Merge branch 'release/2.6.33' into support/2.6

allow StdClass to be cast to array when compiling foreach, to prevent invalid count warning in PHP 7.2+

.gitattributes

@@ -1,7 +1,11 @@
-* text=auto !eol
-docs/chm/make_chm_spc.gif -text
-docs/fop/thryb.ttf -text
-docs/fop/thrybi.ttf -text
-docs/fop/thryi.ttf -text
-docs/fop/thryn.ttf -text
-misc/smarty_icon.gif -text
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# exclude from git export
+/travis.ini export-ignore
+/myconfig.ini export-ignore
+/.travis.yml export-ignore
+/.gitignore export-ignore
+/.gitattributes export-ignore
+/lexer/ export-ignore
+/utilities/ export-ignore

.gitignore

@@ -1,19 +1,10 @@
-docs/*.cache
-docs/*.fot
-docs/Makefile
-docs/chm/*.chm
-docs/chm/*.hh?
-docs/chm/fancy
-docs/config.*
-docs/configure
-docs/diff
-docs/dsssl/html-common.dsl
-docs/entities/file-entities.ent
-docs/entities/version.ent
-docs/html
-docs/manual.pdf
-docs/manual.xml
-docs/phpweb
-docs/revcheck.html
-docs/scripts/file-entities.php
-/templates_c
+
+.idea/
+# Smarty
+lexer/*.php
+lexer/*.php.bak
+lexer/*.out
+utilies/*.php
+/composer.lock
+/vendor
+/tests

ChangeLog

@@ -1,34 +1,46 @@
-2016-07-19  Uwe Tews
-    * {math} shell injection vulnerability patch provided by Tim Weber
-    
-2015-12-30  Uwe Tews
+=== Unreleased ===
 
-    * fixed plugin filepath cache must not be static, because of possible problem
+=== 2.6.33 - 2021-10-23 ===
+- Removed trailing comma in composer.json
+
+=== 2.6.32 - 2021-10-22 ===
+- php8 compatability fix using empty() instead of @count()
+
+=== 2.6.31 - 2017-11-03 ===
+- replace functions deprecated in PHP 7.2
+- {math} fix parameter checking order to avoid misleading message
+- {math} replace wrong versiom
+
+=== 2.6.30 - 2016-07-19 ===
+- {math} shell injection vulnerability patch provided by Tim Weber
+- fixed plugin filepath cache must not be static, because of possible problem
       when using multiple Smarty instances with diffrent plugins_dir settings
          https://github.com/smarty-php/smarty/issues/146 
 
-2015-06-21  Uwe Tews
+=== 2.6.29 - 2015-06-21 ===
+- PHP7 raises E_DEPRECATED use __construct for compatibility
 
-    * PHP7 raises E_DEPRECATED use __construct for compatibility 
+=== 2.6.28 - 2013-09-30 ===
+- Fixed old vulnerability bug https://bugs.gentoo.org/show_bug.cgi?id=356615
+- Fixed made Smarty_Compiler.class.php compatible with PHP 5.5
 
-2013-09-30
+=== 2.6.27 - 2012-09-24===
+- Fixed escape Smarty error messages to avoid possible script execution
+- Fixed security hole in {math} plugin
 
-    * Fixed old vulnerability bug https://bugs.gentoo.org/show_bug.cgi?id=356615
+=== 2.6.26 - 2014-10-31 ===
+- revert super global access changes, and instead rely on
+- USE_SUPER_GLOBALS for security
 
-2013-07-16  Uwe Tews
+=== 2.6.25 - 2009-05-19 ===
+- fix E_NOTICE when sessions are disabled (mohrt)
 
-    * Fixed made Smarty_Compiler.class.php compatible with PHP 5.5
+=== 2.6.24 - 2009-05-16 ===
+- fix problem introduced with super global changes (mohrt)
 
 
-2012-09-24  Uwe Tews
+=== Older versions ===
 
-    * Fixed  escape Smarty error messages to avoid possible script execution
-
-    
-2010-04-17  Uwe Tews
-
-    * Fixed security hole in {math} plugin
-    
 2007-09-27  TAKAGI Masahiro  <matakagi@gmail.com>
 
     * docs/ja/designers/language-custom-functions/language-function-html-checkboxes.xml:
@@ -783,7 +795,7 @@
       docs/fr/programmers/plugins/plugins-inserts.xml:
       sync with EN
 
-2006-10-14  Fernando Correa da Conceição  <fernando_conceicao@yahoo.com.br>
+2006-10-14  Fernando Correa da Concei��o  <fernando_conceicao@yahoo.com.br>
 
     * docs/pt_BR/programmers/api-variables/variable-error-reporting.xml:
       New Translation
@@ -4324,7 +4336,7 @@
       fixed bug in _run_mod_handler
 
     * libs/Smarty_Compiler.class.php:
-      fixed bug with autoload-handling of modifiers. thanks ándre.
+      fixed bug with autoload-handling of modifiers. thanks �ndre.
 
 2003-08-05  Messju Mohr  <messju@lammfellpuschen.de>
 

QUICK_START

@@ -10,9 +10,9 @@ Copy the Smarty library files to your system. In our example, we place them in
 /usr/local/lib/php/Smarty/
 
 $> cd YOUR_DOWNLOAD_DIRECTORY
-$> gtar -ztvf Smarty-2.6.7.tar.gz
+$> gtar -ztvf Smarty-2.x.y.tar.gz
 $> mkdir /usr/local/lib/php/Smarty
-$> cp -r Smarty-2.6.7/libs/* /usr/local/lib/php/Smarty
+$> cp -r Smarty-2.x.y/libs/* /usr/local/lib/php/Smarty
 
 You should now have the following file structure:
 

README

@@ -3,8 +3,6 @@ NAME:
 
     Smarty - the PHP compiling template engine
 
-VERSION: 2.6.18
-
 AUTHORS:
     
     Monte Ohrt <monte at ohrt dot com>

README.md

@@ -1,10 +1,10 @@
-#Smarty 2 template engine
-##Distribution repository
+# Smarty 2 template engine
+## Distribution repository
 Starting with Smarty 2.6.23 Composer has been configured to load the packages from github.
  
 **NOTE: Because of this change you must clear your local composer cache with the "composer clearcache" command**
 
-To get the latest stable version use
+To get the latest v2.6 release use
 
 	"require": {
 	   "smarty/smarty": "~2.6"
@@ -12,12 +12,6 @@ To get the latest stable version use
 
 in your composer.json file.
  
- To get the trunk version use
-
-	"require": {
-	   "smarty/smarty": "~2.6@dev"
-	}
-
 The "smarty/smarty" package will start at libs/....   subfolder.
 
 

composer.json

@@ -29,11 +29,5 @@
             "libs/Smarty_Compiler.class.php",
             "libs/Config_File.class.php"
         ]
-    },
-    "extra": {
-        "branch-alias": {
-            "dev-master": "2.6.x-dev"
-        }
     }
-
 }

libs/Config_File.class.php

@@ -22,7 +22,6 @@
  * smarty-discussion-subscribe@googlegroups.com 
  *
  * @link http://www.smarty.net/
- * @version 2.6.25-dev
  * @copyright Copyright: 2001-2005 New Digital Group, Inc.
  * @author Andrei Zmievski <andrei@php.net>
  * @access public

libs/Smarty.class.php

@@ -27,7 +27,6 @@
  * @author Monte Ohrt <monte at ohrt dot com>
  * @author Andrei Zmievski <andrei@php.net>
  * @package Smarty
- * @version 2.6.30
  */
 
 /* $Id$ */
@@ -465,7 +464,7 @@ class Smarty
      *
      * @var string
      */
-    var $_version              = '2.6.30';
+    var $_version = '2.6.33';
 
     /**
      * current template inclusion depth
@@ -1208,7 +1207,7 @@ class Smarty
                         $_server_vars = ($this->request_use_auto_globals) ? $_SERVER : $GLOBALS['HTTP_SERVER_VARS'];
                         $_last_modified_date = @substr($_server_vars['HTTP_IF_MODIFIED_SINCE'], 0, strpos($_server_vars['HTTP_IF_MODIFIED_SINCE'], 'GMT') + 3);
                         $_gmt_mtime = gmdate('D, d M Y H:i:s', $this->_cache_info['timestamp']).' GMT';
-                        if (@count($this->_cache_info['insert_tags']) == 0
+                        if (empty($this->_cache_info['insert_tags'])
                             && !$this->_cache_serials
                             && $_gmt_mtime == $_last_modified_date) {
                             if (php_sapi_name()=='cgi')

libs/Smarty_Compiler.class.php

@@ -21,7 +21,6 @@
  * @link http://smarty.php.net/
  * @author Monte Ohrt <monte at ohrt dot com>
  * @author Andrei Zmievski <andrei@php.net>
- * @version 2.6.25-dev
  * @copyright 2001-2005 New Digital Group, Inc.
  * @package Smarty
  */
@@ -259,14 +258,9 @@ class Smarty_Compiler extends Smarty {
 
         preg_match_all($search, $source_content, $match,  PREG_SET_ORDER);
         $this->_folded_blocks = $match;
-        reset($this->_folded_blocks);
 
         /* replace special blocks by "{php}" */
-        $source_content = preg_replace_callback($search, create_function ('$matches', "return '"
-                                       . $this->_quote_replace($this->left_delimiter) . 'php'
-                                       . "' . str_repeat(\"\n\", substr_count('\$matches[1]', \"\n\")) .'"
-                                       . $this->_quote_replace($this->right_delimiter)
-                                       . "';")
+        $source_content = preg_replace_callback($search, array($this,'_preg_callback')
                                        , $source_content);
 
         /* Gather all template tags. */
@@ -556,7 +550,7 @@ class Smarty_Compiler extends Smarty {
 
             case 'php':
                 /* handle folded tags replaced by {php} */
-                list(, $block) = each($this->_folded_blocks);
+                $block = array_shift($this->_folded_blocks);
                 $this->_current_line_no += substr_count($block[0], "\n");
                 /* the number of matched elements in the regexp in _compile_file()
                    determins the type of folded tag that was found */
@@ -754,7 +748,12 @@ class Smarty_Compiler extends Smarty {
         return true;
     }
 
-
+    function _preg_callback ($matches) {
+    return $this->_quote_replace($this->left_delimiter)
+           . 'php'
+           . str_repeat("\n", substr_count($matches[1], "\n"))
+           . $this->_quote_replace($this->right_delimiter);
+    }
     /**
      * compile custom function tag
      *
@@ -1192,7 +1191,7 @@ class Smarty_Compiler extends Smarty {
         }
 
         $output = '<?php ';
-        $output .= "\$_from = $from; if (!is_array(\$_from) && !is_object(\$_from)) { settype(\$_from, 'array'); }";
+        $output .= "\$_from = $from; if ((\$_from instanceof StdClass) || (!is_array(\$_from) && !is_object(\$_from))) { settype(\$_from, 'array'); }";
         if (isset($name)) {
             $foreach_props = "\$this->_foreach[$name]";
             $output .= "{$foreach_props} = array('total' => count(\$_from), 'iteration' => 0);\n";

libs/plugins/function.math.php

@@ -18,11 +18,11 @@
  * @author   Monte Ohrt <monte at ohrt dot com>
  *
  * @param array                    $params   parameters
- * @param Smarty_Internal_Template $template template object
+ * @param Smarty
  *
  * @return string|null
  */
-function smarty_function_math($params, $template)
+function smarty_function_math($params, &$smarty)
 {
     static $_allowed_funcs =
         array('int' => true, 'abs' => true, 'ceil' => true, 'cos' => true, 'exp' => true, 'floor' => true,
@@ -58,12 +58,28 @@ function smarty_function_math($params, $template)
         return;
     }
 
+    foreach ($params as $key => $val) {
+        if ($key != "equation" && $key != "format" && $key != "assign") {
+            // make sure value is not empty
+            if (strlen($val) == 0) {
+                trigger_error("math: parameter '{$key}' is empty", E_USER_WARNING);
+
+                return;
+            }
+            if (!is_numeric($val)) {
+                trigger_error("math: parameter '{$key}' is not numeric", E_USER_WARNING);
+
+                return;
+            }
+        }
+    }
+
     // match all vars in equation, make sure all are passed
     preg_match_all('!(?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*)!', $equation, $match);
 
     foreach ($match[ 1 ] as $curr_var) {
         if ($curr_var && !isset($params[ $curr_var ]) && !isset($_allowed_funcs[ $curr_var ])) {
-            trigger_error("math: function call $curr_var not allowed", E_USER_WARNING);
+            trigger_error("math: function call '{$curr_var}' not allowed, or missing parameter '{$curr_var}'", E_USER_WARNING);
 
             return;
         }
@@ -71,17 +87,6 @@ function smarty_function_math($params, $template)
 
     foreach ($params as $key => $val) {
         if ($key != "equation" && $key != "format" && $key != "assign") {
-            // make sure value is not empty
-            if (strlen($val) == 0) {
-                trigger_error("math: parameter $key is empty", E_USER_WARNING);
-
-                return;
-            }
-            if (!is_numeric($val)) {
-                trigger_error("math: parameter $key: is not numeric", E_USER_WARNING);
-
-                return;
-            }
             $equation = preg_replace("/\b$key\b/", " \$params['$key'] ", $equation);
         }
     }
@@ -92,13 +97,13 @@ function smarty_function_math($params, $template)
         if (empty($params[ 'assign' ])) {
             return $smarty_math_result;
         } else {
-            $template->assign($params[ 'assign' ], $smarty_math_result);
+            $smarty->assign($params[ 'assign' ], $smarty_math_result);
         }
     } else {
         if (empty($params[ 'assign' ])) {
             printf($params[ 'format' ], $smarty_math_result);
         } else {
-            $template->assign($params[ 'assign' ], sprintf($params[ 'format' ], $smarty_math_result));
+            $smarty->assign($params[ 'assign' ], sprintf($params[ 'format' ], $smarty_math_result));
         }
     }
 }

make-release.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+if [[ "$1" =~ ^2\.[0-9\.-rc]+$ ]]; then
+   printf 'Creating release %s\n' "$1"
+else
+   echo "Invalid version number: $1. This script can only make v2.x.x releases."
+   exit 1;
+fi
+
+git checkout -b "release/$1"
+sed -i "s/=== Unreleased ===/=== Unreleased ===\\n\\n=== $1 - $(date +%Y-%m-%d) ===/" ChangeLog
+sed -i "s/var \$_version = '[^']\+';/var \$_version = '$1';/" libs/Smarty.class.php
+
+git add ChangeLog libs/Smarty.class.php
+git commit -m "version bump"
+
+git checkout support/2.6
+git pull
+git merge --no-ff "release/$1"
+git branch -d "release/$1"
+git tag -a "v$1" -m "Release $1"
+
+printf 'Done creating release %s\n' "$1"
+
+# shellcheck disable=SC2016
+printf 'Run `git push --follow-tags origin` to publish it.\n'