switch from @count() to empty(). Empty checks if the value is set where as count doesn't and causes errors. Similar to 305bf858c1 (#681)

allow StdClass to be cast to array when compiling foreach, to prevent invalid count warning in PHP 7.2+

.gitattributes

@@ -1,7 +1,11 @@
-* text=auto !eol
-docs/chm/make_chm_spc.gif -text
-docs/fop/thryb.ttf -text
-docs/fop/thrybi.ttf -text
-docs/fop/thryi.ttf -text
-docs/fop/thryn.ttf -text
-misc/smarty_icon.gif -text
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# exclude from git export
+/travis.ini export-ignore
+/myconfig.ini export-ignore
+/.travis.yml export-ignore
+/.gitignore export-ignore
+/.gitattributes export-ignore
+/lexer/ export-ignore
+/utilities/ export-ignore

.gitignore

@@ -1,19 +1,9 @@
-docs/*.cache
-docs/*.fot
-docs/Makefile
-docs/chm/*.chm
-docs/chm/*.hh?
-docs/chm/fancy
-docs/config.*
-docs/configure
-docs/diff
-docs/dsssl/html-common.dsl
-docs/entities/file-entities.ent
-docs/entities/version.ent
-docs/html
-docs/manual.pdf
-docs/manual.xml
-docs/phpweb
-docs/revcheck.html
-docs/scripts/file-entities.php
-/templates_c
+
+.idea/
+# Smarty
+lexer/*.php
+lexer/*.php.bak
+lexer/*.out
+utilies/*.php
+/composer.lock
+/vendor

ChangeLog

@@ -1,3 +1,43 @@
+===== 2.6.31  ===
+2017-11-03
+    * replace functions deprecated in PHP 7.2
+
+
+2016-09-11  Uwe Tews
+    * {math} fix parameter checking order to avoid misleading message
+    * {math} replace wrong versiom
+
+2016-07-19  Uwe Tews
+    * {math} shell injection vulnerability patch provided by Tim Weber
+    
+2015-12-30  Uwe Tews
+
+    * fixed plugin filepath cache must not be static, because of possible problem
+      when using multiple Smarty instances with diffrent plugins_dir settings
+         https://github.com/smarty-php/smarty/issues/146 
+
+2015-06-21  Uwe Tews
+
+    * PHP7 raises E_DEPRECATED use __construct for compatibility 
+
+2013-09-30
+
+    * Fixed old vulnerability bug https://bugs.gentoo.org/show_bug.cgi?id=356615
+
+2013-07-16  Uwe Tews
+
+    * Fixed made Smarty_Compiler.class.php compatible with PHP 5.5
+
+
+2012-09-24  Uwe Tews
+
+    * Fixed  escape Smarty error messages to avoid possible script execution
+
+    
+2010-04-17  Uwe Tews
+
+    * Fixed security hole in {math} plugin
+    
 2007-09-27  TAKAGI Masahiro  <matakagi@gmail.com>
 
     * docs/ja/designers/language-custom-functions/language-function-html-checkboxes.xml:
@@ -752,7 +792,7 @@
       docs/fr/programmers/plugins/plugins-inserts.xml:
       sync with EN
 
-2006-10-14  Fernando Correa da Conceição  <fernando_conceicao@yahoo.com.br>
+2006-10-14  Fernando Correa da Concei��o  <fernando_conceicao@yahoo.com.br>
 
     * docs/pt_BR/programmers/api-variables/variable-error-reporting.xml:
       New Translation
@@ -4293,7 +4333,7 @@
       fixed bug in _run_mod_handler
 
     * libs/Smarty_Compiler.class.php:
-      fixed bug with autoload-handling of modifiers. thanks ándre.
+      fixed bug with autoload-handling of modifiers. thanks �ndre.
 
 2003-08-05  Messju Mohr  <messju@lammfellpuschen.de>
 

NEWS

@@ -1,3 +1,6 @@
+- revert super global access changes, and instead rely on
+  USE_SUPER_GLOBALS for security
+
 Version 2.6.25 (May 19th, 2009)
 -------------------------------
 - fix E_NOTICE when sessions are disabled (mohrt)

README.md

@@ -1,5 +1,5 @@
-#Smarty 2 template engine
-##Distribution repository
+# Smarty 2 template engine
+## Distribution repository
 Starting with Smarty 2.6.23 Composer has been configured to load the packages from github.
  
 **NOTE: Because of this change you must clear your local composer cache with the "composer clearcache" command**

libs/Config_File.class.php

@@ -73,7 +73,7 @@ class Config_File {
      *
      * @param string $config_path (optional) path to the config files
      */
-    function Config_File($config_path = NULL)
+    public function __construct($config_path = NULL)
     {
         if (isset($config_path))
             $this->set_path($config_path);

libs/Smarty.class.php

@@ -20,14 +20,14 @@
  *
  * For questions, help, comments, discussion, etc., please join the
  * Smarty mailing list. Send a blank e-mail to
- * smarty-discussion-subscribe@googlegroups.com 
+ * smarty-discussion-subscribe@googlegroups.com
  *
  * @link http://www.smarty.net/
  * @copyright 2001-2005 New Digital Group, Inc.
  * @author Monte Ohrt <monte at ohrt dot com>
  * @author Andrei Zmievski <andrei@php.net>
  * @package Smarty
- * @version 2.6.25-dev
+ * @version 2.6.31-dev
  */
 
 /* $Id$ */
@@ -465,7 +465,7 @@ class Smarty
      *
      * @var string
      */
-    var $_version              = '2.6.25-dev';
+    var $_version              = '2.6.31';
 
     /**
      * current template inclusion depth
@@ -563,33 +563,19 @@ class Smarty
     var $_cache_including = false;
 
     /**
-     * array of super globals internally
+     * plugin filepath cache
      *
      * @var array
      */
-    var $_supers = array();
-
-
+    var $_filepaths_cache = array();
     /**#@-*/
     /**
      * The class constructor.
      */
-    function Smarty()
+    public function __construct()
     {
       $this->assign('SCRIPT_NAME', isset($_SERVER['SCRIPT_NAME']) ? $_SERVER['SCRIPT_NAME']
                     : @$GLOBALS['HTTP_SERVER_VARS']['SCRIPT_NAME']);
-                    
-      $this->_supers['get'] = $this->request_use_auto_globals ? $_GET : $GLOBALS['HTTP_GET_VARS'];
-      $this->_supers['post'] = $this->request_use_auto_globals ? $_POST : $GLOBALS['HTTP_POST_VARS'];
-      $this->_supers['server'] = $this->request_use_auto_globals ? $_SERVER : $GLOBALS['HTTP_SERVER_VARS'];
-      if(isset($_SESSION))
-        $this->_supers['session'] = $this->request_use_auto_globals ? $_SESSION : $GLOBALS['HTTP_SESSION_VARS'];
-      else
-        $this->_supers['session'] = array();
-      $this->_supers['request'] = $this->request_use_auto_globals ? $_REQUEST : $GLOBALS['HTTP_REQUEST_VARS'];
-      $this->_supers['cookies'] = $this->request_use_auto_globals ? $_COOKIE : $GLOBALS['HTTP_COOKIE_VARS'];
-      $this->_supers['env'] = $this->request_use_auto_globals ? $_ENV : $GLOBALS['HTTP_ENV_VARS'];
-                    
     }
 
     /**
@@ -1078,7 +1064,7 @@ class Smarty
         } else {
             // var non-existant, return valid reference
             $_tmp = null;
-            return $_tmp;   
+            return $_tmp;
         }
     }
 
@@ -1110,7 +1096,8 @@ class Smarty
      */
     function trigger_error($error_msg, $error_type = E_USER_WARNING)
     {
-        trigger_error("Smarty error: $error_msg", $error_type);
+        $msg = htmlentities($error_msg);
+        trigger_error("Smarty error: $msg", $error_type);
     }
 
 
@@ -1137,7 +1124,7 @@ class Smarty
     function fetch($resource_name, $cache_id = null, $compile_id = null, $display = false)
     {
         static $_cache_info = array();
-        
+
         $_smarty_old_error_level = $this->debugging ? error_reporting() : error_reporting(isset($this->error_reporting)
                ? $this->error_reporting : error_reporting() & ~E_NOTICE);
 
@@ -1221,7 +1208,7 @@ class Smarty
                         $_server_vars = ($this->request_use_auto_globals) ? $_SERVER : $GLOBALS['HTTP_SERVER_VARS'];
                         $_last_modified_date = @substr($_server_vars['HTTP_IF_MODIFIED_SINCE'], 0, strpos($_server_vars['HTTP_IF_MODIFIED_SINCE'], 'GMT') + 3);
                         $_gmt_mtime = gmdate('D, d M Y H:i:s', $this->_cache_info['timestamp']).' GMT';
-                        if (@count($this->_cache_info['insert_tags']) == 0
+                        if (empty($this->_cache_info['insert_tags'])
                             && !$this->_cache_serials
                             && $_gmt_mtime == $_last_modified_date) {
                             if (php_sapi_name()=='cgi')
@@ -1953,10 +1940,10 @@ class Smarty
     {
         return eval($code);
     }
-    
+
     /**
      * Extracts the filter name from the given callback
-     * 
+     *
      * @param callback $function
      * @return string
      */
@@ -1971,7 +1958,7 @@ class Smarty
 			return $function;
 		}
 	}
-  
+
     /**#@-*/
 
 }

libs/Smarty_Compiler.class.php

@@ -78,7 +78,7 @@ class Smarty_Compiler extends Smarty {
     /**
      * The class constructor.
      */
-    function Smarty_Compiler()
+    public function __construct()
     {
         // matches double quoted strings:
         // "foobar"
@@ -259,14 +259,9 @@ class Smarty_Compiler extends Smarty {
 
         preg_match_all($search, $source_content, $match,  PREG_SET_ORDER);
         $this->_folded_blocks = $match;
-        reset($this->_folded_blocks);
 
         /* replace special blocks by "{php}" */
-        $source_content = preg_replace($search.'e', "'"
-                                       . $this->_quote_replace($this->left_delimiter) . 'php'
-                                       . "' . str_repeat(\"\n\", substr_count('\\0', \"\n\")) .'"
-                                       . $this->_quote_replace($this->right_delimiter)
-                                       . "'"
+        $source_content = preg_replace_callback($search, array($this,'_preg_callback')
                                        , $source_content);
 
         /* Gather all template tags. */
@@ -556,7 +551,7 @@ class Smarty_Compiler extends Smarty {
 
             case 'php':
                 /* handle folded tags replaced by {php} */
-                list(, $block) = each($this->_folded_blocks);
+                $block = array_shift($this->_folded_blocks);
                 $this->_current_line_no += substr_count($block[0], "\n");
                 /* the number of matched elements in the regexp in _compile_file()
                    determins the type of folded tag that was found */
@@ -754,7 +749,12 @@ class Smarty_Compiler extends Smarty {
         return true;
     }
 
-
+    function _preg_callback ($matches) {
+    return $this->_quote_replace($this->left_delimiter)
+           . 'php'
+           . str_repeat("\n", substr_count($matches[1], "\n"))
+           . $this->_quote_replace($this->right_delimiter);
+    }
     /**
      * compile custom function tag
      *
@@ -1192,7 +1192,7 @@ class Smarty_Compiler extends Smarty {
         }
 
         $output = '<?php ';
-        $output .= "\$_from = $from; if (!is_array(\$_from) && !is_object(\$_from)) { settype(\$_from, 'array'); }";
+        $output .= "\$_from = $from; if ((\$_from instanceof StdClass) || (!is_array(\$_from) && !is_object(\$_from))) { settype(\$_from, 'array'); }";
         if (isset($name)) {
             $foreach_props = "\$this->_foreach[$name]";
             $output .= "{$foreach_props} = array('total' => count(\$_from), 'iteration' => 0);\n";
@@ -2047,27 +2047,57 @@ class Smarty_Compiler extends Smarty {
                 break;
 
             case 'get':
-                $compiled_ref = "\$this->_supers['get']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_GET";
                 break;
 
             case 'post':
-                $compiled_ref = "\$this->_supers['post']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_POST";
                 break;
 
             case 'cookies':
-                $compiled_ref = "\$this->_supers['cookies']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_COOKIE";
                 break;
 
             case 'env':
-                $compiled_ref = "\$this->_supers['env']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_ENV";
                 break;
 
             case 'server':
-                $compiled_ref = "\$this->_supers['server']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_SERVER";
                 break;
 
             case 'session':
-                $compiled_ref = "\$this->_supers['session']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_SESSION";
                 break;
 
             /*
@@ -2075,8 +2105,13 @@ class Smarty_Compiler extends Smarty {
              * compiler.
              */
             case 'request':
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
                 if ($this->request_use_auto_globals) {
-                    $compiled_ref = "\$this->_supers['request']";
+                    $compiled_ref = "\$_REQUEST";
                     break;
                 } else {
                     $this->_init_smarty_vars = true;
@@ -2087,7 +2122,7 @@ class Smarty_Compiler extends Smarty {
                 return null;
 
             case 'template':
-                $compiled_ref = "'$this->_current_file'";
+                $compiled_ref = "'" . addslashes($this->_current_file) . "'";
                 $_max_index = 1;
                 break;
 

libs/internals/core.assemble_plugin_filepath.php

@@ -14,11 +14,9 @@
  */
 function smarty_core_assemble_plugin_filepath($params, &$smarty)
 {
-    static $_filepaths_cache = array();
-
     $_plugin_filename = $params['type'] . '.' . $params['name'] . '.php';
-    if (isset($_filepaths_cache[$_plugin_filename])) {
-        return $_filepaths_cache[$_plugin_filename];
+    if (isset($smarty->_filepaths_cache[$_plugin_filename])) {
+        return $smarty->_filepaths_cache[$_plugin_filename];
     }
     $_return = false;
 
@@ -58,7 +56,7 @@ function smarty_core_assemble_plugin_filepath($params, &$smarty)
             }
         }
     }
-    $_filepaths_cache[$_plugin_filename] = $_return;
+    $smarty->_filepaths_cache[$_plugin_filename] = $_return;
     return $_return;
 }
 

libs/plugins/function.cycle.php

@@ -63,7 +63,11 @@ function smarty_function_cycle($params, &$smarty)
         $cycle_vars[$name]['values'] = $params['values'];
     }
 
-    $cycle_vars[$name]['delimiter'] = (isset($params['delimiter'])) ? $params['delimiter'] : ',';
+    if (isset($params['delimiter'])) {
+        $cycle_vars[$name]['delimiter'] = $params['delimiter'];
+    } elseif (!isset($cycle_vars[$name]['delimiter'])) {
+        $cycle_vars[$name]['delimiter'] = ',';       
+    }
     
     if(is_array($cycle_vars[$name]['values'])) {
         $cycle_array = $cycle_vars[$name]['values'];

libs/plugins/function.fetch.php

@@ -181,12 +181,12 @@ function smarty_function_fetch($params, &$smarty)
                         $content .= fgets($fp,4096);
                     }
                     fclose($fp);
-                    $csplit = split("\r\n\r\n",$content,2);
+                    $csplit = preg_split("!\r\n\r\n!",$content,2);
 
                     $content = $csplit[1];
 
                     if(!empty($params['assign_headers'])) {
-                        $smarty->assign($params['assign_headers'],split("\r\n",$csplit[0]));
+                        $smarty->assign($params['assign_headers'],preg_split("!\r\n!",$csplit[0]));
                     }
                 }
             } else {

libs/plugins/function.math.php

@@ -1,85 +1,109 @@
 <?php
 /**
  * Smarty plugin
- * @package Smarty
- * @subpackage plugins
+ * This plugin is only for Smarty2 BC
+ *
+ * @package    Smarty
+ * @subpackage PluginsFunction
  */
 
-
 /**
  * Smarty {math} function plugin
- *
  * Type:     function<br>
  * Name:     math<br>
- * Purpose:  handle math computations in template<br>
- * @link http://smarty.php.net/manual/en/language.function.math.php {math}
- *          (Smarty online manual)
+ * Purpose:  handle math computations in template
+ *
+ * @link     http://www.smarty.net/manual/en/language.function.math.php {math}
+ *           (Smarty online manual)
  * @author   Monte Ohrt <monte at ohrt dot com>
- * @param array
+ *
+ * @param array                    $params   parameters
  * @param Smarty
- * @return string
+ *
+ * @return string|null
  */
 function smarty_function_math($params, &$smarty)
 {
+    static $_allowed_funcs =
+        array('int' => true, 'abs' => true, 'ceil' => true, 'cos' => true, 'exp' => true, 'floor' => true,
+              'log' => true, 'log10' => true, 'max' => true, 'min' => true, 'pi' => true, 'pow' => true, 'rand' => true,
+              'round' => true, 'sin' => true, 'sqrt' => true, 'srand' => true, 'tan' => true);
     // be sure equation parameter is present
-    if (empty($params['equation'])) {
-        $smarty->trigger_error("math: missing equation parameter");
+    if (empty($params[ 'equation' ])) {
+        trigger_error("math: missing equation parameter", E_USER_WARNING);
+
         return;
     }
 
-    // strip out backticks, not necessary for math
-    $equation = str_replace('`','',$params['equation']);
+    $equation = $params[ 'equation' ];
 
     // make sure parenthesis are balanced
-    if (substr_count($equation,"(") != substr_count($equation,")")) {
-        $smarty->trigger_error("math: unbalanced parenthesis");
+    if (substr_count($equation, "(") != substr_count($equation, ")")) {
+        trigger_error("math: unbalanced parenthesis", E_USER_WARNING);
+
         return;
     }
 
+    // disallow backticks
+    if (strpos($equation, '`') !== false) {
+        trigger_error("math: backtick character not allowed in equation", E_USER_WARNING);
+
+        return;
+    }
+
+    // also disallow dollar signs
+    if (strpos($equation, '$') !== false) {
+        trigger_error("math: dollar signs not allowed in equation", E_USER_WARNING);
+
+        return;
+    }
+
+    foreach ($params as $key => $val) {
+        if ($key != "equation" && $key != "format" && $key != "assign") {
+            // make sure value is not empty
+            if (strlen($val) == 0) {
+                trigger_error("math: parameter '{$key}' is empty", E_USER_WARNING);
+
+                return;
+            }
+            if (!is_numeric($val)) {
+                trigger_error("math: parameter '{$key}' is not numeric", E_USER_WARNING);
+
+                return;
+            }
+        }
+    }
+
     // match all vars in equation, make sure all are passed
-    preg_match_all("!(?:0x[a-fA-F0-9]+)|([a-zA-Z][a-zA-Z0-9_]+)!",$equation, $match);
-    $allowed_funcs = array('int','abs','ceil','cos','exp','floor','log','log10',
-                           'max','min','pi','pow','rand','round','sin','sqrt','srand','tan');
-    
-    foreach($match[1] as $curr_var) {
-        if ($curr_var && !in_array($curr_var, array_keys($params)) && !in_array($curr_var, $allowed_funcs)) {
-            $smarty->trigger_error("math: function call $curr_var not allowed");
+    preg_match_all('!(?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*)!', $equation, $match);
+
+    foreach ($match[ 1 ] as $curr_var) {
+        if ($curr_var && !isset($params[ $curr_var ]) && !isset($_allowed_funcs[ $curr_var ])) {
+            trigger_error("math: function call '{$curr_var}' not allowed, or missing parameter '{$curr_var}'", E_USER_WARNING);
+
             return;
         }
     }
 
-    foreach($params as $key => $val) {
+    foreach ($params as $key => $val) {
         if ($key != "equation" && $key != "format" && $key != "assign") {
-            // make sure value is not empty
-            if (strlen($val)==0) {
-                $smarty->trigger_error("math: parameter $key is empty");
-                return;
-            }
-            if (!is_numeric($val)) {
-                $smarty->trigger_error("math: parameter $key: is not numeric");
-                return;
-            }
             $equation = preg_replace("/\b$key\b/", " \$params['$key'] ", $equation);
         }
     }
+    $smarty_math_result = null;
+    eval("\$smarty_math_result = " . $equation . ";");
 
-    eval("\$smarty_math_result = ".$equation.";");
-
-    if (empty($params['format'])) {
-        if (empty($params['assign'])) {
+    if (empty($params[ 'format' ])) {
+        if (empty($params[ 'assign' ])) {
             return $smarty_math_result;
         } else {
-            $smarty->assign($params['assign'],$smarty_math_result);
+            $smarty->assign($params[ 'assign' ], $smarty_math_result);
         }
     } else {
-        if (empty($params['assign'])){
-            printf($params['format'],$smarty_math_result);
+        if (empty($params[ 'assign' ])) {
+            printf($params[ 'format' ], $smarty_math_result);
         } else {
-            $smarty->assign($params['assign'],sprintf($params['format'],$smarty_math_result));
+            $smarty->assign($params[ 'assign' ], sprintf($params[ 'format' ], $smarty_math_result));
         }
     }
 }
-
-/* vim: set expandtab: */
-
-?>