                'function' => 'smarty_make_timestamp',
-                                'file'     => SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'
-                            )
-                        )
-                    );
-                    $time = smarty_make_timestamp($_value);
-                }
+                $$_key = $_value; // we'll handle conversion below
                 break;
             case 'month_names':
                 if (is_array($_value) && count($_value) === 12) {
@@ -178,43 +169,59 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
     }
     // Note: date() is faster than strftime()
     // Note: explode(date()) is faster than date() date() date()
-    if (isset($params[ 'time' ]) && is_array($params[ 'time' ])) {
-        if (isset($params[ 'time' ][ $prefix . 'Year' ])) {
+
+    if (isset($time) && is_array($time)) {
+        if (isset($time[$prefix . 'Year'])) {
             // $_REQUEST[$field_array] given
             foreach (array(
-                'Y' => 'Year',
-                'm' => 'Month',
-                'd' => 'Day'
-            ) as $_elementKey => $_elementName) {
+                         'Y' => 'Year',
+                         'm' => 'Month',
+                         'd' => 'Day'
+                     ) as $_elementKey => $_elementName) {
                 $_variableName = '_' . strtolower($_elementName);
                 $$_variableName =
-                    isset($params[ 'time' ][ $prefix . $_elementName ]) ? $params[ 'time' ][ $prefix . $_elementName ] :
+                    isset($time[$prefix . $_elementName]) ? $time[$prefix . $_elementName] :
                         date($_elementKey);
             }
-        } elseif (isset($params[ 'time' ][ $field_array ][ $prefix . 'Year' ])) {
+        } elseif (isset($time[$field_array][$prefix . 'Year'])) {
             // $_REQUEST given
             foreach (array(
-                'Y' => 'Year',
-                'm' => 'Month',
-                'd' => 'Day'
-            ) as $_elementKey => $_elementName) {
+                         'Y' => 'Year',
+                         'm' => 'Month',
+                         'd' => 'Day'
+                     ) as $_elementKey => $_elementName) {
                 $_variableName = '_' . strtolower($_elementName);
-                $$_variableName = isset($params[ 'time' ][ $field_array ][ $prefix . $_elementName ]) ?
-                    $params[ 'time' ][ $field_array ][ $prefix . $_elementName ] : date($_elementKey);
+                $$_variableName = isset($time[$field_array][$prefix . $_elementName]) ?
+                    $time[$field_array][$prefix . $_elementName] : date($_elementKey);
             }
         } else {
             // no date found, use NOW
-            list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d'));
+            list($_year, $_month, $_day) = explode('-', date('Y-m-d'));
         }
+    } elseif (isset($time) && preg_match("/(\d*)-(\d*)-(\d*)/", $time, $matches)) {
+        $_year = $_month = $_day = null;
+        if ($matches[1] > '') $_year = (int) $matches[1];
+        if ($matches[2] > '') $_month = (int) $matches[2];
+        if ($matches[3] > '') $_day = (int) $matches[3];
     } elseif ($time === null) {
         if (array_key_exists('time', $params)) {
-            $_year = $_month = $_day = $time = null;
+            $_year = $_month = $_day = null;
         } else {
-            list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d'));
+            list($_year, $_month, $_day) = explode('-', date('Y-m-d'));
         }
     } else {
-        list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d', $time));
+        $template->_checkPlugins(
+            array(
+                array(
+                    'function' => 'smarty_make_timestamp',
+                    'file'     => SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'
+                )
+            )
+        );
+        $time = smarty_make_timestamp($time);
+	    list($_year, $_month, $_day) = explode('-', date('Y-m-d', $time));
     }
+
     // make syntax "+N" or "-N" work with $start_year and $end_year
     // Note preg_match('!^(\+|\-)\s*(\d+)$!', $end_year, $match) is slower than trim+substr
     foreach (array(

libs/plugins/function.mailto.php

@@ -48,8 +48,13 @@
  */
 function smarty_function_mailto($params)
 {
-    static $_allowed_encoding =
-        array('javascript' => true, 'javascript_charcode' => true, 'hex' => true, 'none' => true);
+    static $_allowed_encoding = array(
+        'javascript' => true,
+        'javascript_charcode' => true,
+        'hex' => true,
+        'none' => true
+    );
+
     $extra = '';
     if (empty($params[ 'address' ])) {
         trigger_error("mailto: missing 'address' parameter", E_USER_WARNING);
@@ -57,11 +62,11 @@ function smarty_function_mailto($params)
     } else {
         $address = $params[ 'address' ];
     }
+
     $text = $address;
+
     // netscape and mozilla do not decode %40 (@) in BCC field (bug?)
     // so, don't encode it.
-    $search = array('%40', '%2C');
-    $replace = array('@', ',');
     $mail_parms = array();
     foreach ($params as $var => $value) {
         switch ($var) {
@@ -69,7 +74,7 @@ function smarty_function_mailto($params)
             case 'bcc':
             case 'followupto':
                 if (!empty($value)) {
-                    $mail_parms[] = $var . '=' . str_replace($search, $replace, rawurlencode($value));
+                    $mail_parms[] = $var . '=' . str_replace(array('%40', '%2C'), array('@', ','), rawurlencode($value));
                 }
                 break;
             case 'subject':
@@ -83,6 +88,7 @@ function smarty_function_mailto($params)
             default:
         }
     }
+
     if ($mail_parms) {
         $address .= '?' . join('&', $mail_parms);
     }
@@ -94,19 +100,26 @@ function smarty_function_mailto($params)
         );
         return;
     }
+
+    $flags = ENT_QUOTES;
+    if (defined('ENT_SUBSTITUTE') && defined('ENT_HTML401')) {
+        $flags |= ENT_SUBSTITUTE | ENT_HTML401;
+    }
+
+    $string = '<a href="mailto:' . htmlspecialchars($address, $flags, Smarty::$_CHARSET) .
+        '" ' . $extra . '>' . htmlspecialchars($text, $flags, Smarty::$_CHARSET) . '</a>';
+
     if ($encode === 'javascript') {
-	    $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
         $js_encode = '';
         for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
             $js_encode .= '%' . bin2hex($string[ $x ]);
         }
         return '<script type="text/javascript">document.write(unescape(\'' . $js_encode . '\'))</script>';
     } elseif ($encode === 'javascript_charcode') {
-        $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
         for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
             $ord[] = ord($string[ $x ]);
         }
-	    return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
+        return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
     } elseif ($encode === 'hex') {
         preg_match('!^(.*)(\?.*)$!', $address, $match);
         if (!empty($match[ 2 ])) {
@@ -129,6 +142,6 @@ function smarty_function_mailto($params)
         return '<a href="' . $mailto . $address_encode . '" ' . $extra . '>' . $text_encode . '</a>';
     } else {
         // no encoding
-        return '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
+        return $string;
     }
 }

libs/plugins/function.math.php

@@ -70,7 +70,7 @@ function smarty_function_math($params, $template)
     $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
     $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
     $operators = '[,+\/*\^%-]'; // Allowed math operators
-    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?1))?)+$/';
+    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)*\)|\((?1)*\)))(?:'.$operators.'(?1))?)+$/';
 
     if (!preg_match($regexp, $equation)) {
         trigger_error("math: illegal characters", E_USER_WARNING);

libs/plugins/modifier.escape.php

@@ -188,7 +188,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
                     // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                     '<!--' => '<\!--',
                     '<s'   => '<\s',
-                    '<S'   => '<\S'
+                    '<S'   => '<\S',
+	                "`" => "\\\\`",
+	                "\${" => "\\\\\\$\\{"
                 )
             );
         case 'mail':

libs/plugins/modifiercompiler.escape.php

@@ -92,7 +92,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
                 // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                 return 'strtr(' .
                        $params[ 0 ] .
-                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", 
+                       "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
+                       "`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
         }
     } catch (SmartyException $e) {
         // pass through to regular plugin fallback

libs/plugins/modifiercompiler.unescape.php

@@ -14,20 +14,28 @@
  * @author Rodney Rehm
  *
  * @param array $params parameters
+ * @param Smarty_Internal_TemplateCompilerBase $compiler
  *
  * @return string with compiled code
  */
-function smarty_modifiercompiler_unescape($params)
+function smarty_modifiercompiler_unescape($params, Smarty_Internal_TemplateCompilerBase $compiler)
 {
-    if (!isset($params[ 1 ])) {
-        $params[ 1 ] = 'html';
-    }
+    $compiler->template->_checkPlugins(
+        array(
+            array(
+                'function' => 'smarty_literal_compiler_param',
+                'file'     => SMARTY_PLUGINS_DIR . 'shared.literal_compiler_param.php'
+            )
+        )
+    );
+
+    $esc_type = smarty_literal_compiler_param($params, 1, 'html');
+
     if (!isset($params[ 2 ])) {
         $params[ 2 ] = '\'' . addslashes(Smarty::$_CHARSET) . '\'';
-    } else {
-        $params[ 2 ] = "'{$params[ 2 ]}'";
     }
-    switch (trim($params[ 1 ], '"\'')) {
+
+    switch ($esc_type) {
         case 'entity':
         case 'htmlall':
             if (Smarty::$_MBSTRING) {

libs/plugins/shared.mb_str_replace.php

@@ -44,9 +44,43 @@ if (!function_exists('smarty_mb_str_replace')) {
                 }
             }
         } else {
+            $mb_reg_charset = mb_regex_encoding();
+            // Check if mbstring regex is using UTF-8
+            $reg_is_unicode = !strcasecmp($mb_reg_charset, "UTF-8");
+            if(!$reg_is_unicode) {
+                // ...and set to UTF-8 if not
+                mb_regex_encoding("UTF-8");
+            }
+
+            // See if charset used by Smarty is matching one used by regex...
+            $current_charset = mb_regex_encoding();
+            $convert_result = (bool)strcasecmp(Smarty::$_CHARSET, $current_charset);
+            if($convert_result) {
+                // ...convert to it if not.
+                $subject = mb_convert_encoding($subject, $current_charset, Smarty::$_CHARSET);
+                $search = mb_convert_encoding($search, $current_charset, Smarty::$_CHARSET);
+                $replace = mb_convert_encoding($replace, $current_charset, Smarty::$_CHARSET);
+            }
+
             $parts = mb_split(preg_quote($search), $subject);
+            // If original regex encoding was not unicode...
+            if(!$reg_is_unicode) {
+                // ...restore original regex encoding to avoid breaking the system.
+                mb_regex_encoding($mb_reg_charset);
+            }
+            if($parts === false) {
+                // This exception is thrown if call to mb_split failed.
+                // Usually it happens, when $search or $replace are not valid for given mb_regex_encoding().
+                // There may be other cases for it to fail, please file an issue if you find a reproducible one.
+                throw new SmartyException("Source string is not a valid $current_charset sequence (probably)");
+            }
+
             $count = count($parts) - 1;
             $subject = implode($replace, $parts);
+            // Convert results back to charset used by Smarty, if needed.
+            if($convert_result) {
+                $subject = mb_convert_encoding($subject, Smarty::$_CHARSET, $current_charset);
+            }
         }
         return $subject;
     }

libs/sysplugins/smarty_internal_templatebase.php

@@ -246,7 +246,15 @@ abstract class Smarty_Internal_TemplateBase extends Smarty_Internal_Data
                 error_reporting($_smarty_old_error_level);
             }
             return $result;
-        } catch (Exception $e) {
+        } catch (Exception $e) { // PHP 5.x specific
+            while (ob_get_level() > $level) {
+                ob_end_clean();
+            }
+            if (isset($_smarty_old_error_level)) {
+                error_reporting($_smarty_old_error_level);
+            }
+            throw $e;
+        } catch (Throwable $e) { // For PHP ^7.0 this can also catch Errors
             while (ob_get_level() > $level) {
                 ob_end_clean();
             }

run-tests-for-all-php-versions.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+Help()
+{
+   # Display Help
+   echo "Runs PHPUnit tests for all PHP versions supported by this version of Smarty."
+   echo
+   echo "Syntax: $0 [-e|h]"
+   echo "options:"
+   echo "e     Exclude a group of unit tests, e.g. -e 'slow'"
+   echo "h     Print this Help."
+   echo
+}
+
+Exclude=""
+
+# Get the options
+while getopts ":he:" option; do
+   case $option in
+      e) # Exclude
+        echo $OPTARG
+         Exclude=$OPTARG;;
+      h) # display Help
+         Help
+         exit;;
+     \?) # Invalid option
+         echo "Error: Invalid option"
+         exit;;
+   esac
+done
+
+if [ -z $Exclude ];
+then
+  Entrypoint="./run-tests.sh"
+else
+   Entrypoint="./run-tests.sh $Exclude"
+fi
+
+# Runs tests for all supported PHP versions
+docker-compose run --entrypoint "$Entrypoint" php54 && \
+docker-compose run --entrypoint "$Entrypoint" php55 && \
+docker-compose run --entrypoint "$Entrypoint" php56 && \
+docker-compose run --entrypoint "$Entrypoint" php70 && \
+docker-compose run --entrypoint "$Entrypoint" php71 && \
+docker-compose run --entrypoint "$Entrypoint" php72 && \
+docker-compose run --entrypoint "$Entrypoint" php73 && \
+docker-compose run --entrypoint "$Entrypoint" php74

run-tests.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+composer update
+
+php -r 'echo "\nPHP version " . phpversion() . ". ";';
+
+if [ -z $1 ];
+then
+  echo "Running all unit tests.\n"
+  php ./vendor/phpunit/phpunit/phpunit tests
+else
+  echo "Running all unit tests, except tests marked with @group $1.\n"
+  php ./vendor/phpunit/phpunit/phpunit --exclude-group $1 tests
+fi

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionHtmlSelectDateTest.php

@@ -238,6 +238,7 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
 
         $this->years['default'] = "<option value=\"{$year}\" selected=\"selected\">{$year}</option>";
         $this->years['none'] = "<option value=\"{$year}\">{$year}</option>";
+
     }
 
     protected function reverse($string)
@@ -394,6 +395,33 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
         $this->assertEquals($result, $tpl->fetch());
     }
 
+    public function testEmptyDayWithDateString() {
+        $n = "\n";
+        $result = '<select name="Date_Month">' . $n . $this->months['default'] . $n . '</select>'
+            . $n . '<select name="Date_Day">' . $n . '<option value="">day</option>' . $n . $this->days['none'] . $n . '</select>'
+            . $n . '<select name="Date_Year">' . $n . $this->years['start_2005'] . $n . '</select>';
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time="2022-02-" day_empty="day" start_year=2005}');
+        $this->assertEquals($result, $tpl->fetch());
+    }
+
+    public function testEmptyMonthWithDateStrings() {
+        $n = "\n";
+        $result = '<select name="Date_Month">' . $n . '<option value="">month</option>' . $n . $this->months['none'] . $n . '</select>'
+            . $n . '<select name="Date_Day">' . $n . $this->days['default'] . $n . '</select>'
+            . $n . '<select name="Date_Year">' . $n . $this->years['start_2005'] . $n . '</select>';
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time="2022--20" month_empty="month" start_year=2005}');
+        $this->assertEquals($result, $tpl->fetch());
+    }
+
+    public function testEmptyYearWithDateStrings() {
+        $n = "\n";
+        $result = '<select name="Date_Month">' . $n . $this->months['default'] . $n . '</select>'
+            . $n . '<select name="Date_Day">' . $n . $this->days['default'] . $n . '</select>'
+            . $n . '<select name="Date_Year">' . $n . '<option value="">year</option>' . $n . $this->years['none'] . $n . '</select>';
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time="-02-20" year_empty="year"}');
+        $this->assertEquals($result, $tpl->fetch());
+    }
+
     public function testId()
     {
         $n = "\n";

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionMailtoTest.php

@@ -150,7 +150,7 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
 
     public function testUmlauts()
     {
-        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
+        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&amp;subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me+smtpext@example.com" cc="you@example.com,they@example.com" subject="hällo wörld"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
     }
@@ -158,9 +158,26 @@ class PluginFunctionMailtoTest extends PHPUnit_Smarty
     public function testUmlautsWithoutMbstring()
     {
         Smarty::$_MBSTRING = false;
-        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
+        $result = '<a href="mailto:me+smtpext@example.com?cc=you@example.com,they@example.com&amp;subject=h%C3%A4llo%20w%C3%B6rld" >me+smtpext@example.com</a>';
         $tpl = $this->smarty->createTemplate('eval:{mailto address="me+smtpext@example.com" cc="you@example.com,they@example.com" subject="hällo wörld"}');
         $this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;
     }
+
+	public function testJavascriptChars()
+	{
+		$result = '<script type="text/javascript">document.write(unescape(\'%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%71%75%6f%74%3b%26%67%74%3b%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%23%30%33%39%3b%29%3b%20%61%6c%65%72%74%28%26%71%75%6f%74%3b%69%6e%6a%65%63%74%69%6f%6e%26%71%75%6f%74%3b%29%3b%20%2f%2f%22%20%3e%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%71%75%6f%74%3b%26%67%74%3b%6d%65%40%65%78%61%6d%70%6c%65%2e%63%6f%6d%26%23%30%33%39%3b%29%3b%20%61%6c%65%72%74%28%26%71%75%6f%74%3b%69%6e%6a%65%63%74%69%6f%6e%26%71%75%6f%74%3b%29%3b%20%2f%2f%3c%2f%61%3e\'))</script>';
+		$this->smarty->assign('address', 'me@example.com">me@example.com\'); alert("injection"); //');
+		$tpl = $this->smarty->createTemplate('eval:{mailto address=$address encode=javascript}');
+		$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
+	}
+
+	public function testHtmlChars()
+	{
+		$result = '<a href="mailto:me@example.com&quot;&gt;&lt;h1&gt;" class="email">me@example.com&quot;&gt;&lt;h1&gt;</a>';
+		$this->smarty->assign('address', 'me@example.com"><h1>');
+		$tpl = $this->smarty->createTemplate('eval:{mailto address=$address extra=\'class="email"\'}');
+		$this->assertEquals(str_replace("\r", '', $result), $this->smarty->fetch($tpl));
+	}
+
 }

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php

@@ -207,4 +207,25 @@ class PluginModifierEscapeTest extends PHPUnit_Smarty
         $this->assertEquals("sma'rty@»example«.com", $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;
     }
+
+	public function testTemplateLiteralBackticks()
+	{
+		$tpl = $this->smarty->createTemplate('string:{"`Hello, World!`"|escape:"javascript"}');
+		$this->assertEquals("\\`Hello, World!\\`", $this->smarty->fetch($tpl));
+	}
+
+	public function testTemplateLiteralInterpolation()
+	{
+		$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
+		$this->smarty->assign('vector', "`Hello, \${name}!`");
+		$this->assertEquals("\\`Hello, \\\$\\{name}!\\`", $this->smarty->fetch($tpl));
+	}
+
+	public function testTemplateLiteralBackticksAndInterpolation()
+	{
+		$this->smarty->assign('vector', '`${alert(`Hello, ${name}!`)}${`\n`}`');
+		$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
+		$this->assertEquals("\\`\\\$\\{alert(\\`Hello, \\\$\\{name}!\\`)}\\\$\\{\\`\\\\n\\`}\\`", $this->smarty->fetch($tpl));
+	}
+
 }

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierUnescapeTest.php

@@ -63,6 +63,11 @@ class PluginModifierUnescapeTest extends PHPUnit_Smarty
         $tpl = $this->smarty->createTemplate('string:{"' . $encoded . '"|unescape:"url"}');
         $this->assertEquals($result, $this->smarty->fetch($tpl));
     }
-}
 
-?>
+    public function testCharset()
+    {
+        $tpl = $this->smarty->createTemplate("string:{''Stiff Opposition Expected to Casketless Funeral Plan''|unescape:'htmlall':'utf-8'}");
+        $this->assertEquals("'Stiff Opposition Expected to Casketless Funeral Plan'", $this->smarty->fetch($tpl));
+    }
+
+}

tests/UnitTests/TemplateSource/ValueTests/Math/MathTest.php

@@ -162,4 +162,12 @@ class MathTest extends PHPUnit_Smarty
 		$this->assertEquals($expected, $this->smarty->fetch($tpl));
 	}
 
+	public function testRand()
+	{
+		$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{math equation="x * rand()" x=$x}');
+		// this assertion may seem silly, but it serves to prove that using rand() without a parameter
+		// will not trigger a security error (see https://github.com/smarty-php/smarty/issues/794)
+		$this->assertEquals("0", $this->smarty->fetch($tpl));
+	}
+
 }

tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore

@@ -0,0 +1,2 @@
+# Ignore anything in here, but keep this directory
+*

tests/UnitTests/TemplateSource/_Issues/549/MbSplitEncodingIssue549Test.php

@@ -0,0 +1,77 @@
+<?php
+/**
+ * Smarty PHPunit tests - issue #549 regression tests
+ *
+ * @package PHPunit
+ * @author  Andrey Repin <anrdaemon@yandex.ru>
+ */
+
+/**
+ * class for compiler tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState    disabled
+ * @backupStaticAttributes enabled
+ *
+ * mb_split breaks if Smarty encoding is not the same as mbstring regex encoding.
+ */
+class MbSplitEncodingIssue549Test extends PHPUnit_Smarty
+{
+    /** @var string Saved Smarty charset */
+    private $charset;
+
+    /** @var array Source data for tests, hexed to protect from accidental reencoding */
+    private $data = array(
+        "subject" => '4772c3bc6e6577616c64', // "Grünewald"
+        "pattern" => '77616c64', // "wald"
+        "replacement" => '7374c3bc726d', // "stürm"
+        "result" => '4772c3bc6e657374c3bc726d', // "Grünestürm"
+    );
+
+    public function setUp()
+    {
+        if(!\Smarty::$_MBSTRING)
+        {
+            return $this->markTestSkipped("mbstring extension is not in use by Smarty");
+        }
+
+        $this->charset = \Smarty::$_CHARSET;
+        $this->setUpSmarty(dirname(__FILE__));
+    }
+
+    public function tearDown()
+    {
+        \Smarty::$_CHARSET = $this->charset ?: \Smarty::$_CHARSET;
+        $this->cleanDirs();
+    }
+
+    /** Provider for testReplaceModifier
+     */
+    public function encodingPairsProvider()
+    {
+        return array(
+            "with non-UNICODE src/non-UNICODE regex (PHP < 5.6 default)" => array("Windows-1252", "EUC-JP"),
+            "with UTF-8 src/non-UNICODE regex (PHP < 5.6 default)" => array("UTF-8", "EUC-JP"),
+            "with UTF-8 src/UTF-8 regex (PHP >= 5.6)" => array("UTF-8", "UTF-8"),
+            "with non-UNICODE src/UTF-8 regex" => array("Windows-1252", "UTF-8"),
+        );
+    }
+
+    /** Test behavior of `replace` modifier with different source and regex encodings
+     *
+     * @dataProvider encodingPairsProvider
+     */
+    public function testReplaceModifier($mb_int_encoding, $mb_regex_encoding)
+    {
+        $data = $this->data;
+        \array_walk($data, function(&$value, $key) use($mb_int_encoding) {
+            $value = \mb_convert_encoding(pack("H*", $value), $mb_int_encoding, "UTF-8");
+        });
+        \extract($data, \EXTR_SKIP);
+
+        \mb_regex_encoding($mb_regex_encoding);
+        \Smarty::$_CHARSET = $mb_int_encoding;
+        $this->assertEquals($result, $this->smarty->fetch("string:{\"$subject\"|replace:\"$pattern\":\"$replacement\"}"));
+    }
+
+}

tests/UnitTests/TemplateSource/_Issues/549/cache/.gitignore

@@ -0,0 +1,2 @@
+# Ignore anything in here, but keep this directory
+*

tests/UnitTests/TemplateSource/_Issues/549/templates_c/.gitignore

@@ -0,0 +1,2 @@
+# Ignore anything in here, but keep this directory
+*

tests/UnitTests/TemplateSource/_Issues/ArgumentMustBePassedByReference961Test.php

@@ -0,0 +1,65 @@
+<?php
+
+class ArgumentMustBePassedByReference961Test extends PHPUnit_Smarty
+{
+
+	/**
+	 * @group issue961
+	 */
+	public function testReset()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'reset', 'reset');
+		$templateStr = "string:{reset(\$ar)}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'1',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 */
+	public function testResetAsModifier()
+	{
+		$smarty = new Smarty();
+		$templateStr = "string:{\$ar|reset}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'1',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 */
+	public function testResetInExpression()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'reset', 'reset');
+		$templateStr = "string:{if reset(\$ar)}ok{/if}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'ok',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 * @deprecated
+	 */
+	public function testMatch()
+	{
+		$smarty = new Smarty();
+		$smarty->setErrorReporting(E_ALL & ~ E_USER_DEPRECATED);
+		$smarty->registerPlugin('modifier', 'preg_match', 'preg_match');
+		$templateStr = 'string:{assign var="match" value=null}{if preg_match(\'/([a-z]{4})/\', "a test", $match)}{$match.1}{/if}';
+		$this->assertEquals(
+			'test',
+			$smarty->fetch($templateStr)
+		);
+	}
+}

utilities/testrunners/php54/Dockerfile

@@ -0,0 +1,13 @@
+FROM php:5.4-cli
+
+## Upgrade CA certificates
+RUN curl -k https://curl.se/ca/cacert.pem > cacert.crt && cp cacert.crt /usr/local/share/ca-certificates/ && update-ca-certificates
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install --force-yes -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php55/Dockerfile

@@ -0,0 +1,13 @@
+FROM php:5.5-cli
+
+## Upgrade CA certificates
+RUN curl -k https://curl.se/ca/cacert.pem > cacert.crt && cp cacert.crt /usr/local/share/ca-certificates/ && update-ca-certificates
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install --force-yes -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php56/Dockerfile

@@ -0,0 +1,13 @@
+FROM php:5.6-cli
+
+## Upgrade CA certificates
+RUN curl -k https://curl.se/ca/cacert.pem > cacert.crt && cp cacert.crt /usr/local/share/ca-certificates/ && update-ca-certificates
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install --force-yes -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php70/Dockerfile

@@ -0,0 +1,10 @@
+FROM php:7.0-cli
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php71/Dockerfile

@@ -0,0 +1,10 @@
+FROM php:7.1-cli
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php72/Dockerfile

@@ -0,0 +1,10 @@
+FROM php:7.2-cli
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php73/Dockerfile

@@ -0,0 +1,10 @@
+FROM php:7.3-cli
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/php74/Dockerfile

@@ -0,0 +1,10 @@
+FROM php:7.4-cli
+
+## Basic utilities
+RUN apt-get update -yqq && apt-get install -y curl apt-utils git zip unzip
+
+## Composer
+COPY ./utilities/testrunners/shared/install-composer.sh /root/install-composer.sh
+WORKDIR /root
+RUN sh ./install-composer.sh
+RUN mv ./composer.phar /usr/local/bin/composer

utilities/testrunners/run-test.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+composer update && php ./vendor/phpunit/phpunit/phpunit -c phpunit.xml tests

utilities/testrunners/shared/install-composer.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
+php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
+ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
+
+if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
+then
+    >&2 echo 'ERROR: Invalid installer checksum'
+    rm composer-setup.php
+    exit 1
+fi
+
+php composer-setup.php --quiet
+RESULT=$?
+rm composer-setup.php
+exit $RESULT