Fixed logic error in this changed if statement

CHANGELOG.md

@@ -6,19 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [3.1.40] - 2021-10-13
-
-### Changed
-- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649
-
-### Security
-- More advanced javascript escaping to handle https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks to m-haritonov
-
 ## [3.1.39] - 2021-02-17
 
 ### Security
-- Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
-- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120.
+- Prevent access to `$smarty.template_object` in sandbox mode
+- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}` 
 
 ## [3.1.38] - 2021-01-08
 

README.md

@@ -18,7 +18,7 @@ Smarty can be run with PHP 5.2 to PHP 7.4.
 
 > Read the NEW_FEATURES and INHERITANCE_RELEASE_NOTES file for recent extensions to Smarty 3.1 functionality
 
-Smarty versions 3.1.11 or later are now on GitHub and can be installed with Composer.
+Smarty versions 3.1.11 or later are now on github and can be installed with Composer.
 
 
 The "smarty/smarty" package will start at libs/....   subfolder.

SECURITY.md

@@ -1,19 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Smarty currently supports the latest minor version of Smarty 3 and Smarty 4. (Smarty 4 has not been released yet.)
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 4.0.x   | :white_check_mark: |
-| 3.1.x   | :white_check_mark: |
-| < 3.1   | :x:                |
-
-## Reporting a Vulnerability
-
- If you have discovered a security issue with Smarty, please contact us at mail [at] simonwisselink.nl. Do not 
- disclose your findings publicly and PLEASE PLEASE do not file an Issue.
- 
-We will try to confirm the vulnerability and develop a fix if appropriate. When we release the fix, we will publish 
-a security release. Please let us know if you want to be credited.

libs/Smarty.class.php

@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.40';
+    const SMARTY_VERSION = '3.1.39';
     /**
      * define variable scopes
      */

libs/plugins/modifier.escape.php

@@ -184,11 +184,7 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
                     '"'  => '\\"',
                     "\r" => '\\r',
                     "\n" => '\\n',
-                    '</' => '<\/',
-                    // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
-                    '<!--' => '<\!--',
-                    '<s'   => '<\s',
-                    '<S'   => '<\S'
+                    '</' => '<\/'
                 )
             );
         case 'mail':
@@ -254,7 +250,6 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
             }
             return $return;
         default:
-            trigger_error("escape: unsupported type: $esc_type - returning unmodified string", E_USER_NOTICE);
             return $string;
     }
 }

libs/plugins/modifiercompiler.escape.php

@@ -89,10 +89,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
                 return 'preg_replace("%(?<!\\\\\\\\)\'%", "\\\'",' . $params[ 0 ] . ')';
             case 'javascript':
                 // escape quotes and backslashes, newlines, etc.
-                // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                 return 'strtr(' .
                        $params[ 0 ] .
-                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/" ))';
         }
     } catch (SmartyException $e) {
         // pass through to regular plugin fallback

libs/sysplugins/smarty_internal_resource_file.php

@@ -37,7 +37,8 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
                 $source->filepath . ($source->isConfig ? $source->smarty->_joined_config_dir :
                     $source->smarty->_joined_template_dir)
             );
-            $source->timestamp = filemtime($source->filepath);
+            // When not doing compile_check, set timestamp to true
+            $source->timestamp = $source->smarty->compile_check ? filemtime($source->filepath) : true;
         } else {
             $source->timestamp = $source->exists = false;
         }
@@ -50,6 +51,10 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
      */
     public function populateTimestamp(Smarty_Template_Source $source)
     {
+        if (!$source->smarty->compile_check) {
+            $source->timestamp =  $source->exists = true;
+            return;
+        }
         if (!$source->exists) {
             $source->timestamp = $source->exists = is_file($source->filepath);
         }
@@ -68,13 +73,15 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
      */
     public function getContent(Smarty_Template_Source $source)
     {
-        if ($source->exists) {
-            return file_get_contents($source->filepath);
+        if (($source->smarty->compile_check && !$source->exists)
+            || false === ($content = file_get_contents($source->filepath))
+        ) {
+            throw new SmartyException(
+                'Unable to read ' . ($source->isConfig ? 'config' : 'template') .
+                " {$source->type} '{$source->name}'"
+            );
         }
-        throw new SmartyException(
-            'Unable to read ' . ($source->isConfig ? 'config' : 'template') .
-            " {$source->type} '{$source->name}'"
-        );
+        return $content;
     }
 
     /**
@@ -126,6 +133,17 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
             $file = str_replace(DIRECTORY_SEPARATOR === '/' ? '\\' : '/', DIRECTORY_SEPARATOR, $file);
         }
         $_directories = $source->smarty->getTemplateDir(null, $source->isConfig);
+
+        // If possible, assume the file exists when compile_check = false;
+        if (!$source->smarty->compile_check
+            && count($_directories) == 1    // if there are multiple directories, we'll have to scan them
+            && $file[ 0 ] !== '['           // template_dir index
+            && !$source->smarty->use_include_path // cannot optimize when we need to use include path
+        ) {
+            $path = reset($_directories) . $file;
+            return (strpos($path, '.' . DIRECTORY_SEPARATOR) !== false) ? $source->smarty->_realpath($path) : $path;
+        }
+
         // template_dir index?
         if ($file[ 0 ] === '[' && preg_match('#^\[([^\]]+)\](.+)$#', $file, $fileMatch)) {
             $file = $fileMatch[ 2 ];
@@ -157,6 +175,7 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
                 $_directories = $_index_dirs;
             }
         }
+
         // relative file name?
         foreach ($_directories as $_directory) {
             $path = $_directory . $file;

libs/sysplugins/smarty_template_compiled.php

@@ -74,9 +74,14 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
             $this->filepath .= '.cache';
         }
         $this->filepath .= '.php';
-        $this->timestamp = $this->exists = is_file($this->filepath);
-        if ($this->exists) {
-            $this->timestamp = filemtime($this->filepath);
+
+        if ($smarty->compile_check) {
+            $this->timestamp = $this->exists = is_file($this->filepath);
+            if ($this->exists) {
+                $this->timestamp = filemtime($this->filepath);
+            }
+        } else {
+            $this->timestamp = $this->exists = true;
         }
     }
 
@@ -135,8 +140,9 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
         if ($source->handler->recompiled) {
             $source->handler->process($_smarty_tpl);
         } elseif (!$source->handler->uncompiled) {
-            if (!$this->exists || $smarty->force_compile
-                || ($_smarty_tpl->compile_check && $source->getTimeStamp() > $this->getTimeStamp())
+            if (
+                $smarty->force_compile ||
+                ($_smarty_tpl->compile_check && (!$this->exists || ($source->getTimeStamp() > $this->getTimeStamp())))
             ) {
                 $this->compileTemplateSource($_smarty_tpl);
                 $compileCheck = $_smarty_tpl->compile_check;