release 1.3.21

2022-12-18 13:13:44 +01:00
parent d2cb86e323
commit b96e32b713
35 changed files with 359 additions and 122 deletions
--- a/libs/smarty/.github/workflows/ci.yml
+++ b/libs/smarty/.github/workflows/ci.yml
@@ -0,0 +1,73 @@
+# https://help.github.com/en/categories/automating-your-workflow-with-github-actions
+
+on:
+  - pull_request
+  - push
+
+name: CI
+
+jobs:
+  tests:
+    name: Tests
+
+    runs-on: ${{ matrix.os }}
+
+    env:
+      PHP_EXTENSIONS: dom, json, libxml, mbstring, pdo_sqlite, soap, xml, xmlwriter
+      PHP_INI_VALUES: assert.exception=1, zend.assertions=1
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+
+        php-version:
+          - "7.1"
+          - "7.2"
+          - "7.3"
+          - "7.4"
+          - "8.0"
+
+        compiler:
+          - default
+
+        include:
+          - os: ubuntu-latest
+            php-version: "8.0"
+            compiler: jit
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    - name: Override PHP ini values for JIT compiler
+      if: matrix.compiler == 'jit'
+      run: echo "PHP_INI_VALUES::assert.exception=1, zend.assertions=1, opcache.enable=1, opcache.enable_cli=1, opcache.optimization_level=-1, opcache.jit=1255, opcache.jit_buffer_size=32M" >> $GITHUB_ENV
+
+    - name: Install PHP with extensions
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ matrix.php-version }}
+        coverage: pcov
+        extensions: ${{ env.PHP_EXTENSIONS }}
+        ini-values: ${{ env.PHP_INI_VALUES }}
+
+    - name: Validate composer.json and composer.lock
+      run: composer validate
+
+    - name: Cache Composer packages
+      id: composer-cache
+      uses: actions/cache@v2
+      with:
+        path: vendor
+        key: ${{ runner.os }}-php-${{ matrix.php-version }}-${{ hashFiles('**/composer.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-php-${{ matrix.php-version }}-
+
+    - name: Install dependencies
+      if: steps.composer-cache.outputs.cache-hit != 'true'
+      run: composer install --prefer-dist --no-progress --no-suggest
+
+    - name: Run tests with phpunit
+      run: ./phpunit.sh
--- a/libs/smarty/Smarty.class.php
+++ b/libs/smarty/Smarty.class.php
@@ -98,7 +98,7 @@ class Smarty extends Smarty_Internal_TemplateBase
    /**
     * smarty version
     */
-    const SMARTY_VERSION = '4.0.0-rc.0';
+    const SMARTY_VERSION = '4.1.0';
    /**
     * define variable scopes
     */
--- a/libs/smarty/plugins/function.mailto.php
+++ b/libs/smarty/plugins/function.mailto.php
@@ -94,22 +94,19 @@ function smarty_function_mailto($params)
        );
        return;
    }
-    // FIXME: (rodneyrehm) document.write() excues me what? 1998 has passed!
    if ($encode === 'javascript') {
-        $string = 'document.write(\'<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>\');';
+	    $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
        $js_encode = '';
        for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
            $js_encode .= '%' . bin2hex($string[ $x ]);
        }
-        return '<script type="text/javascript">eval(unescape(\'' . $js_encode . '\'))</script>';
+        return '<script type="text/javascript">document.write(unescape(\'' . $js_encode . '\'))</script>';
    } elseif ($encode === 'javascript_charcode') {
        $string = '<a href="mailto:' . $address . '" ' . $extra . '>' . $text . '</a>';
-        for ($x = 0, $y = strlen($string); $x < $y; $x++) {
+        for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
            $ord[] = ord($string[ $x ]);
        }
-        $_ret = "<script type=\"text/javascript\" language=\"javascript\">\n" . "{document.write(String.fromCharCode(" .
-                implode(',', $ord) . "))" . "}\n" . "</script>\n";
-        return $_ret;
+	    return '<script type="text/javascript">document.write(String.fromCharCode(' . implode(',', $ord) . '))</script>';
    } elseif ($encode === 'hex') {
        preg_match('!^(.*)(\?.*)$!', $address, $match);
        if (!empty($match[ 2 ])) {
--- a/libs/smarty/plugins/function.math.php
+++ b/libs/smarty/plugins/function.math.php
@@ -28,7 +28,12 @@ function smarty_function_math($params, $template)
            'int'   => true,
            'abs'   => true,
            'ceil'  => true,
+            'acos'   => true,
+            'acosh'   => true,
            'cos'   => true,
+            'cosh'   => true,
+            'deg2rad'   => true,
+            'rad2deg'   => true,
            'exp'   => true,
            'floor' => true,
            'log'   => true,
@@ -39,27 +44,51 @@ function smarty_function_math($params, $template)
            'pow'   => true,
            'rand'  => true,
            'round' => true,
+            'asin'   => true,
+            'asinh'   => true,
            'sin'   => true,
+            'sinh'   => true,
            'sqrt'  => true,
            'srand' => true,
-            'tan'   => true
+            'atan'   => true,
+            'atanh'   => true,
+            'tan'   => true,
+            'tanh'   => true
        );
+
    // be sure equation parameter is present
    if (empty($params[ 'equation' ])) {
        trigger_error("math: missing equation parameter", E_USER_WARNING);
        return;
    }
    $equation = $params[ 'equation' ];
+
+    // Remove whitespaces
+    $equation = preg_replace('/\s+/', '', $equation);
+
+    // Adapted from https://www.php.net/manual/en/function.eval.php#107377
+    $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
+    $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
+    $operators = '[+\/*\^%-]'; // Allowed math operators
+    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?1))?)+$/';
+
+    if (!preg_match($regexp, $equation)) {
+        trigger_error("math: illegal characters", E_USER_WARNING);
+        return;
+    }
+
    // make sure parenthesis are balanced
    if (substr_count($equation, '(') !== substr_count($equation, ')')) {
        trigger_error("math: unbalanced parenthesis", E_USER_WARNING);
        return;
    }
+
    // disallow backticks
    if (strpos($equation, '`') !== false) {
        trigger_error("math: backtick character not allowed in equation", E_USER_WARNING);
        return;
    }
+
    // also disallow dollar signs
    if (strpos($equation, '$') !== false) {
        trigger_error("math: dollar signs not allowed in equation", E_USER_WARNING);
@@ -96,6 +125,7 @@ function smarty_function_math($params, $template)
    }
    $smarty_math_result = null;
    eval("\$smarty_math_result = " . $equation . ";");
+
    if (empty($params[ 'format' ])) {
        if (empty($params[ 'assign' ])) {
            return $smarty_math_result;
--- a/libs/smarty/plugins/modifier.date_format.php
+++ b/libs/smarty/plugins/modifier.date_format.php
@@ -26,8 +26,11 @@
 * @return string |void
 * @uses   smarty_make_timestamp()
 */
+
 function smarty_modifier_date_format($string, $format = null, $default_date = '', $formatter = 'auto')
 {
+	#$format = %d.%m.%Y %H:%M:%S
+
    if ($format === null) {
        $format = Smarty::$_DATE_FORMAT;
    }
@@ -78,7 +81,13 @@ function smarty_modifier_date_format($string, $format = null, $default_date = ''
            }
            $format = str_replace($_win_from, $_win_to, $format);
        }
-        return strftime($format, $timestamp);
+		
+		$new_format = date_format_to($format, 'date');
+		#error_log("Smarty date format: ".$format."     new format: ".$new_format, 0);
+		
+		$date = DateTimeImmutable::createFromFormat('U', $timestamp);
+		return $date->format($new_format);
+        #return strftime($format, $timestamp);
    } else {
        return date($format, $timestamp);
    }
--- a/libs/smarty/plugins/shared.mb_str_replace.php
+++ b/libs/smarty/plugins/shared.mb_str_replace.php
@@ -44,7 +44,7 @@ if (!function_exists('smarty_mb_str_replace')) {
                }
            }
        } else {
-            $parts = mb_split(preg_quote($search), $subject);
+            $parts = mb_split(preg_quote($search), $subject) ?: array();
            $count = count($parts) - 1;
            $subject = implode($replace, $parts);
        }
--- a/libs/smarty/sysplugins/smarty_internal_cacheresource_file.php
+++ b/libs/smarty/sysplugins/smarty_internal_cacheresource_file.php
@@ -196,8 +196,8 @@ class Smarty_Internal_CacheResource_File extends Smarty_CacheResource
     */
    public function hasLock(Smarty $smarty, Smarty_Template_Cached $cached)
    {
-        clearstatcache(true, $cached->lock_id);
-        if (is_file($cached->lock_id)) {
+        clearstatcache(true, $cached->lock_id ?? '');
+        if (null !== $cached->lock_id && is_file($cached->lock_id)) {
            $t = filemtime($cached->lock_id);
            return $t && (time() - $t < $smarty->locking_timeout);
        } else {
--- a/libs/smarty/sysplugins/smarty_internal_compile_function.php
+++ b/libs/smarty/sysplugins/smarty_internal_compile_function.php
@@ -157,7 +157,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
            $output = "<?php echo \"/*%%SmartyNocache:{$compiler->template->compiled->nocache_hash}%%*/<?php ";
            $output .= "\\\$_smarty_tpl->smarty->ext->_tplFunction->restoreTemplateVariables(\\\$_smarty_tpl, '{$_name}');?>\n";
            $output .= "/*/%%SmartyNocache:{$compiler->template->compiled->nocache_hash}%%*/\";\n?>";
-            $output .= "<?php echo str_replace('{$compiler->template->compiled->nocache_hash}', \$_smarty_tpl->compiled->nocache_hash, ob_get_clean());\n";
+            $output .= "<?php echo str_replace('{$compiler->template->compiled->nocache_hash}', \$_smarty_tpl->compiled->nocache_hash ?? '', ob_get_clean());\n";
            $output .= "}\n}\n";
            $output .= "/*/ {$_funcName}_nocache */\n\n";
            $output .= "?>\n";
--- a/libs/smarty/sysplugins/smarty_internal_config_file_compiler.php
+++ b/libs/smarty/sysplugins/smarty_internal_config_file_compiler.php
@@ -158,7 +158,7 @@ class Smarty_Internal_Config_File_Compiler
        }
        // template header code
        $template_header =
-            "<?php /* Smarty version " . Smarty::SMARTY_VERSION . ", created on " . strftime("%Y-%m-%d %H:%M:%S") .
+            "<?php /* Smarty version " . Smarty::SMARTY_VERSION . ", created on " . date("Y-m-d H:i:s") .
            "\n";
        $template_header .= "         compiled from '{$this->template->source->filepath}' */ ?>\n";
        $code = '<?php $_smarty_tpl->smarty->ext->configLoad->_loadConfigVars($_smarty_tpl, ' .
--- a/libs/smarty/sysplugins/smarty_internal_runtime_codeframe.php
+++ b/libs/smarty/sysplugins/smarty_internal_runtime_codeframe.php
@@ -45,7 +45,7 @@ class Smarty_Internal_Runtime_CodeFrame
            $properties[ 'cache_lifetime' ] = $_template->cache_lifetime;
        }
        $output = "<?php\n";
-        $output .= "/* Smarty version {$properties[ 'version' ]}, created on " . strftime("%Y-%m-%d %H:%M:%S") .
+        $output .= "/* Smarty version {$properties[ 'version' ]}, created on " . date("Y-m-d H:i:s") .
                   "\n  from '" . str_replace('*/', '* /', $_template->source->filepath) . "' */\n\n";
        $output .= "/* @var Smarty_Internal_Template \$_smarty_tpl */\n";
        $dec = "\$_smarty_tpl->_decodeProperties(\$_smarty_tpl, " . var_export($properties, true) . ',' .
--- a/libs/smarty/sysplugins/smarty_internal_template.php
+++ b/libs/smarty/sysplugins/smarty_internal_template.php
@@ -24,6 +24,7 @@
 *
 * @method bool mustCompile()
 */
+ #[\AllowDynamicProperties]
 class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
 {
    /**
--- a/libs/smarty/sysplugins/smarty_internal_templatecompilerbase.php
+++ b/libs/smarty/sysplugins/smarty_internal_templatecompilerbase.php
@@ -1135,7 +1135,7 @@ abstract class Smarty_Internal_TemplateCompilerBase
            flush();
        }
        $e = new SmartyCompilerException($error_text);
-        $e->line = $line;
+        $e->setLine($line);
        $e->source = trim(preg_replace('![\t\r\n]+!', ' ', $match[ $line - 1 ]));
        $e->desc = $args;
        $e->template = $this->template->source->filepath;
--- a/libs/smarty/sysplugins/smarty_internal_templateparser.php
+++ b/libs/smarty/sysplugins/smarty_internal_templateparser.php
@@ -2397,6 +2397,9 @@ public static $yy_action = array(
    }
 // line 749 "../smarty/lexer/smarty_internal_templateparser.y"
    public function yy_r94(){
+	    if ($this->security && $this->security->static_classes !== array()) {
+		    $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
+	    }
    $prefixVar = $this->compiler->getNewPrefixVariable();
    if ($this->yystack[$this->yyidx + -2]->minor['var'] === '\'smarty\'') {
        $this->compiler->appendPrefixCode("<?php {$prefixVar} = ". $this->compiler->compileTag('private_special_variable',array(),$this->yystack[$this->yyidx + -2]->minor['smarty_internal_index']).';?>');
--- a/libs/smarty/sysplugins/smartycompilerexception.php
+++ b/libs/smarty/sysplugins/smartycompilerexception.php
@@ -16,12 +16,12 @@ class SmartyCompilerException extends SmartyException
    }

    /**
-     * The line number of the template error
-     *
-     * @type int|null
+     * @param int $line
     */
-    public $line = null;
-
+    public function setLine($line)
+    {
+        $this->line = $line;
+    }
    /**
     * The template source snippet relating to the error
     *