Merge branch 'release/4.5.7' into support/4

Add missing end tag for 'assigned template variables' section.
backport of d6153d4

CHANGELOG.md

@@ -6,9 +6,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [4.5.5] - 2024-11-21
+## [4.5.7] - 2026-06-29
+- Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
+- Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
+- Security: `{fetch}` no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing `trusted_uri` (CWE-918 server-side request forgery)
 
 
+## [4.5.6] - 2025-08-26
+- Fixed that modifiers called like function would be compiled to modifier name instead of calling the registered callback [#1100](https://github.com/smarty-php/smarty/issues/1100)
+- Replace SMARTY_VERSION constant with $smarty.version in debug.tpl [#1073](https://github.com/smarty-php/smarty/issues/1073)
+
+
+- Fixed escaping of array/object keys in debug_print_var
+
+## [4.5.5] - 2024-11-21
+
 - Support the deprecations introduced in PHP 8.4 and added tests for PHP 8.4 [#1084](https://github.com/smarty-php/smarty/pull/1084)
 
 ## [4.5.4] - 2024-08-14

docs/designers/language-modifiers/index.md

@@ -12,10 +12,12 @@ These parameters follow the modifier name and are separated by a `:`
 
 - [capitalize](language-modifier-capitalize.md)
 - [cat](language-modifier-cat.md)
+- [count](language-modifier-count.md)
 - [count_characters](language-modifier-count-characters.md)
 - [count_paragraphs](language-modifier-count-paragraphs.md)
 - [count_sentences](language-modifier-count-sentences.md)
 - [count_words](language-modifier-count-words.md)
+- [debug_print_var](language-modifier-debug-print-var.md)
 - [date_format](language-modifier-date-format.md)
 - [default](language-modifier-default.md)
 - [escape](language-modifier-escape.md)

docs/designers/language-modifiers/language-modifier-count.md

@@ -0,0 +1,21 @@
+# count
+
+Returns the number of elements in an array (or Countable object). Will return 0 for null.
+Returns 1 for any other type (such as a string).
+
+If the optional mode parameter is set to 1, count() will recursively count the array. 
+This is particularly useful for counting all the elements of a multidimensional array.
+
+## Basic usage
+```smarty
+{if $myVar|count > 3}4 or more{/if}
+{if count($myVar) > 3}4 or more{/if}
+```
+
+
+## Parameters
+
+| Parameter | Type | Required | Description                                            |
+|-----------|------|----------|--------------------------------------------------------|
+| 1         | int  | No       | If set to 1, count() will recursively count the array. |
+

docs/designers/language-modifiers/language-modifier-debug-print-var.md

@@ -0,0 +1,26 @@
+# debug_print_var
+
+
+
+Returns the value of the given variable in a human-readable format in HTML. 
+Used in the [debug console](../chapter-debugging-console.md), but you can also use it in your template
+while developing to see what is going on under the hood.
+
+> **Note**
+>
+> Use for debugging only! Since you may accidentally reveal sensitive information or introduce vulnerabilities such as XSS using this
+method never use it in production.
+
+## Basic usage
+```smarty
+{$myVar|debug_print_var}
+```
+
+
+## Parameters
+
+| Parameter | Type | Required | Description                                                            |
+|-----------|------|----------|------------------------------------------------------------------------|
+| 1         | int  | No       | maximum recursion depth if $var is an array or object (defaults to 10) |
+| 2         | int  | No       | maximum string length if $var is a string (defaults to 40)             |
+

libs/Smarty.class.php

@@ -107,7 +107,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.5.5';
+    const SMARTY_VERSION = '4.5.7';
     /**
      * define variable scopes
      */

libs/debug.tpl

@@ -108,7 +108,7 @@
     </head>
     <body>
 
-    <h1>Smarty {Smarty::SMARTY_VERSION} Debug Console
+    <h1>Smarty {$smarty.version} Debug Console
         -  {if isset($template_name)}{$template_name|debug_print_var nofilter} {/if}{if !empty($template_data)}Total Time {$execution_time|string_format:"%.5f"}{/if}</h1>
 
     {if !empty($template_data)}
@@ -144,6 +144,7 @@
                         {$vars['attributes']|debug_print_var nofilter}
                     {/if}
                 </td>
+            </tr>
          {/foreach}
     </table>
 

libs/plugins/function.fetch.php

@@ -191,7 +191,24 @@ function smarty_function_fetch($params, $template)
             return;
         }
     } else {
-        $content = @file_get_contents($params[ 'file' ]);
+        if ($protocol && isset($template->smarty->security_policy)) {
+            // Remote resource (e.g. https://) reached through file_get_contents().
+            // isTrustedUri() only validates the initial URL, but file_get_contents()
+            // follows redirects by default, so an open redirect on an otherwise
+            // trusted host could be used to reach a non-trusted target (SSRF).
+            // Disable redirect-following while a security policy is in effect.
+            $context = stream_context_create(
+                array(
+                    'http' => array(
+                        'follow_location' => 0,
+                        'max_redirects'   => 1,
+                    ),
+                )
+            );
+            $content = @file_get_contents($params[ 'file' ], false, $context);
+        } else {
+            $content = @file_get_contents($params[ 'file' ]);
+        }
         if ($content === false) {
             throw new SmartyException("{fetch} cannot read resource '" . $params[ 'file' ] . "'");
         }

libs/plugins/function.html_image.php

@@ -75,7 +75,7 @@ function smarty_function_html_image($params, Smarty_Internal_Template $template)
                 break;
             case 'link':
             case 'href':
-                $prefix = '<a href="' . $_val . '">';
+                $prefix = '<a href="' . smarty_function_escape_special_chars($_val) . '">';
                 $suffix = '</a>';
                 break;
             default:
@@ -153,6 +153,11 @@ function smarty_function_html_image($params, Smarty_Internal_Template $template)
         $width = round($width * $_resize);
         $height = round($height * $_resize);
     }
-    return $prefix . '<img src="' . $path_prefix . $file . '" alt="' . $alt . '" width="' . $width . '" height="' .
-           $height . '"' . $extra . ' />' . $suffix;
+    // $alt and the pass-through attributes ($extra) are already escaped above;
+    // escape the remaining value-context params at output time so untrusted
+    // values cannot break out of the attribute (CWE-79). The unescaped $file/
+    // $width/$height are still used for getimagesize()/DPI math above.
+    return $prefix . '<img src="' . smarty_function_escape_special_chars($path_prefix . $file) . '" alt="' . $alt
+           . '" width="' . smarty_function_escape_special_chars($width) . '" height="'
+           . smarty_function_escape_special_chars($height) . '"' . $extra . ' />' . $suffix;
 }

libs/plugins/function.html_select_date.php

@@ -131,9 +131,6 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
             case 'day_value_format':
             case 'month_format':
             case 'month_value_format':
-            case 'day_size':
-            case 'month_size':
-            case 'year_size':
             case 'all_extra':
             case 'day_extra':
             case 'month_extra':
@@ -151,6 +148,13 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
             case 'year_id':
                 $$_key = (string)$_value;
                 break;
+            case 'day_size':
+            case 'month_size':
+            case 'year_size':
+                // numeric HTML size attribute; cast to int (consistent with
+                // html_select_time) so it cannot break out of size="…" (CWE-79)
+                $$_key = (int)$_value;
+                break;
             case 'display_days':
             case 'display_months':
             case 'display_years':

libs/plugins/modifier.debug_print_var.php

@@ -31,7 +31,7 @@ function smarty_modifier_debug_print_var($var, $max = 10, $length = 40, $depth =
                 break;
             }
             foreach ($var as $curr_key => $curr_val) {
-                $results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b>' . strtr($curr_key, $_replace) .
+                $results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b>' . htmlspecialchars(strtr($curr_key, $_replace)) .
                             '</b> =&gt; ' .
                             smarty_modifier_debug_print_var($curr_val, $max, $length, ++$depth, $objects);
                 $depth--;
@@ -49,7 +49,7 @@ function smarty_modifier_debug_print_var($var, $max = 10, $length = 40, $depth =
             }
             $objects[] = $var;
             foreach ($object_vars as $curr_key => $curr_val) {
-                $results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b> -&gt;' . strtr($curr_key, $_replace) .
+                $results .= '<br>' . str_repeat('&nbsp;', $depth * 2) . '<b> -&gt;' . htmlspecialchars(strtr($curr_key, $_replace)) .
                             '</b> = ' . smarty_modifier_debug_print_var($curr_val, $max, $length, ++$depth, $objects);
                 $depth--;
             }

libs/sysplugins/smarty_internal_templatecompilerbase.php

@@ -455,28 +455,28 @@ abstract class Smarty_Internal_TemplateCompilerBase
             $this->smarty->_current_file = $this->template->source->filepath;
             // get template source
             if (!empty($this->template->source->components)) {
-				$_compiled_code = '<?php $_smarty_tpl->_loadInheritance(); $_smarty_tpl->inheritance->init($_smarty_tpl, true); ?>';
+                $_compiled_code = '<?php $_smarty_tpl->_loadInheritance(); $_smarty_tpl->inheritance->init($_smarty_tpl, true); ?>';
 
-				$i = 0;
-				$reversed_components = array_reverse($this->template->getSource()->components);
-				foreach ($reversed_components as $source) {
-					$i++;
-					if ($i === count($reversed_components)) {
-						$_compiled_code .= '<?php $_smarty_tpl->inheritance->endChild($_smarty_tpl); ?>';
-					}
-					$_compiled_code .= $this->compileTag(
-						'include',
-						[
-							var_export($source->resource, true),
-							['scope' => 'parent'],
-						]
-					);
-				}
-				$_compiled_code = $this->postFilter($_compiled_code, $this->template);
+                $i = 0;
+                $reversed_components = array_reverse($this->template->getSource()->components);
+                foreach ($reversed_components as $source) {
+                    $i++;
+                    if ($i === count($reversed_components)) {
+                        $_compiled_code .= '<?php $_smarty_tpl->inheritance->endChild($_smarty_tpl); ?>';
+                    }
+                    $_compiled_code .= $this->compileTag(
+                        'include',
+                        [
+                            var_export($source->resource, true),
+                            ['scope' => 'parent'],
+                        ]
+                    );
+                }
+                $_compiled_code = $this->postFilter($_compiled_code, $this->template);
             } else {
                 // get template source
                 $_content = $this->template->source->getContent();
-				$_compiled_code = $this->postFilter($this->doCompile($this->preFilter($_content), true));
+                $_compiled_code = $this->postFilter($this->doCompile($this->preFilter($_content), true));
             }
             if (!empty($this->required_plugins[ 'compiled' ]) || !empty($this->required_plugins[ 'nocache' ])) {
                 $_compiled_code = '<?php ' . $this->compileRequiredPlugins() . "?>\n" . $_compiled_code;
@@ -617,7 +617,8 @@ abstract class Smarty_Internal_TemplateCompilerBase
     {
         if (!$this->smarty->security_policy || $this->smarty->security_policy->isTrustedPhpFunction($name, $this)) {
             if (strcasecmp($name, 'isset') === 0 || strcasecmp($name, 'empty') === 0
-                || strcasecmp($name, 'array') === 0 || is_callable($name)
+                || strcasecmp($name, 'array') === 0
+                || (is_callable($name) && !isset($this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name]))
             ) {
                 $func_name = smarty_strtolower_ascii($name);
 
@@ -649,28 +650,42 @@ abstract class Smarty_Internal_TemplateCompilerBase
                     }
                     if ($func_name === 'empty') {
                         return $func_name . '(' .
-                               str_replace("')->value", "',null,true,false)->value", $parameter[ 0 ]) . ')';
+                            str_replace("')->value", "',null,true,false)->value", $parameter[0]) . ')';
                     } else {
-                        return $func_name . '(' . $parameter[ 0 ] . ')';
+                        return $func_name . '(' . $parameter[0] . ')';
                     }
                 } else {
 
-					if (
-						!$this->smarty->loadPlugin('smarty_modifiercompiler_' . $name)
-						&& !isset($this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name])
-						&& !in_array($name, ['time', 'join', 'is_array', 'in_array', 'count'])
-					) {
-						trigger_error('Using unregistered function "' . $name . '" in a template is deprecated and will be ' .
-							'removed in a future release. Use Smarty::registerPlugin to explicitly register ' .
-							'a custom modifier.', E_USER_DEPRECATED);
-					}
+                    if (
+                        !$this->smarty->loadPlugin('smarty_modifiercompiler_' . $name)
+                        && !isset($this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name])
+                        && !in_array($name, ['time', 'join', 'is_array', 'in_array', 'count'])
+                    ) {
+                        trigger_error('Using unregistered function "' . $name . '" in a template is deprecated and will be ' .
+                            'removed in a future release. Use Smarty::registerPlugin to explicitly register ' .
+                            'a custom modifier.', E_USER_DEPRECATED);
+                    }
 
-					return $name . '(' . implode(',', $parameter) . ')';
+                    return $name . '(' . implode(',', $parameter) . ')';
                 }
-            } else {
-                $this->trigger_template_error("unknown function '{$name}'");
+
             }
         }
+
+        if (isset($this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name])) {
+            if ($name === $this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name][0]) {
+                return $name . '(' . implode(',', $parameter) . ')';
+            }
+
+            return sprintf(
+                'call_user_func_array($_smarty_tpl->registered_plugins[ \'%s\' ][ %s ][ 0 ], array( %s ))',
+                Smarty::PLUGIN_MODIFIER,
+                var_export($name, true),
+                implode(',', $parameter)
+            );
+        }
+
+        $this->trigger_template_error("unknown function '{$name}'");
     }
 
     /**

libs/sysplugins/smarty_security.php

@@ -590,12 +590,34 @@ class Smarty_Security
      */
     private function _checkDir($filepath, $dirs)
     {
-        $directory = dirname($this->smarty->_realpath($filepath, true)) . DIRECTORY_SEPARATOR;
+        // Resolve the canonical, symlink-free path of the requested file so that
+        // a symlink located inside a trusted directory cannot be abused to read
+        // a file outside of it (CWE-22 path traversal). Smarty::_realpath() only
+        // normalizes the path as a string and does not follow symlinks, so we
+        // fall back to it only when the file does not yet exist on disk (e.g.
+        // config/cache paths that are validated before being written).
+        $realpath = @realpath($filepath);
+        $resolved = $realpath !== false ? $realpath : $this->smarty->_realpath($filepath, true);
+        $directory = dirname($resolved) . DIRECTORY_SEPARATOR;
+
+        // Canonicalize the trusted directories the same way. This keeps
+        // legitimate symlinked deployment paths working (e.g. a Capistrano-style
+        // "current" release symlink, or macOS' /var -> /private/var): both the
+        // file and the trusted directories are compared after symlinks have been
+        // resolved.
+        $trusted = array();
+        foreach ($dirs as $dir => $unused) {
+            $trusted[ $dir ] = true;
+            if (($dirRealpath = @realpath($dir)) !== false) {
+                $trusted[ rtrim($dirRealpath, '\\/') . DIRECTORY_SEPARATOR ] = true;
+            }
+        }
+
         $_directory = array();
         if (!preg_match('#[\\\\/][.][.][\\\\/]#', $directory)) {
             while (true) {
                 // test if the directory is trusted
-                if (isset($dirs[ $directory ])) {
+                if (isset($trusted[ $directory ])) {
                     return $_directory;
                 }
                 // abort if we've reached root

mkdocs.yml

@@ -49,10 +49,12 @@ nav:
         - 'Introduction': 'designers/language-modifiers/index.md'
         - 'capitalize': 'designers/language-modifiers/language-modifier-capitalize.md'
         - 'cat': 'designers/language-modifiers/language-modifier-cat.md'
+        - 'count': 'designers/language-modifiers/language-modifier-count.md'
         - 'count_characters': 'designers/language-modifiers/language-modifier-count-characters.md'
         - 'count_paragraphs': 'designers/language-modifiers/language-modifier-count-paragraphs.md'
         - 'count_sentences': 'designers/language-modifiers/language-modifier-count-sentences.md'
         - 'count_words': 'designers/language-modifiers/language-modifier-count-words.md'
+        - 'debug_print_var': 'designers/language-modifiers/language-modifier-debug-print-var.md'
         - 'date_format': 'designers/language-modifiers/language-modifier-date-format.md'
         - 'default': 'designers/language-modifiers/language-modifier-default.md'
         - 'escape': 'designers/language-modifiers/language-modifier-escape.md'
@@ -122,4 +124,4 @@ nav:
       - 'programmers/caching.md'
       - 'programmers/resources.md'
       - 'programmers/advanced-features.md'
-      - 'programmers/plugins.md'
+      - 'programmers/plugins.md'

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -375,6 +375,87 @@ class SecurityTest extends PHPUnit_Smarty
         $this->smarty->display('string:{$smarty.template_object}');
     }
 
+    /**
+     * A symlink located inside a trusted secure_dir must not be usable to read
+     * a file outside of it (CWE-22 path traversal via symlink).
+     */
+    public function testSymlinkEscapeFromSecureDirIsRejected()
+    {
+        list($secureDir, $outsideFile) = $this->createSymlinkFixture('secret-outside-content');
+        $link = $secureDir . DIRECTORY_SEPARATOR . 'finance_doc';
+        if (!@symlink($outsideFile, $link)) {
+            $this->markTestSkipped('Unable to create symlinks on this platform');
+        }
+
+        $this->smarty->security_policy->secure_dir = array($secureDir . DIRECTORY_SEPARATOR);
+
+        $this->expectException('SmartyException');
+        $this->expectExceptionMessage('not trusted file path');
+        // Use forward slashes: backslashes in a double-quoted template string are
+        // interpreted as escape sequences (\f, \r, ...), which would corrupt a
+        // Windows path. Forward slashes work on every platform.
+        $this->smarty->fetch('string:{include file="' . str_replace('\\', '/', $link) . '"}');
+    }
+
+    /**
+     * A symlink that stays inside the trusted secure_dir must keep working, so
+     * legitimate (e.g. deployment) symlinks are not broken by the fix above.
+     */
+    public function testSymlinkWithinSecureDirIsAllowed()
+    {
+        list($secureDir) = $this->createSymlinkFixture('secret-outside-content');
+        $target = $secureDir . DIRECTORY_SEPARATOR . 'real.tpl';
+        file_put_contents($target, 'inside-content');
+        $link = $secureDir . DIRECTORY_SEPARATOR . 'linked.tpl';
+        if (!@symlink($target, $link)) {
+            $this->markTestSkipped('Unable to create symlinks on this platform');
+        }
+
+        $this->smarty->security_policy->secure_dir = array($secureDir . DIRECTORY_SEPARATOR);
+
+        // Forward slashes so backslashes in a Windows path are not mistaken for
+        // escape sequences inside the double-quoted template string.
+        $this->assertEquals('inside-content', $this->smarty->fetch('string:{include file="' . str_replace('\\', '/', $link) . '"}'));
+    }
+
+    /**
+     * Builds a temporary directory tree for the symlink tests: a (canonicalized)
+     * secure directory plus a file located outside of it. The tree is removed in
+     * tearDown(). Returns array(secureDir, outsideFile).
+     */
+    private function createSymlinkFixture($outsideContent)
+    {
+        $base = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'smarty_symlink_' . getmypid() . '_' . uniqid();
+        $secureDir = $base . DIRECTORY_SEPARATOR . 'secure';
+        mkdir($secureDir, 0777, true);
+        $outsideFile = $base . DIRECTORY_SEPARATOR . 'outside.txt';
+        file_put_contents($outsideFile, $outsideContent);
+
+        // Canonicalize so secure_dir is symlink-free (sys_get_temp_dir() itself
+        // may sit under a symlink, e.g. /var -> /private/var on macOS).
+        $this->symlinkFixtureDir = realpath($base);
+        return array(realpath($secureDir), realpath($outsideFile));
+    }
+
+    /** @var string|null temp dir created by createSymlinkFixture(), removed in tearDown */
+    private $symlinkFixtureDir = null;
+
+    protected function tearDown(): void
+    {
+        if (!empty($this->symlinkFixtureDir) && is_dir($this->symlinkFixtureDir)) {
+            $it = new \RecursiveIteratorIterator(
+                new \RecursiveDirectoryIterator($this->symlinkFixtureDir, \FilesystemIterator::SKIP_DOTS),
+                \RecursiveIteratorIterator::CHILD_FIRST
+            );
+            foreach ($it as $entry) {
+                ($entry->isDir() && !$entry->isLink()) ? rmdir($entry->getPathname()) : unlink($entry->getPathname());
+            }
+            rmdir($this->symlinkFixtureDir);
+            $this->symlinkFixtureDir = null;
+        }
+        parent::tearDown();
+    }
+
 }
 
 class mysecuritystaticclass

tests/UnitTests/SmartyMethodsTests/RegisterModifier/RegisterModifierFirstClassCallablesTest.php

@@ -0,0 +1,55 @@
+<?php
+// first class callables where introduced in PHP 8.1
+if (PHP_VERSION_ID >= 80100) {
+
+	/**
+	 * class for register modifier with (first class) callables tests
+	 *
+	 * @runTestsInSeparateProcess
+	 * @preserveGlobalState disabled
+	 * @backupStaticAttributes enabled
+	 */
+	class RegisterModifierFirstClassCallablesTest extends PHPUnit_Smarty
+	{
+		public function setUp(): void
+		{
+			$this->setUpSmarty(__DIR__);
+		}
+
+
+		public function testInit()
+		{
+			$this->cleanDirs();
+		}
+
+		public function testRegisterFirstClassCallable()
+		{
+			$this->smarty->registerPlugin(Smarty::PLUGIN_MODIFIER, 'testmodifier', eval('return strrev(...);'));
+			$this->assertEquals('mosredna', $this->smarty->fetch('string:{"andersom"|testmodifier}'));
+		}
+
+		public function testRegisterFirstClassCallableSameName()
+		{
+			$this->smarty->registerPlugin(Smarty::PLUGIN_MODIFIER, 'mymodifier', eval('return strrev(...);'));
+			$this->assertEquals('mosredna', $this->smarty->fetch('string:{"andersom"|mymodifier}'));
+		}
+
+		public function testRegisterFirstClassCallableAsFunc()
+		{
+			$this->smarty->registerPlugin(Smarty::PLUGIN_MODIFIER, 'kprint_r_out', eval('return strrev(...);'));
+			$this->smarty->assign('myVar', 'andersom');
+			$this->assertEquals('mosredna', $this->smarty->fetch('string:{kprint_r_out($myVar)}'));
+		}
+
+		public function testRegisterFirstClassCallableSameNameAsPhpFunc()
+		{
+			$this->smarty->registerPlugin(Smarty::PLUGIN_MODIFIER, 'mymodifierfcc', eval('return strrev(...);'));
+			$this->assertEquals('mosredna', $this->smarty->fetch('string:{mymodifierfcc("andersom")}'));
+		}
+
+	}
+}
+function mymodifierfcc($a, $b, $c)
+{
+	return "$a function $b $c";
+}

tests/UnitTests/SmartyMethodsTests/RegisterModifier/RegisterModifierTest.php

@@ -88,6 +88,22 @@ class RegisterModifierTest extends PHPUnit_Smarty
         $this->smarty->unregisterPlugin(Smarty::PLUGIN_MODIFIER, 'testmodifier');
         $this->assertTrue(isset($this->smarty->registered_plugins[Smarty::PLUGIN_BLOCK]['testmodifier']));
     }
+
+
+    public function testRegisterNativePhpFuncAsString()
+    {
+        $this->smarty->registerPlugin(Smarty::PLUGIN_MODIFIER, 'strrev', 'strrev');
+        $this->smarty->assign('myVar', 'andersom');
+        $this->assertEquals('mosredna', $this->smarty->fetch('string:{strrev($myVar)}'));
+    }
+
+    public function testRegisterNativePhpFuncUnderDifferentName()
+    {
+        $this->smarty->registerPlugin(Smarty::PLUGIN_MODIFIER, 'k_xyz_a', 'strrev');
+        $this->smarty->assign('myVar', 'andersom');
+        $this->assertEquals('mosredna', $this->smarty->fetch('string:{k_xyz_a($myVar)}'));
+    }
+
 }
 
 function mymodifier($a, $b, $c)

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionFetchTest.php

@@ -82,4 +82,99 @@ class PluginFunctionFetchTest extends PHPUnit_Smarty
       $this->smarty->fetch('string:{fetch file="/templates/../etc/passwd"}');
   }
 
+    /**
+     * When a security policy is in effect, {fetch} of a remote resource must not
+     * follow redirects, otherwise an open redirect on a trusted host could be
+     * used to bypass trusted_uri and reach an internal target (SSRF, CWE-918).
+     *
+     * @runInSeparateProcess
+     * @preserveGlobalState disabled
+     */
+    public function testFetchRemoteDisablesRedirectsUnderSecurity()
+    {
+        FetchContextCaptureStreamWrapper::$capturedOptions = null;
+        stream_wrapper_register('ssrftest', 'FetchContextCaptureStreamWrapper');
+        try {
+            $this->smarty->enableSecurity();
+            $this->smarty->security_policy->trusted_uri[] = '/^ssrftest:\/\/allowed$/';
+
+            $result = $this->smarty->fetch('string:{fetch file="ssrftest://allowed/data"}');
+
+            $this->assertSame('BODY', $result);
+            $this->assertIsArray(FetchContextCaptureStreamWrapper::$capturedOptions);
+            $this->assertArrayHasKey('http', FetchContextCaptureStreamWrapper::$capturedOptions);
+            $this->assertSame(0, FetchContextCaptureStreamWrapper::$capturedOptions['http']['follow_location']);
+            $this->assertLessThanOrEqual(1, FetchContextCaptureStreamWrapper::$capturedOptions['http']['max_redirects']);
+        } finally {
+            stream_wrapper_unregister('ssrftest');
+        }
+    }
+
+    /**
+     * Without a security policy there is no trusted_uri to bypass, so the
+     * redirect-disabling stream context is not applied (backwards compatible).
+     *
+     * @runInSeparateProcess
+     * @preserveGlobalState disabled
+     */
+    public function testFetchRemoteKeepsDefaultBehaviorWithoutSecurity()
+    {
+        FetchContextCaptureStreamWrapper::$capturedOptions = null;
+        stream_wrapper_register('ssrftest', 'FetchContextCaptureStreamWrapper');
+        try {
+            $result = $this->smarty->fetch('string:{fetch file="ssrftest://allowed/data"}');
+
+            $this->assertSame('BODY', $result);
+            $this->assertSame(array(), FetchContextCaptureStreamWrapper::$capturedOptions);
+        } finally {
+            stream_wrapper_unregister('ssrftest');
+        }
+    }
+
+}
+
+/**
+ * Minimal custom stream wrapper used by the fetch SSRF tests: it records the
+ * stream context options that {fetch} passes to file_get_contents() and returns
+ * a fixed body so the call succeeds without touching the network.
+ */
+class FetchContextCaptureStreamWrapper
+{
+    /** @var resource|null populated by PHP when a context is passed */
+    public $context;
+
+    /** @var array|null options captured from the context on the last open */
+    public static $capturedOptions = null;
+
+    private $read = false;
+
+    public function stream_open($path, $mode, $options, &$opened_path)
+    {
+        self::$capturedOptions = isset($this->context) ? stream_context_get_options($this->context) : array();
+        return true;
+    }
+
+    public function stream_read($count)
+    {
+        if ($this->read) {
+            return '';
+        }
+        $this->read = true;
+        return 'BODY';
+    }
+
+    public function stream_eof()
+    {
+        return $this->read;
+    }
+
+    public function stream_stat()
+    {
+        return array();
+    }
+
+    public function url_stat($path, $flags)
+    {
+        return array();
+    }
 }

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionHtmlImageTest.php

@@ -0,0 +1,84 @@
+<?php
+/**
+ * Smarty PHPunit tests of the {html_image} function plugin
+ *
+ * @package PHPunit
+ */
+
+/**
+ * class for {html_image} tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState disabled
+ * @backupStaticAttributes enabled
+ */
+class PluginFunctionHtmlImageTest extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+    }
+
+    public function testInit()
+    {
+        $this->cleanDirs();
+    }
+
+    /**
+     * Passing both width and height skips the getimagesize() lookup, so no real
+     * image file is needed to render the tag.
+     */
+    private function render($params)
+    {
+        $tpl = $this->smarty->createTemplate('eval:{html_image file=$file width=$width height=$height href=$href path_prefix=$path_prefix}');
+        $tpl->assign($params + array(
+            'file'        => 'pic.jpg',
+            'width'       => 44,
+            'height'      => 68,
+            'href'        => '',
+            'path_prefix' => '',
+        ));
+        return $tpl->fetch();
+    }
+
+    public function testHrefIsEscaped()
+    {
+        $result = $this->render(array('href' => '"><script>alert(1)</script>'));
+        $this->assertStringNotContainsString('<script>', $result);
+        $this->assertStringContainsString('&lt;script&gt;', $result);
+    }
+
+    public function testWidthIsEscaped()
+    {
+        $result = $this->render(array('width' => '44" onload="alert(1)'));
+        $this->assertStringNotContainsString('onload="', $result);
+        $this->assertStringContainsString('&quot;', $result);
+    }
+
+    public function testHeightIsEscaped()
+    {
+        $result = $this->render(array('height' => '68" onmouseover="alert(1)'));
+        $this->assertStringNotContainsString('onmouseover="', $result);
+    }
+
+    public function testFileAndPathPrefixAreEscaped()
+    {
+        $result = $this->render(array('file' => 'pic.jpg"><script>alert(1)</script>', 'path_prefix' => '"><b>'));
+        $this->assertStringNotContainsString('<script>', $result);
+        $this->assertStringNotContainsString('<b>', $result);
+    }
+
+    /**
+     * Benign values must be unchanged (no breakage, no double-encoding of an
+     * ampersand already present in a URL).
+     */
+    public function testBenignValuesAreUnchanged()
+    {
+        $result = $this->render(array('width' => 44, 'height' => 68, 'href' => 'detail.php?id=1&page=2'));
+        $this->assertStringContainsString('width="44"', $result);
+        $this->assertStringContainsString('height="68"', $result);
+        $this->assertStringContainsString('src="pic.jpg"', $result);
+        $this->assertStringContainsString('href="detail.php?id=1&amp;page=2"', $result);
+        $this->assertStringNotContainsString('&amp;amp;', $result);
+    }
+}

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionHtmlSelectDateTest.php

@@ -308,6 +308,19 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
         $this->assertEquals($result, $tpl->fetch());
     }
 
+    /**
+     * day_size/month_size/year_size are numeric HTML size attributes and are
+     * cast to int (consistent with html_select_time) so an untrusted value
+     * cannot break out of size="…" (CWE-79).
+     */
+    public function testSizeIsCastToInt()
+    {
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time=' . $this->now . ' year_size="5\" onfocus=alert(1) x=\""}');
+        $result = $tpl->fetch();
+        $this->assertStringContainsString('size="5"', $result);
+        $this->assertStringNotContainsString('onfocus', $result);
+    }
+
     public function testFieldOrder()
     {
         $n = "\n";

tests/UnitTests/TemplateSource/_Issues/1189/IncludeExtendsBlockLeakIssue1189Test.php

@@ -0,0 +1,33 @@
+<?php
+/**
+ * Smarty PHPunit test reproducing issue #1189.
+ *
+ * When a parent template is {include}d, then a child template that {extends}
+ * the parent overrides a {block}, a subsequent {include} of the parent in the
+ * same render must still show the parent's block content.
+ *
+ * The block override from the extending child must not leak into the later
+ * include of the parent template.
+ *
+ * @see https://github.com/smarty-php/smarty/issues/1189
+ *
+ * @preserveGlobalState    disabled
+ */
+class IncludeExtendsBlockLeakIssue1189Test extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+    }
+
+    /**
+     * Sequence: include parent -> include child(extends parent) -> include parent.
+     * Expected: PARENT CHILD PARENT
+     * Bug (#1189): PARENT CHILD CHILD
+     */
+    public function testBlockOverrideDoesNotLeakIntoLaterParentInclude()
+    {
+        $result = $this->smarty->fetch('top.tpl');
+        $this->assertSame('PARENT CHILD PARENT', preg_replace('/\s+/', ' ', trim($result)));
+    }
+}

tests/UnitTests/TemplateSource/_Issues/1189/templates/child.tpl

@@ -0,0 +1,2 @@
+{extends file="parent.tpl"}
+{block name=message}CHILD{/block}

tests/UnitTests/TemplateSource/_Issues/1189/templates/parent.tpl

@@ -0,0 +1 @@
+{block name=message}PARENT{/block}

tests/UnitTests/TemplateSource/_Issues/1189/templates/top.tpl

@@ -0,0 +1 @@
+{include file="parent.tpl"} {include file="child.tpl"} {include file="parent.tpl"}