Add change in regex for PRCE (PHP < 7.3)

Fixes #794

CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Fixed PHP8.1 deprecation errors in modifiers (upper, explode, number_format and replace) [#755](https://github.com/smarty-php/smarty/pull/755) and [#788](https://github.com/smarty-php/smarty/pull/788)
+- Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794)
+
 ## [4.2.0] - 2022-08-01
 
 ### Fixed

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Smarty currently supports the latest minor version of Smarty 3 and Smarty 4. (Smarty 4 has not been released yet.)
+Smarty currently supports the latest minor version of Smarty 3 and Smarty 4.
 
 | Version | Supported          |
 | ------- | ------------------ |

libs/plugins/function.math.php

@@ -70,7 +70,7 @@ function smarty_function_math($params, $template)
     $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
     $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
     $operators = '[,+\/*\^%-]'; // Allowed math operators
-    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?1))?)+$/';
+    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)*\)|\((?1)*\)))(?:'.$operators.'(?1))?)+$/';
 
     if (!preg_match($regexp, $equation)) {
         trigger_error("math: illegal characters", E_USER_WARNING);

libs/plugins/modifier.explode.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifier
+ */
+
+/**
+ * Smarty explode modifier plugin
+ * Type:     modifier
+ * Name:     explode
+ * Purpose:  split a string by a string
+ *
+ * @param string   $separator
+ * @param string   $string
+ * @param int|null $limit
+ *
+ * @return array
+ */
+function smarty_modifier_explode($separator, $string, ?int $limit = null)
+{
+    // provide $string default to prevent deprecation errors in PHP >=8.1
+    return explode($separator, $string ?? '', $limit ?? PHP_INT_MAX);
+}

libs/plugins/modifier.number_format.php

@@ -0,0 +1,26 @@
+<?php
+/**
+ * Smarty plugin
+ *
+ * @package    Smarty
+ * @subpackage PluginsModifier
+ */
+
+/**
+ * Smarty number_format modifier plugin
+ * Type:     modifier
+ * Name:     number_format
+ * Purpose:  Format a number with grouped thousands
+ *
+ * @param float|null  $num
+ * @param int         $decimals
+ * @param string|null $decimal_separator
+ * @param string|null $thousands_separator
+ *
+ * @return string
+ */
+function smarty_modifier_number_format(?float $num, int $decimals = 0, ?string $decimal_separator = ".", ?string $thousands_separator = ",")
+{
+    // provide $num default to prevent deprecation errors in PHP >=8.1
+    return number_format($num ?? 0.0, $decimals, $decimal_separator, $thousands_separator);
+}

libs/plugins/modifiercompiler.upper.php

@@ -21,8 +21,8 @@
 function smarty_modifiercompiler_upper($params)
 {
     if (Smarty::$_MBSTRING) {
-        return 'mb_strtoupper(' . $params[ 0 ] . ', \'' . addslashes(Smarty::$_CHARSET) . '\')';
+        return 'mb_strtoupper(' . $params[ 0 ] . ' ?? \'\', \'' . addslashes(Smarty::$_CHARSET) . '\')';
     }
     // no MBString fallback
-    return 'strtoupper(' . $params[ 0 ] . ')';
+    return 'strtoupper(' . $params[ 0 ] . ' ?? \'\')';
 }

libs/plugins/shared.mb_str_replace.php

@@ -62,7 +62,7 @@ if (!function_exists('smarty_mb_str_replace')) {
                 $replace = mb_convert_encoding($replace, $current_charset, Smarty::$_CHARSET);
             }
 
-            $parts = mb_split(preg_quote($search), $subject) ?: array();
+            $parts = mb_split(preg_quote($search), $subject ?? "") ?: array();
             // If original regex encoding was not unicode...
             if(!$reg_is_unicode) {
                 // ...restore original regex encoding to avoid breaking the system.

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierExplodeTest.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace UnitTests\TemplateSource\TagTests\PluginModifier;
+
+/**
+ * class for modifier tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginModifierExplodeTest extends \PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+    }
+
+    /**
+     * @return void
+     * @throws \SmartyException
+     *
+     * @dataProvider explodeDataProvider
+     */
+    public function testExplode($template, $subject, $expectedString)
+    {
+        $this->smarty->assign('subject', $subject);
+
+        $tpl = $this->smarty->createTemplate($template);
+        $res = $this->smarty->fetch($tpl);
+
+        $this->assertEquals($expectedString, $res);
+    }
+
+    public function explodeDataProvider()
+    {
+        return [
+            'default'  => [
+                'template'      => 'string:{","|explode:$subject|json_encode}',
+                'subject'       => 'a,b,c,d',
+                'expectedString' => '["a","b","c","d"]',
+            ],
+            'withNoDelimiterFound'  => [
+                'template'      => 'string:{","|explode:$subject|json_encode}',
+                'subject'       => 'abcd',
+                'expectedString' => '["abcd"]',
+            ],
+            'withNull' => [
+                'template'      => 'string:{","|explode:$subject|json_encode}',
+                'subject'       => null,
+                'expectedString' => '[""]',
+            ],
+        ];
+    }
+}

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierNumberFormatTest.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace UnitTests\TemplateSource\TagTests\PluginModifier;
+
+/**
+ * class for modifier tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginModifierNumberFormatTest extends \PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+    }
+
+    /**
+     * @return void
+     * @throws \SmartyException
+     *
+     * @dataProvider numberFormatDataProvider
+     */
+    public function testNumberFormat($template, $subject, $expectedString)
+    {
+        $this->smarty->assign('subject', $subject);
+
+        $tpl = $this->smarty->createTemplate($template);
+
+        $this->assertEquals($expectedString, $this->smarty->fetch($tpl));
+    }
+
+    public function numberFormatDataProvider()
+    {
+        return [
+            'default'  => [
+                'template'      => 'string:{$subject|number_format}',
+                'subject'       => 12345,
+                'expectedString' => "12,345",
+            ],
+            'withDecimalDefault'  => [
+                'template'      => 'string:{$subject|number_format}',
+                'subject'       => 12345.6789,
+                'expectedString' => "12,346",
+            ],
+            'withDecimalAndExtras'  => [
+                'template'      => 'string:{$subject|number_format:2:"-":"~"}',
+                'subject'       => 12345.6789,
+                'expectedString' => "12~345-68",
+            ],
+            'withNull' => [
+                'template'      => 'string:{$subject|number_format}',
+                'subject'       => null,
+                'expectedString' => 0,
+            ],
+        ];
+    }
+}

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierReplaceTest.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace UnitTests\TemplateSource\TagTests\PluginModifier;
+
+/**
+ * class for modifier tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginModifierReplaceTest extends \PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+    }
+
+    /**
+     * @return void
+     * @throws \SmartyException
+     *
+     * @dataProvider replaceDataProvider
+     */
+    public function testReplace($template, $subject, $expectedString)
+    {
+        $this->smarty->assign('subject', $subject);
+
+        $tpl = $this->smarty->createTemplate($template);
+
+        $this->assertEquals($expectedString, $this->smarty->fetch($tpl));
+    }
+
+    public function replaceDataProvider()
+    {
+        return [
+            'default'  => [
+                'template'      => 'string:{$subject|replace:",":"-"}',
+                'subject'       => "a,b,c,d",
+                'expectedString' => "a-b-c-d",
+            ],
+            'doNothing'  => [
+                'template'      => 'string:{$subject|replace:"":""}',
+                'subject'       => "a,b,c,d",
+                'expectedString' => "a,b,c,d",
+            ],
+            'withNull' => [
+                'template'      => 'string:{$subject|replace:"":""}',
+                'subject'       => null,
+                'expectedString' => "",
+            ],
+        ];
+    }
+}

tests/UnitTests/TemplateSource/ValueTests/Math/MathTest.php

@@ -156,4 +156,12 @@ class MathTest extends PHPUnit_Smarty
 		$this->assertEquals($expected, $this->smarty->fetch($tpl));
 	}
 
+	public function testRand()
+	{
+		$tpl = $this->smarty->createTemplate('eval:{$x = "0"}{math equation="x * rand()" x=$x}');
+		// this assertion may seem silly, but it serves to prove that using rand() without a parameter
+		// will not trigger a security error (see https://github.com/smarty-php/smarty/issues/794)
+		$this->assertEquals("0", $this->smarty->fetch($tpl));
+	}
+
 }