Merge branch 'release/5.8.3'

Fixes #1192

AGENTS.md

@@ -73,7 +73,7 @@ GitHub Actions (`.github/workflows/ci.yml`): matrix of PHP 7.2–8.5 on ubuntu +
 
 ## Docs
 
-Markdown in `docs/`, built with mkdocs + Material theme. Preview: `mkdocs serve`. Published via `mike deploy 5.x`.
+Markdown in `docs/`, built with mkdocs + Material theme. Install the toolchain with `pip install -r docs/requirements.txt`, then preview with `mkdocs serve`. Published via `mike deploy 5.x`.
 
 ## Release
 

CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.8.3] - 2026-06-28
+- fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
+
+
 ## [5.8.2] - 2026-06-24
 - Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
 - Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)

CONTRIBUTING.md

@@ -100,6 +100,11 @@ Enhancement suggestions are tracked as [GitHub issues](https://github.com/smarty
 The [docs](docs/index.md) are written in markdown, configured in [mkdocs.yml](mkdocs.yml) and published 
 to [GitHub pages](https://smarty-php.github.io/smarty) using [mkdocs](https://www.mkdocs.org/) and [mike](https://github.com/jimporter/mike).
 
+You need Python to build the docs. Install the required packages first:
+```bash
+pip install -r docs/requirements.txt
+```
+
 To preview the docs while you are writing, run:
 ```bash
 mkdocs serve

docs/requirements.txt

@@ -0,0 +1,14 @@
+# Python dependencies for building/previewing the docs.
+#
+#   pip install -r docs/requirements.txt
+#   mkdocs serve          # local preview
+#   mike deploy 5.x       # publish
+#
+# pymdown-extensions must be >=11: earlier releases pass filename=None to
+# Pygments, and Pygments >=2.19 then crashes with
+# "'NoneType' object has no attribute 'replace'" on any untitled code block.
+mkdocs>=1.6
+mkdocs-material>=9.7
+pymdown-extensions>=11
+Pygments>=2.19
+mike>=2.2

run-tests-for-all-php-versions.sh

@@ -5,7 +5,7 @@
 # - ./run-tests-for-all-php-versions.sh --group 20221124
 # - ./run-tests-for-all-php-versions.sh --exclude-group slow
 
-COMPOSE_CMD="mutagen-compose"
+COMPOSE_CMD="docker compose"
 
 $COMPOSE_CMD run --rm php72 ./run-tests.sh $@ && \
 $COMPOSE_CMD run --rm php73 ./run-tests.sh $@ && \

src/Runtime/InheritanceRuntime.php

@@ -69,12 +69,8 @@ class InheritanceRuntime {
 	 * @param array $blockNames outer level block name
 	 */
 	public function init(Template $tpl, $initChild, $blockNames = []) {
-		// if called while executing parent template it must be a sub-template with new inheritance root.
-		// A new root is started either by a child template ($initChild) or by a sub-template included
-		// outside of any block rendering (empty source stack); the latter must not inherit the leftover
-		// block overrides of a previously completed inheritance tree (see issue #1189).
-		if (($initChild || empty($this->sourceStack)) && $this->state === 3
-			&& (strpos($tpl->template_resource, 'extendsall') === false)) {
+		// if called while executing parent template it must be a sub-template with new inheritance root
+		if ($initChild && $this->state === 3 && (strpos($tpl->template_resource, 'extendsall') === false)) {
 			$tpl->setInheritance(clone $tpl->getSmarty()->getRuntime('Inheritance'));
 			$tpl->getInheritance()->init($tpl, $initChild, $blockNames);
 			return;

src/Smarty.php

@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
 	/**
 	 * smarty version
 	 */
-	const SMARTY_VERSION = '5.8.2';
+	const SMARTY_VERSION = '5.8.3';
 
 	/**
 	 * define caching modes

src/Template.php

@@ -260,7 +260,11 @@ class Template extends TemplateBase {
 
 		$tpl = $this->smarty->doCreateTemplate($template_name, $cache_id, $compile_id, $this, $caching, $cache_lifetime);
 
-		$tpl->inheritance = $this->getInheritance(); // re-use the same Inheritance object inside the inheritance tree
+		// Re-use the same Inheritance object only inside an active inheritance tree, i.e. when this
+		// (including) template already has one. A template outside any inheritance tree has no
+		// Inheritance object (null); sub-templates it {include}s must then start with their own, so an
+		// {include}d template that uses {block}/{extends} creates a fresh root via getInheritance().
+		$tpl->inheritance = $this->inheritance;
 
 		if ($scope) {
 			$tpl->defaultScope = $scope;

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -273,7 +273,10 @@ class SecurityTest extends PHPUnit_Smarty
 
 		$this->expectException(\Smarty\Exception::class);
 		$this->expectExceptionMessage('not trusted file path');
-		$this->smarty->fetch('string:{include file="' . $link . '"}');
+		// Use forward slashes: backslashes in a double-quoted template string are
+		// interpreted as escape sequences (\f, \r, ...), which would corrupt a
+		// Windows path. Forward slashes work on every platform.
+		$this->smarty->fetch('string:{include file="' . str_replace('\\', '/', $link) . '"}');
 	}
 
 	/**
@@ -292,7 +295,9 @@ class SecurityTest extends PHPUnit_Smarty
 
 		$this->smarty->security_policy->secure_dir = array($secureDir . DIRECTORY_SEPARATOR);
 
-		$this->assertEquals('inside-content', $this->smarty->fetch('string:{include file="' . $link . '"}'));
+		// Forward slashes so backslashes in a Windows path are not mistaken for
+		// escape sequences inside the double-quoted template string.
+		$this->assertEquals('inside-content', $this->smarty->fetch('string:{include file="' . str_replace('\\', '/', $link) . '"}'));
 	}
 
 	/**