v3.1.21

-This line, and those below, will be ignored--

M    distribution/libs/sysplugins/smarty_internal_cacheresource_file.php

INHERITANCE_RELEASE_NOTES.txt

@@ -23,9 +23,9 @@ If $smarty->inheritance_merge_compiled_includes = false; {include} subtemplate w
 You must now manually merge all {include} subtemplate which do contain {block} tags. This is done by setting the "inline" option.
 {include file='foo.bar' inline}
 
-1. In case of a variable file name like {include file=$foo inline} you must you the variable in a compile_id  $smarty->compile_id = $foo;
+1. In case of a variable file name like {include file=$foo inline} you must use the variable in a compile_id  $smarty->compile_id = $foo;
 2. If you use individual compile_id in {include file='foo.tpl' compile_id=$bar inline} it must be used in the 
-   global compile_id as well  $smarty->compile_id = $foo;
+   global compile_id as well  $smarty->compile_id = $bar;
 3. If call templates with different template_dir configurations and a parent could same named child template from different folders
    you must make the folder name part of the compile_id.
 

change_log.txt

@@ -1,8 +1,46 @@
+ ===== 3.1.21 ===== (18.10.2014)
+ 17.10.2014
+ - bugfix on $php_handling security and optimization of smarty_internal_parsetree (Thue Kristensen)
+ 
+ 16.10.2014
+ - bugfix composer.json update
+ 
+ 15.10.2014
+ - bugfix calling a new created cache file with fetch() and Smarty::CACHING_LIFETIME_SAVED multiple times did fail (forum 22350)
 
- ===== 3.1.20-dev ===== (xx.xx.2014)
+ 14.10.2014
+ - bugfix any tag placed within "<script language=php>" will throw a security exception to close all thinkable holes
+ - bugfix classmap in root composer.json should start at "libs/..."
+ - improvement cache is_file(file_exists) results of loadPlugin() to avoid unnecessary calls during compilation (Issue 201}
+
+ 12.10.2014
+ - bugfix a comment like "<script{*foo*} language=php>" bypassed $php_handling checking (Thue Kristensen)
+ - bugfix change of 08.10.2014 could create E_NOTICE meassage when using "<?php" tags
+ - bugfix "<script language=php>" with $php_handling PHP_PASSTHRU was executed in {nocache} sections
+
+ ===== 3.1.20 ===== (09.10.2014)
+ 08.10.2014
+ - bugfix security mode of "<script language=php>" must be controlled by $php_handling property (Thue Kristensen)
+ 
+ 01.10.2014
+ - bugfix template resource of inheritance blocks could get invalid if the default resource type is not 'file'(Issue 202)
+ - bugfix existing child {block} tag must override parent {block} tag append / prepend setting (topic 25259)
+ 
+ 02.08.2014
+ - bugfix modifier wordwrap did output break string wrong if first word was exceeding length with cut = true (topic 25193)
+ 
+ 24.07.2014
+ - bugfix cache clear when cache folder does not exist
+
+ 16.07.2014
+ - enhancement remove BOM automatically from template source (topic 25161)
+ 
+ 04.07.2014
+ - bugfix the bufix of 02.06.2014 broke correct handling of child templates with same name but different template folders in extends resource (issue 194 and topic 25099)
+ 
  ===== 3.1.19 ===== (30.06.2014)
  20.06.2014
- - bugfix template variables could not be passed as paramter in {include} when the include was in a {nocache} section (topic 25131)
+ - bugfix template variables could not be passed as parameter in {include} when the include was in a {nocache} section (topic 25131)
  
  17.06.2014
  - bugfix large template text of some charsets could cause parsing errors (topic 24630)

libs/Smarty.class.php

@@ -110,7 +110,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = 'Smarty-3.1.19-dev';
+    const SMARTY_VERSION = 'Smarty-3.1.21';
 
     /**
      * define variable scopes
@@ -662,6 +662,14 @@ class Smarty extends Smarty_Internal_TemplateBase
      * @var array
      */
     public $merged_templates_func = array();
+
+    /**
+     * Cache of is_file results of loadPlugin()
+     * 
+     * @var array
+     */
+    public static $_is_file_cache= array();
+
     /**#@-*/
 
     /**
@@ -1372,9 +1380,8 @@ class Smarty extends Smarty_Internal_TemplateBase
         // if type is "internal", get plugin from sysplugins
         if (strtolower($_name_parts[1]) == 'internal') {
             $file = SMARTY_SYSPLUGINS_DIR . strtolower($plugin_name) . '.php';
-            if (file_exists($file)) {
+            if (isset(self::$_is_file_cache[$file]) ? self::$_is_file_cache[$file] : self::$_is_file_cache[$file] = is_file($file)) {
                 require_once($file);
-
                 return $file;
             } else {
                 return false;
@@ -1392,9 +1399,8 @@ class Smarty extends Smarty_Internal_TemplateBase
                 $_plugin_dir . strtolower($_plugin_filename),
             );
             foreach ($names as $file) {
-                if (file_exists($file)) {
+                if (isset(self::$_is_file_cache[$file]) ? self::$_is_file_cache[$file] : self::$_is_file_cache[$file] = is_file($file)) {
                     require_once($file);
-
                     return $file;
                 }
                 if ($this->use_include_path && !preg_match('/^([\/\\\\]|[a-zA-Z]:[\/\\\\])/', $_plugin_dir)) {

libs/plugins/modifier.escape.php

@@ -12,7 +12,7 @@
  * Name:     escape<br>
  * Purpose:  escape string for output
  *
- * @link   http://www.smarty.net/manual/en/language.modifier.count.characters.php count_characters (Smarty online manual)
+ * @link   http://www.smarty.net/docs/en/language.modifier.escape
  * @author Monte Ohrt <monte at ohrt dot com>
  *
  * @param string  $string        input string

libs/plugins/shared.mb_wordwrap.php

@@ -28,20 +28,14 @@ if (!function_exists('smarty_mb_wordwrap')) {
         $length = 0;
         $t = '';
         $_previous = false;
+        $_space = false;
 
         foreach ($tokens as $_token) {
             $token_length = mb_strlen($_token, Smarty::$_CHARSET);
             $_tokens = array($_token);
             if ($token_length > $width) {
-                // remove last space
-                $t = mb_substr($t, 0, - 1, Smarty::$_CHARSET);
-                $_previous = false;
-                $length = 0;
-
-                if ($cut) {
+                 if ($cut) {
                     $_tokens = preg_split('!(.{' . $width . '})!S' . Smarty::$_UTF8_MODIFIER, $_token, - 1, PREG_SPLIT_NO_EMPTY + PREG_SPLIT_DELIM_CAPTURE);
-                    // broken words go on a new line
-                    $t .= $break;
                 }
             }
 
@@ -52,27 +46,23 @@ if (!function_exists('smarty_mb_wordwrap')) {
 
                 if ($length > $width) {
                     // remove space before inserted break
-                    if ($_previous && $token_length < $width) {
+                    if ($_previous) {
                         $t = mb_substr($t, 0, - 1, Smarty::$_CHARSET);
                     }
 
-                    // add the break before the token
-                    $t .= $break;
-                    $length = $token_length;
-
-                    // skip space after inserting a break
-                    if ($_space) {
-                        $length = 0;
-                        continue;
+                    if (!$_space) {
+                        // add the break before the token
+                        if (!empty($t)) {
+                            $t .= $break;
+                        }
+                        $length = $token_length;
                     }
                 } elseif ($token == "\n") {
                     // hard break must reset counters
                     $_previous = 0;
                     $length = 0;
-                } else {
-                    // remember if we had a space or not
-                    $_previous = $_space;
                 }
+                $_previous = $_space;
                 // add the token
                 $t .= $token;
             }

libs/sysplugins/smarty_internal_cacheresource_file.php

@@ -147,7 +147,10 @@ class Smarty_Internal_CacheResource_File extends Smarty_CacheResource
         $_compile_id = isset($compile_id) ? preg_replace('![^\w\|]+!', '_', $compile_id) : null;
         $_dir_sep = $smarty->use_sub_dirs ? '/' : '^';
         $_compile_id_offset = $smarty->use_sub_dirs ? 3 : 0;
-        $_dir = realpath($smarty->getCacheDir()) . '/';
+        if (($_dir = realpath($smarty->getCacheDir())) === false) {
+            return 0;
+        }
+        $_dir .= '/';
         $_dir_length = strlen($_dir);
         if (isset($_cache_id)) {
             $_cache_id_parts = explode('|', $_cache_id);

libs/sysplugins/smarty_internal_compile_block.php

@@ -78,6 +78,12 @@ class Smarty_Internal_Compile_Block extends Smarty_Internal_CompileBase
         $_attr = $this->getAttributes($compiler, $args);
         $_name = trim($_attr['name'], "\"'");
 
+        // existing child must override parent settings
+        if (isset($compiler->template->block_data[$_name]) && $compiler->template->block_data[$_name]['mode'] == 'replace') {
+            $_attr['append'] = false;
+            $_attr['prepend'] = false;
+        }
+
         // check if we process an inheritance child template
         if ($compiler->inheritance_child) {
             array_unshift(self::$nested_block_names, $_name);
@@ -377,7 +383,7 @@ class Smarty_Internal_Compile_Private_Child_Block extends Smarty_Internal_Compil
 
         // update template with original template resource of {block}
         if (trim($_attr['type'], "'") == 'file') {
-            $compiler->template->template_resource = realpath(trim($_attr['file'], "'"));
+            $compiler->template->template_resource = 'file:' . realpath(trim($_attr['file'], "'"));
         } else {
             $compiler->template->template_resource = trim($_attr['resource'], "'");
         }

libs/sysplugins/smarty_internal_compile_break.php

@@ -70,6 +70,6 @@ class Smarty_Internal_Compile_Break extends Smarty_Internal_CompileBase
             $compiler->trigger_template_error("cannot break {$_levels} level(s)", $compiler->lex->taglineno);
         }
 
-        return "<?php break {$_levels}?>";
+        return "<?php break {$_levels};?>";
     }
 }

libs/sysplugins/smarty_internal_compile_continue.php

@@ -70,6 +70,6 @@ class Smarty_Internal_Compile_Continue extends Smarty_Internal_CompileBase
             $compiler->trigger_template_error("cannot continue {$_levels} level(s)", $compiler->lex->taglineno);
         }
 
-        return "<?php continue {$_levels}?>";
+        return "<?php continue {$_levels};?>";
     }
 }

libs/sysplugins/smarty_internal_compile_function.php

@@ -135,12 +135,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
             }
             $plugins_string .= "?>/*/%%SmartyNocache:{$compiler->template->properties['nocache_hash']}%%*/';?>\n";
         }
-        // remove last line break from function definition
-        $last = count($compiler->parser->current_buffer->subtrees) - 1;
-        if ($compiler->parser->current_buffer->subtrees[$last] instanceof _smarty_linebreak) {
-            unset($compiler->parser->current_buffer->subtrees[$last]);
-        }
-        // if caching save template function for possible nocache call
+         // if caching save template function for possible nocache call
         if ($compiler->template->caching) {
             $compiler->template->properties['function'][$_name]['compiled'] .= $plugins_string
                 . $compiler->parser->current_buffer->to_smarty_php();

libs/sysplugins/smarty_internal_configfilelexer.php

@@ -33,6 +33,9 @@ class Smarty_Internal_Configfilelexer
         self::instance($this);
         $this->data = $data . "\n"; //now all lines are \n-terminated
         $this->counter = 0;
+        if (preg_match('/^\xEF\xBB\xBF/', $this->data, $match)) {
+            $this->counter += strlen($match[0]);
+        }
         $this->line = 1;
         $this->compiler = $compiler;
         $this->smarty = $compiler->smarty;

libs/sysplugins/smarty_internal_parsetree.php

@@ -91,7 +91,7 @@ class _smarty_tag extends _smarty_parsetree
     public function assign_to_var()
     {
         $var = sprintf('$_tmp%d', ++Smarty_Internal_Templateparser::$prefix_number);
-        $this->parser->compiler->prefix_code[] = sprintf('<?php ob_start();?>%s<?php %s=ob_get_clean();?>', $this->data, $var);
+        $this->parser->compiler->prefix_code[] = sprintf("<?php ob_start();\n%s\n%s=ob_get_clean();?>", preg_replace(array('/^\s*<\?php\s+/','/\s*\?>\s*$/'), '', $this->data), $var);
 
         return $var;
     }
@@ -271,7 +271,9 @@ class _smarty_template_buffer extends _smarty_parsetree
      */
     public function append_subtree(_smarty_parsetree $subtree)
     {
-        $this->subtrees[] = $subtree;
+        if ($subtree->data !== '') {
+            $this->subtrees[] = $subtree;
+        }
     }
 
     /**
@@ -283,50 +285,47 @@ class _smarty_template_buffer extends _smarty_parsetree
     {
         $code = '';
         for ($key = 0, $cnt = count($this->subtrees); $key < $cnt; $key ++) {
-            if ($key + 2 < $cnt) {
-                if ($this->subtrees[$key] instanceof _smarty_linebreak && $this->subtrees[$key + 1] instanceof _smarty_tag && $this->subtrees[$key + 1]->data == '' && $this->subtrees[$key + 2] instanceof _smarty_linebreak) {
-                    $key = $key + 1;
+            if ($this->subtrees[$key] instanceof _smarty_text) {
+                $subtree = $this->subtrees[$key]->to_smarty_php();
+                while ($key + 1 < $cnt && ($this->subtrees[$key+1] instanceof _smarty_text || $this->subtrees[$key +1]->data == '')) {
+                    $key++;
+                    if ($this->subtrees[$key]->data == '') {
+                        continue;
+                    }
+                    $subtree .= $this->subtrees[$key]->to_smarty_php();
+                }
+                if ($subtree == '') {
                     continue;
                 }
-                if (substr($this->subtrees[$key]->data, - 1) == '<' && $this->subtrees[$key + 1]->data == '' && substr($this->subtrees[$key + 2]->data, - 1) == '?') {
-                    $key = $key + 2;
+                $code .= preg_replace('/(<%|%>|<\?php|<\?|\?>|<\/?script)/', "<?php echo '\$1'; ?>\n", $subtree);
+                continue;
+            }
+            if ($this->subtrees[$key] instanceof _smarty_tag) {
+                $subtree = $this->subtrees[$key]->to_smarty_php();
+                while ($key + 1 < $cnt && ($this->subtrees[$key+1] instanceof _smarty_tag || $this->subtrees[$key +1]->data == '')) {
+                    $key++;
+                    if ($this->subtrees[$key]->data == '') {
+                        continue;
+                    }
+                    $newCode = $this->subtrees[$key]->to_smarty_php();
+                    if ((preg_match('/^\s*<\?php\s+/', $newCode) &&  preg_match('/\s*\?>\s*$/', $subtree))) {
+                        $subtree = preg_replace('/\s*\?>\s*$/', "\n", $subtree);
+                        $subtree .= preg_replace('/^\s*<\?php\s+/', '', $newCode);
+                    } else {
+                        $subtree .= $newCode;
+                    }
+                }
+                if ($subtree == '') {
                     continue;
                 }
-            }
-            if (substr($code, - 1) == '<') {
-                $subtree = $this->subtrees[$key]->to_smarty_php();
-                if (substr($subtree, 0, 1) == '?') {
-                    $code = substr($code, 0, strlen($code) - 1) . '<<?php ?>?' . substr($subtree, 1);
-                } elseif ($this->parser->asp_tags && substr($subtree, 0, 1) == '%') {
-                    $code = substr($code, 0, strlen($code) - 1) . '<<?php ?>%' . substr($subtree, 1);
-                } else {
-                    $code .= $subtree;
-                }
-                continue;
-            }
-            if ($this->parser->asp_tags && substr($code, - 1) == '%') {
-                $subtree = $this->subtrees[$key]->to_smarty_php();
-                if (substr($subtree, 0, 1) == '>') {
-                    $code = substr($code, 0, strlen($code) - 1) . '%<?php ?>>' . substr($subtree, 1);
-                } else {
-                    $code .= $subtree;
-                }
-                continue;
-            }
-            if (substr($code, - 1) == '?') {
-                $subtree = $this->subtrees[$key]->to_smarty_php();
-                if (substr($subtree, 0, 1) == '>') {
-                    $code = substr($code, 0, strlen($code) - 1) . '?<?php ?>>' . substr($subtree, 1);
-                } else {
-                    $code .= $subtree;
-                }
+                $code .= $subtree;
                 continue;
             }
             $code .= $this->subtrees[$key]->to_smarty_php();
         }
-
         return $code;
     }
+
 }
 
 /**
@@ -360,35 +359,3 @@ class _smarty_text extends _smarty_parsetree
         return $this->data;
     }
 }
-
-/**
- * template linebreaks
- *
- * @package    Smarty
- * @subpackage Compiler
- * @ignore
- */
-class _smarty_linebreak extends _smarty_parsetree
-{
-    /**
-     * Create buffer with linebreak content
-     *
-     * @param object $parser parser object
-     * @param string $data   linebreak string
-     */
-    public function __construct($parser, $data)
-    {
-        $this->parser = $parser;
-        $this->data = $data;
-    }
-
-    /**
-     * Return linebrak
-     *
-     * @return string linebreak
-     */
-    public function to_smarty_php()
-    {
-        return $this->data;
-    }
-}

libs/sysplugins/smarty_internal_resource_extends.php

@@ -44,14 +44,14 @@ class Smarty_Internal_Resource_Extends extends Smarty_Resource
                 throw new SmartyException("Resource type {$s->type} cannot be used with the extends resource type");
             }
             $sources[$s->uid] = $s;
-            $uid .= $s->filepath;
+            $uid .= realpath($s->filepath);
             if ($_template && $_template->smarty->compile_check) {
                 $exists = $exists && $s->exists;
             }
         }
         $source->components = $sources;
         $source->filepath = $s->filepath;
-        $source->uid = sha1(realpath($uid));
+        $source->uid = sha1($uid);
         if ($_template && $_template->smarty->compile_check) {
             $source->timestamp = $s->timestamp;
             $source->exists = $exists;

libs/sysplugins/smarty_internal_template.php

@@ -231,6 +231,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
             // don't write cache file
             return false;
         }
+        $this->cached->timestamp = time();
         $this->properties['cache_lifetime'] = $this->cache_lifetime;
         $this->properties['unifunc'] = 'content_' . str_replace(array('.', ','), '_', uniqid('', true));
         $content = $this->createTemplateCodeFrame($content, true);

libs/sysplugins/smarty_internal_templatebase.php

@@ -245,7 +245,7 @@ abstract class Smarty_Internal_TemplateBase extends Smarty_Internal_Data
                 // loop over items, stitch back together
                 foreach ($cache_split as $curr_idx => $curr_split) {
                     // escape PHP tags in template content
-                    $output .= preg_replace('/(<%|%>|<\?php|<\?|\?>)/', "<?php echo '\$1'; ?>\n", $curr_split);
+                    $output .= preg_replace('/(<%|%>|<\?php|<\?|\?>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>)/', "<?php echo '\$1'; ?>\n", $curr_split);
                     if (isset($cache_parts[0][$curr_idx])) {
                         $_template->properties['has_nocache_code'] = true;
                         // remove nocache tags from cache output

libs/sysplugins/smarty_internal_templatelexer.php

@@ -20,61 +20,64 @@ class Smarty_Internal_Templatelexer
     public $node;
     public $line;
     public $taglineno;
+    public $is_phpScript = false;
     public $state = 1;
+    public $smarty;
+    public $literal_cnt = 0;
     private $heredoc_id_stack = Array();
     public $yyTraceFILE;
     public $yyTracePrompt;
     public $state_name = array(1 => 'TEXT', 2 => 'SMARTY', 3 => 'LITERAL', 4 => 'DOUBLEQUOTEDSTRING', 5 => 'CHILDBODY');
-    public $smarty_token_names = array( // Text for parser error messages
-                                        'IDENTITY'        => '===',
-                                        'NONEIDENTITY'    => '!==',
-                                        'EQUALS'          => '==',
-                                        'NOTEQUALS'       => '!=',
-                                        'GREATEREQUAL'    => '(>=,ge)',
-                                        'LESSEQUAL'       => '(<=,le)',
-                                        'GREATERTHAN'     => '(>,gt)',
-                                        'LESSTHAN'        => '(<,lt)',
-                                        'MOD'             => '(%,mod)',
-                                        'NOT'             => '(!,not)',
-                                        'LAND'            => '(&&,and)',
-                                        'LOR'             => '(||,or)',
-                                        'LXOR'            => 'xor',
-                                        'OPENP'           => '(',
-                                        'CLOSEP'          => ')',
-                                        'OPENB'           => '[',
-                                        'CLOSEB'          => ']',
-                                        'PTR'             => '->',
-                                        'APTR'            => '=>',
-                                        'EQUAL'           => '=',
-                                        'NUMBER'          => 'number',
-                                        'UNIMATH'         => '+" , "-',
-                                        'MATH'            => '*" , "/" , "%',
-                                        'INCDEC'          => '++" , "--',
-                                        'SPACE'           => ' ',
-                                        'DOLLAR'          => '$',
-                                        'SEMICOLON'       => ';',
-                                        'COLON'           => ':',
-                                        'DOUBLECOLON'     => '::',
-                                        'AT'              => '@',
-                                        'HATCH'           => '#',
-                                        'QUOTE'           => '"',
-                                        'BACKTICK'        => '`',
-                                        'VERT'            => '|',
-                                        'DOT'             => '.',
-                                        'COMMA'           => '","',
-                                        'ANDSYM'          => '"&"',
-                                        'QMARK'           => '"?"',
-                                        'ID'              => 'identifier',
-                                        'TEXT'            => 'text',
-                                        'FAKEPHPSTARTTAG' => 'Fake PHP start tag',
-                                        'PHPSTARTTAG'     => 'PHP start tag',
-                                        'PHPENDTAG'       => 'PHP end tag',
-                                        'LITERALSTART'    => 'Literal start',
-                                        'LITERALEND'      => 'Literal end',
-                                        'LDELSLASH'       => 'closing tag',
-                                        'COMMENT'         => 'comment',
-                                        'AS'              => 'as',
-                                        'TO'              => 'to',
+    public $smarty_token_names = array(        // Text for parser error messages
+                                               'IDENTITY'        => '===',
+                                               'NONEIDENTITY'    => '!==',
+                                               'EQUALS'          => '==',
+                                               'NOTEQUALS'       => '!=',
+                                               'GREATEREQUAL'    => '(>=,ge)',
+                                               'LESSEQUAL'       => '(<=,le)',
+                                               'GREATERTHAN'     => '(>,gt)',
+                                               'LESSTHAN'        => '(<,lt)',
+                                               'MOD'             => '(%,mod)',
+                                               'NOT'             => '(!,not)',
+                                               'LAND'            => '(&&,and)',
+                                               'LOR'             => '(||,or)',
+                                               'LXOR'            => 'xor',
+                                               'OPENP'           => '(',
+                                               'CLOSEP'          => ')',
+                                               'OPENB'           => '[',
+                                               'CLOSEB'          => ']',
+                                               'PTR'             => '->',
+                                               'APTR'            => '=>',
+                                               'EQUAL'           => '=',
+                                               'NUMBER'          => 'number',
+                                               'UNIMATH'         => '+" , "-',
+                                               'MATH'            => '*" , "/" , "%',
+                                               'INCDEC'          => '++" , "--',
+                                               'SPACE'           => ' ',
+                                               'DOLLAR'          => '$',
+                                               'SEMICOLON'       => ';',
+                                               'COLON'           => ':',
+                                               'DOUBLECOLON'     => '::',
+                                               'AT'              => '@',
+                                               'HATCH'           => '#',
+                                               'QUOTE'           => '"',
+                                               'BACKTICK'        => '`',
+                                               'VERT'            => '|',
+                                               'DOT'             => '.',
+                                               'COMMA'           => '","',
+                                               'ANDSYM'          => '"&"',
+                                               'QMARK'           => '"?"',
+                                               'ID'              => 'identifier',
+                                               'TEXT'            => 'text',
+                                               'FAKEPHPSTARTTAG' => 'Fake PHP start tag',
+                                               'PHPSTARTTAG'     => 'PHP start tag',
+                                               'PHPENDTAG'       => 'PHP end tag',
+                                               'LITERALSTART'    => 'Literal start',
+                                               'LITERALEND'      => 'Literal end',
+                                               'LDELSLASH'       => 'closing tag',
+                                               'COMMENT'         => 'comment',
+                                               'AS'              => 'as',
+                                               'TO'              => 'to',
     );
 
     function __construct($data, $compiler)
@@ -82,6 +85,9 @@ class Smarty_Internal_Templatelexer
         //        $this->data = preg_replace("/(\r\n|\r|\n)/", "\n", $data);
         $this->data = $data;
         $this->counter = 0;
+        if (preg_match('/^\xEF\xBB\xBF/', $this->data, $match)) {
+            $this->counter += strlen($match[0]);
+        }
         $this->line = 1;
         $this->smarty = $compiler->smarty;
         $this->compiler = $compiler;
@@ -152,17 +158,18 @@ class Smarty_Internal_Templatelexer
             11 => 0,
             12 => 0,
             13 => 0,
-            14 => 0,
-            15 => 0,
-            16 => 0,
+            14 => 2,
             17 => 0,
             18 => 0,
             19 => 0,
+            20 => 0,
+            21 => 0,
+            22 => 0,
         );
         if ($this->counter >= strlen($this->data)) {
             return false; // end of input
         }
-        $yy_global_pattern = "/\G(\\{\\})|\G(" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*setfilter\\s+)|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G(<\\?(?:php\\w+|=|[a-zA-Z]+)?)|\G(\\?>)|\G(\\s*" . $this->rdel . ")|\G(<%)|\G(%>)|\G([\S\s])/iS";
+        $yy_global_pattern = "/\G(\\{\\})|\G(" . $this->ldel . "\\*([\S\s]*?)\\*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/strip\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*setfilter\\s+)|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G((<script\\s+language\\s*=\\s*[\"']?\\s*php\\s*[\"']?\\s*>)|(<\\?(?:php\\w+|=|[a-zA-Z]+)?))|\G(\\?>)|\G(<\/script>)|\G(\\s*" . $this->rdel . ")|\G(<%)|\G(%>)|\G([\S\s])/iS";
 
         do {
             if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -330,45 +337,55 @@ class Smarty_Internal_Templatelexer
     function yy_r1_14($yy_subpatterns)
     {
 
-        if (in_array($this->value, Array('<?', '<?=', '<?php'))) {
+        if (($script = strpos($this->value, '<s') === 0) || in_array($this->value, Array('<?', '<?=', '<?php'))) {
+            if ($script) {
+                $this->is_phpScript = true;
+            }
             $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
         } elseif ($this->value == '<?xml') {
             $this->token = Smarty_Internal_Templateparser::TP_XMLTAG;
         } else {
-            $this->token = Smarty_Internal_Templateparser::TP_FAKEPHPSTARTTAG;
-            $this->value = substr($this->value, 0, 2);
+            $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+            //$this->value = substr($this->value, 0, 2);
         }
     }
 
-    function yy_r1_15($yy_subpatterns)
-    {
-
-        $this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG;
-    }
-
-    function yy_r1_16($yy_subpatterns)
-    {
-
-        $this->token = Smarty_Internal_Templateparser::TP_TEXT;
-    }
-
     function yy_r1_17($yy_subpatterns)
     {
 
-        $this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG;
+        $this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG;
     }
 
     function yy_r1_18($yy_subpatterns)
     {
 
-        $this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG;
+        $this->token = Smarty_Internal_Templateparser::TP_PHPENDSCRIPT;
     }
 
     function yy_r1_19($yy_subpatterns)
     {
 
+        $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+    }
+
+    function yy_r1_20($yy_subpatterns)
+    {
+
+        $this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG;
+    }
+
+    function yy_r1_21($yy_subpatterns)
+    {
+
+        $this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG;
+    }
+
+    function yy_r1_22($yy_subpatterns)
+    {
+
+        $phpEndScript = $this->is_phpScript ? '|<\\/script>' : '';
         $to = strlen($this->data);
-        preg_match("/{$this->ldel}|<\?|\?>|<%|%>/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
+        preg_match("/{$this->ldel}|<\?|<%|\?>|%>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>{$phpEndScript}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
         if (isset($match[0][1])) {
             $to = $match[0][1];
         }
@@ -942,15 +959,11 @@ class Smarty_Internal_Templatelexer
             1 => 0,
             2 => 0,
             3 => 0,
-            4 => 0,
-            5 => 0,
-            6 => 0,
-            7 => 0,
         );
         if ($this->counter >= strlen($this->data)) {
             return false; // end of input
         }
-        $yy_global_pattern = "/\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G(<\\?(?:php\\w+|=|[a-zA-Z]+)?)|\G(\\?>)|\G(<%)|\G(%>)|\G([\S\s])/iS";
+        $yy_global_pattern = "/\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G([\S\s])/iS";
 
         do {
             if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -1003,19 +1016,16 @@ class Smarty_Internal_Templatelexer
     function yy_r3_1($yy_subpatterns)
     {
 
-        if ($this->smarty->auto_literal && isset($this->value[$this->ldel_length]) ? strpos(" \n\t\r", $this->value[$this->ldel_length]) !== false : false) {
-            $this->token = Smarty_Internal_Templateparser::TP_TEXT;
-        } else {
-            $this->token = Smarty_Internal_Templateparser::TP_LITERALSTART;
-            $this->yypushstate(self::LITERAL);
-        }
+        $this->literal_cnt ++;
+        $this->token = Smarty_Internal_Templateparser::TP_LITERAL;
     }
 
     function yy_r3_2($yy_subpatterns)
     {
 
-        if ($this->smarty->auto_literal && isset($this->value[$this->ldel_length]) ? strpos(" \n\t\r", $this->value[$this->ldel_length]) !== false : false) {
-            $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+        if ($this->literal_cnt) {
+            $this->literal_cnt --;
+            $this->token = Smarty_Internal_Templateparser::TP_LITERAL;
         } else {
             $this->token = Smarty_Internal_Templateparser::TP_LITERALEND;
             $this->yypopstate();
@@ -1023,39 +1033,10 @@ class Smarty_Internal_Templatelexer
     }
 
     function yy_r3_3($yy_subpatterns)
-    {
-
-        if (in_array($this->value, Array('<?', '<?=', '<?php'))) {
-            $this->token = Smarty_Internal_Templateparser::TP_PHPSTARTTAG;
-        } else {
-            $this->token = Smarty_Internal_Templateparser::TP_FAKEPHPSTARTTAG;
-            $this->value = substr($this->value, 0, 2);
-        }
-    }
-
-    function yy_r3_4($yy_subpatterns)
-    {
-
-        $this->token = Smarty_Internal_Templateparser::TP_PHPENDTAG;
-    }
-
-    function yy_r3_5($yy_subpatterns)
-    {
-
-        $this->token = Smarty_Internal_Templateparser::TP_ASPSTARTTAG;
-    }
-
-    function yy_r3_6($yy_subpatterns)
-    {
-
-        $this->token = Smarty_Internal_Templateparser::TP_ASPENDTAG;
-    }
-
-    function yy_r3_7($yy_subpatterns)
     {
 
         $to = strlen($this->data);
-        preg_match("/{$this->ldel}\/?literal{$this->rdel}|<\?|<%|\?>|%>/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
+        preg_match("/{$this->ldel}\/?literal{$this->rdel}/", $this->data, $match, PREG_OFFSET_CAPTURE, $this->counter);
         if (isset($match[0][1])) {
             $to = $match[0][1];
         } else {
@@ -1077,13 +1058,15 @@ class Smarty_Internal_Templatelexer
             8  => 0,
             9  => 0,
             10 => 0,
-            11 => 3,
-            15 => 0,
+            11 => 0,
+            12 => 0,
+            13 => 3,
+            17 => 0,
         );
         if ($this->counter >= strlen($this->data)) {
             return false; // end of input
         }
-        $yy_global_pattern = "/\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G(\")|\G(`\\$)|\G(\\$[0-9]*[a-zA-Z_]\\w*)|\G(\\$)|\G(([^\"\\\\]*?)((?:\\\\.[^\"\\\\]*?)*?)(?=(" . $this->ldel . "|\\$|`\\$|\")))|\G([\S\s])/iS";
+        $yy_global_pattern = "/\G(" . $this->ldel . "\\s*(if|elseif|else if|while)\\s+)|\G(" . $this->ldel . "\\s*for\\s+)|\G(" . $this->ldel . "\\s*foreach(?![^\s]))|\G(" . $this->ldel . "\\s*literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/literal\\s*" . $this->rdel . ")|\G(" . $this->ldel . "\\s*\/)|\G(" . $this->ldel . "\\s*)|\G(\")|\G(`\\$)|\G(\\$[0-9]*[a-zA-Z_]\\w*)|\G(\\$)|\G(([^\"\\\\]*?)((?:\\\\.[^\"\\\\]*?)*?)(?=(" . $this->ldel . "|\\$|`\\$|\")))|\G([\S\s])/iS";
 
         do {
             if (preg_match($yy_global_pattern, $this->data, $yymatches, null, $this->counter)) {
@@ -1170,6 +1153,18 @@ class Smarty_Internal_Templatelexer
     }
 
     function yy_r4_5($yy_subpatterns)
+    {
+
+        $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+    }
+
+    function yy_r4_6($yy_subpatterns)
+    {
+
+        $this->token = Smarty_Internal_Templateparser::TP_TEXT;
+    }
+
+    function yy_r4_7($yy_subpatterns)
     {
 
         if ($this->smarty->auto_literal && isset($this->value[$this->ldel_length]) ? strpos(" \n\t\r", $this->value[$this->ldel_length]) !== false : false) {
@@ -1181,7 +1176,7 @@ class Smarty_Internal_Templatelexer
         }
     }
 
-    function yy_r4_6($yy_subpatterns)
+    function yy_r4_8($yy_subpatterns)
     {
 
         if ($this->smarty->auto_literal && isset($this->value[$this->ldel_length]) ? strpos(" \n\t\r", $this->value[$this->ldel_length]) !== false : false) {
@@ -1193,14 +1188,14 @@ class Smarty_Internal_Templatelexer
         }
     }
 
-    function yy_r4_7($yy_subpatterns)
+    function yy_r4_9($yy_subpatterns)
     {
 
         $this->token = Smarty_Internal_Templateparser::TP_QUOTE;
         $this->yypopstate();
     }
 
-    function yy_r4_8($yy_subpatterns)
+    function yy_r4_10($yy_subpatterns)
     {
 
         $this->token = Smarty_Internal_Templateparser::TP_BACKTICK;
@@ -1209,25 +1204,25 @@ class Smarty_Internal_Templatelexer
         $this->taglineno = $this->line;
     }
 
-    function yy_r4_9($yy_subpatterns)
+    function yy_r4_11($yy_subpatterns)
     {
 
         $this->token = Smarty_Internal_Templateparser::TP_DOLLARID;
     }
 
-    function yy_r4_10($yy_subpatterns)
+    function yy_r4_12($yy_subpatterns)
     {
 
         $this->token = Smarty_Internal_Templateparser::TP_TEXT;
     }
 
-    function yy_r4_11($yy_subpatterns)
+    function yy_r4_13($yy_subpatterns)
     {
 
         $this->token = Smarty_Internal_Templateparser::TP_TEXT;
     }
 
-    function yy_r4_15($yy_subpatterns)
+    function yy_r4_17($yy_subpatterns)
     {
 
         $to = strlen($this->data);

libs/sysplugins/smarty_security.php

@@ -79,7 +79,7 @@ class Smarty_Security
     /**
      * This is an array of trusted PHP modifiers.
      * If empty all modifiers are allowed.
-     * To disable all modifier set $modifiers = null.
+     * To disable all modifier set $php_modifiers = null.
      *
      * @var array
      */