mirror of https://github.com/smarty-php/smarty.git synced 2026-08-03 20:14:31 +02:00

Files

T

Simon Wisselink 11e69eca68 Security: escape value-context attributes in html_image/html_select_date (CWE-79)

{html_image} already escaped alt and pass-through attributes, but emitted
file, path_prefix, href/link, width and height raw, letting an untrusted
value break out of the generated tag. Escape these at output time; the
unescaped values are still used for getimagesize()/DPI math. Escaping uses
htmlspecialchars with double_encode=false, so existing entities and values
like "100%" are preserved (no BC break for legitimate values).

{html_select_date} treated day_size/month_size/year_size as strings and
emitted them raw into size="…"; cast them to int to match
{html_select_time} and close the breakout.

The remaining flagged parameters (mailto extra; html_table *_attr/
trailpad/caption/loop; html_radios/html_checkboxes separator;
html_select_* *_extra/field_separator and the unrecognised-attribute
pass-through) intentionally emit raw markup as documented, so escaping
them would break backwards compatibility. Add a security note to those
docs pages instead, telling authors to escape untrusted values themselves.

Adds tests for html_image escaping (incl. benign-value/no-double-encode
checks) and the html_select_date size cast.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-24 00:48:01 +02:00

5.9 KiB

Raw Blame History

{html_radios}

{html_radios} is a custom function that creates an HTML radio button group. It also takes care of which item is selected by default as well.

Attributes

Attribute Name	Required	Description
name	No	Name of radio list
values	Yes, unless using options attribute	An array of values for radio buttons
output	Yes, unless using options attribute	An array of output for radio buttons
selected	No	The selected radio element
options	Yes, unless using values and output	An associative array of values and output
separator	No	String of text to separate each radio item
assign	No	Assign radio tags to an array instead of output
labels	No	Add -tags to the output (defaults to true)
label_ids	No	Add id-attributes to <label> and <input> to the output (defaults to false)
escape	No	Escape the output / content (values are always escaped) (defaults to true)
strict	No	Will make the "extra" attributes disabled and readonly only be set, if they were supplied with either boolean TRUE or string "disabled" and "readonly" respectively (defaults to false)

Required attributes are values and output, unless you use options instead.
All output is XHTML compliant.
All parameters that are not in the list above are output as name/value-pairs inside each of the created <input>-tags.

Security note

The separator attribute is written into the generated HTML without escaping, so it can contain markup such as separator='<br />'. If its value originates from untrusted input, escape it yourself first to avoid cross-site scripting (XSS). Option values and labels are escaped automatically.

Examples

<?php

$smarty->assign('cust_ids', array(1000,1001,1002,1003));
$smarty->assign('cust_names', array(
                              'Joe Schmoe',
                              'Jack Smith',
                              'Jane Johnson',
                              'Charlie Brown')
                              );
$smarty->assign('customer_id', 1001);

Where template is:

{html_radios name='id' values=$cust_ids output=$cust_names
       selected=$customer_id separator='<br />'}

<?php
$smarty->assign('cust_radios', array(
                               1000 => 'Joe Schmoe',
                               1001 => 'Jack Smith',
                               1002 => 'Jane Johnson',
                               1003 => 'Charlie Brown'));
$smarty->assign('customer_id', 1001);

Where template is:


{html_radios name='id' options=$cust_radios
     selected=$customer_id separator='<br />'}

Both examples will output:

<label><input type="radio" name="id" value="1000" />Joe Schmoe</label><br />
<label><input type="radio" name="id" value="1001" checked="checked" />Jack Smith</label><br />
<label><input type="radio" name="id" value="1002" />Jane Johnson</label><br />
<label><input type="radio" name="id" value="1003" />Charlie Brown</label><br />


<?php

$sql = 'select type_id, types from contact_types order by type';
$smarty->assign('contact_types',$db->getAssoc($sql));

$sql = 'select contact_id, name, email, contact_type_id '
        .'from contacts where contact_id='.$contact_id;
$smarty->assign('contact',$db->getRow($sql));

The variable assigned from the database above would be output with the template:

{html_radios name='contact_type_id' options=$contact_types
     selected=$contact.contact_type_id separator='<br />'}

5.9 KiB Raw Blame History

{html_radios}

Attributes

Examples

5.9 KiB

Raw Blame History