Fixed PHPUnit expected Exceptions.

CHANGELOG.md

@@ -6,16 +6,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [4.0.4] - 2022-01-18
-
-### Fixed
-- Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-php/smarty/issues/702)
-
-## [4.0.3] - 2022-01-10
-
-### Security
-- Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408
-
 ## [4.0.2] - 2022-01-10
 
 ### Security

lexer/smarty_internal_templateparser.y

@@ -747,9 +747,6 @@ value(res)       ::= doublequoted_with_quotes(s). {
 
 
 value(res)    ::= varindexed(vi) DOUBLECOLON static_class_access(r). {
-    if ($this->security && $this->security->static_classes !== array()) {
-        $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
-    }
     $prefixVar = $this->compiler->getNewPrefixVariable();
     if (vi['var'] === '\'smarty\'') {
         $this->compiler->appendPrefixCode("<?php {$prefixVar} = ". $this->compiler->compileTag('private_special_variable',array(),vi['smarty_internal_index']).';?>');

libs/Smarty.class.php

@@ -98,7 +98,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.0.4';
+    const SMARTY_VERSION = '4.0.2';
     /**
      * define variable scopes
      */

libs/plugins/function.math.php

@@ -70,7 +70,7 @@ function smarty_function_math($params, $template)
     $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
     $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
     $operators = '[+\/*\^%-]'; // Allowed math operators
-    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?1))?)+$/';
+    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?2))?)+$/';
 
     if (!preg_match($regexp, $equation)) {
         trigger_error("math: illegal characters", E_USER_WARNING);

libs/sysplugins/smarty_internal_templateparser.php

@@ -2397,9 +2397,6 @@ public static $yy_action = array(
     }
 // line 749 "../smarty/lexer/smarty_internal_templateparser.y"
     public function yy_r94(){
-	    if ($this->security && $this->security->static_classes !== array()) {
-		    $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
-	    }
     $prefixVar = $this->compiler->getNewPrefixVariable();
     if ($this->yystack[$this->yyidx + -2]->minor['var'] === '\'smarty\'') {
         $this->compiler->appendPrefixCode("<?php {$prefixVar} = ". $this->compiler->compileTag('private_special_variable',array(),$this->yystack[$this->yyidx + -2]->minor['smarty_internal_index']).';?>');

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -257,41 +257,19 @@ class SecurityTest extends PHPUnit_Smarty
         $this->assertEquals('25', $this->smarty->fetch($tpl));
     }
 
-	/**
-	 * test not trusted PHP function
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
-	 */
-	public function testNotTrustedStaticClass()
-	{
+/**
+ * test not trusted PHP function
+  * @runInSeparateProcess
+  * @preserveGlobalState disabled
+  */
+    public function testNotTrustedStaticClass()
+    {
         $this->expectException('SmartyException');
         $this->expectExceptionMessage('access to static class \'mysecuritystaticclass\' not allowed by security setting');
         $this->smarty->security_policy->static_classes = array('null');
         $this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
     }
 
-	/**
-	 * test not trusted PHP function
-	 */
-	public function testNotTrustedStaticClassEval()
-	{
-		$this->expectException('SmartyException');
-		$this->expectExceptionMessage('dynamic static class not allowed by security setting');
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{$test = "mysecuritystaticclass"}{$test::square(5)}');
-	}
-
-	/**
-	 * test not trusted PHP function
-	 */
-	public function testNotTrustedStaticClassSmartyVar()
-	{
-		$this->expectException('SmartyException');
-		$this->expectExceptionMessage('dynamic static class not allowed by security setting');
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{$smarty.template_object::square(5)}');
-	}
-
     public function testChangedTrustedDirectory()
     {
         $this->smarty->security_policy->secure_dir = array(

tests/UnitTests/TemplateSource/ValueTests/Math/MathTest.php

@@ -44,14 +44,6 @@ class MathTest extends PHPUnit_Smarty
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
 
-    public function testMultipleOperators()
-    {
-        $this->smarty->disableSecurity();
-        $expected = "2 -- 2";
-        $tpl = $this->smarty->createTemplate('eval:{$x = 5}{$y = 4}{math equation="x - y + 1" x=$x y=$y} -- {math equation="5 - 4 + 1"}');
-        $this->assertEquals($expected, $this->smarty->fetch($tpl));
-    }
-
     public function testSyntaxSin()
     {
         $this->smarty->disableSecurity();