diff --git a/tools/smarty/Smarty.class.php b/tools/smarty/Smarty.class.php index b8a10c5d0..40532fc2a 100644 --- a/tools/smarty/Smarty.class.php +++ b/tools/smarty/Smarty.class.php @@ -2,7 +2,7 @@ /** * Project: Smarty: the PHP compiling template engine * File: Smarty.class.php - * SVN: $Id: Smarty.class.php 4551 2012-02-06 20:45:10Z rodneyrehm $ + * SVN: $Id: Smarty.class.php 4694 2013-01-13 21:13:14Z uwe.tews@googlemail.com $ * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -28,7 +28,7 @@ * @author Uwe Tews * @author Rodney Rehm * @package Smarty - * @version 3.1.8 + * @version 3.1.13 */ /** @@ -57,7 +57,7 @@ if (!defined('SMARTY_PLUGINS_DIR')) { define('SMARTY_PLUGINS_DIR', SMARTY_DIR . 'plugins' . DS); } if (!defined('SMARTY_MBSTRING')) { - define('SMARTY_MBSTRING', function_exists('mb_strlen')); + define('SMARTY_MBSTRING', function_exists('mb_split')); } if (!defined('SMARTY_RESOURCE_CHAR_SET')) { // UTF-8 can only be done properly when mbstring is available! @@ -113,7 +113,7 @@ class Smarty extends Smarty_Internal_TemplateBase { /** * smarty version */ - const SMARTY_VERSION = 'Smarty-3.1.8'; + const SMARTY_VERSION = 'Smarty-3.1.13'; /** * define variable scopes @@ -189,8 +189,12 @@ class Smarty extends Smarty_Internal_TemplateBase { * Flag denoting if PCRE should run in UTF-8 mode */ public static $_UTF8_MODIFIER = 'u'; - - + + /** + * Flag denoting if operating system is windows + */ + public static $_IS_WINDOWS = false; + /**#@+ * variables */ @@ -1277,7 +1281,7 @@ class Smarty extends Smarty_Internal_TemplateBase { } // plugin filename is expected to be: [type].[name].php $_plugin_filename = "{$_name_parts[1]}.{$_name_parts[2]}.php"; - + $_stream_resolve_include_path = function_exists('stream_resolve_include_path'); // loop through plugin dirs and find the plugin @@ -1298,7 +1302,7 @@ class Smarty extends Smarty_Internal_TemplateBase { } else { $file = Smarty_Internal_Get_Include_Path::getIncludePath($file); } - + if ($file !== false) { require_once($file); return $file; @@ -1388,10 +1392,12 @@ class Smarty extends Smarty_Internal_TemplateBase { // add the SMARTY_DIR to the list of muted directories if (!isset(Smarty::$_muted_directories[SMARTY_DIR])) { $smarty_dir = realpath(SMARTY_DIR); - Smarty::$_muted_directories[SMARTY_DIR] = array( - 'file' => $smarty_dir, - 'length' => strlen($smarty_dir), - ); + if ($smarty_dir !== false) { + Smarty::$_muted_directories[SMARTY_DIR] = array( + 'file' => $smarty_dir, + 'length' => strlen($smarty_dir), + ); + } } // walk the muted directories and test against $errfile @@ -1399,6 +1405,11 @@ class Smarty extends Smarty_Internal_TemplateBase { if (!$dir) { // resolve directory and length for speedy comparisons $file = realpath($key); + if ($file === false) { + // this directory does not exist, remove and skip it + unset(Smarty::$_muted_directories[$key]); + continue; + } $dir = array( 'file' => $file, 'length' => strlen($file), @@ -1464,6 +1475,9 @@ class Smarty extends Smarty_Internal_TemplateBase { } } +// Check if we're running on windows +Smarty::$_IS_WINDOWS = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'; + // let PCRE (preg_*) treat strings as ISO-8859-1 if we're not dealing with UTF-8 if (Smarty::$_CHARSET !== 'UTF-8') { Smarty::$_UTF8_MODIFIER = ''; @@ -1474,6 +1488,10 @@ if (Smarty::$_CHARSET !== 'UTF-8') { * @package Smarty */ class SmartyException extends Exception { + public static $escape = true; + public function __construct($message) { + $this->message = self::$escape ? htmlentities($message) : $message; + } } /** @@ -1502,8 +1520,8 @@ function smartyAutoload($class) 'smarty_resource_recompiled' => true, ); - if (preg_match('/^[0-9a-z_-]+$/i', $_class) && !strncmp($_class, 'smarty_internal_', 16) || isset($_classes[$_class])) { - include SMARTY_SYSPLUGINS_DIR . $_class . '.php'; + if (!strncmp($_class, 'smarty_internal_', 16) || isset($_classes[$_class])) { + include SMARTY_SYSPLUGINS_DIR . $_class . '.php'; } } diff --git a/tools/smarty/plugins/function.html_checkboxes.php b/tools/smarty/plugins/function.html_checkboxes.php index fb9584bbd..1866bc2f3 100644 --- a/tools/smarty/plugins/function.html_checkboxes.php +++ b/tools/smarty/plugins/function.html_checkboxes.php @@ -116,6 +116,23 @@ function smarty_function_html_checkboxes($params, $template) case 'assign': break; + case 'strict': break; + + case 'disabled': + case 'readonly': + if (!empty($params['strict'])) { + if (!is_scalar($_val)) { + trigger_error("html_options: $_key attribute must be a scalar, only boolean true or string '$_key' will actually add the attribute", E_USER_NOTICE); + } + + if ($_val === true || $_val === $_key) { + $extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_key) . '"'; + } + + break; + } + // omit break; to fall through! + default: if(!is_array($_val)) { $extra .= ' '.$_key.'="'.smarty_function_escape_special_chars($_val).'"'; diff --git a/tools/smarty/plugins/function.html_options.php b/tools/smarty/plugins/function.html_options.php index 86266e269..68fa0524a 100644 --- a/tools/smarty/plugins/function.html_options.php +++ b/tools/smarty/plugins/function.html_options.php @@ -90,7 +90,24 @@ function smarty_function_html_options($params, $template) $selected = smarty_function_escape_special_chars((string) $_val); } break; - + + case 'strict': break; + + case 'disabled': + case 'readonly': + if (!empty($params['strict'])) { + if (!is_scalar($_val)) { + trigger_error("html_options: $_key attribute must be a scalar, only boolean true or string '$_key' will actually add the attribute", E_USER_NOTICE); + } + + if ($_val === true || $_val === $_key) { + $extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_key) . '"'; + } + + break; + } + // omit break; to fall through! + default: if (!is_array($_val)) { $extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_val) . '"'; @@ -150,6 +167,8 @@ function smarty_function_html_options_optoutput($key, $value, $selected, $id, $c trigger_error("html_options: value is an object of class '". get_class($value) ."' without __toString() method", E_USER_NOTICE); return ''; } + } else { + $value = smarty_function_escape_special_chars((string) $value); } $_html_result .= $_html_class . $_html_id . '>' . $value . '' . "\n"; $idx++; diff --git a/tools/smarty/plugins/function.html_radios.php b/tools/smarty/plugins/function.html_radios.php index 7c830724a..a2741f68f 100644 --- a/tools/smarty/plugins/function.html_radios.php +++ b/tools/smarty/plugins/function.html_radios.php @@ -102,6 +102,23 @@ function smarty_function_html_radios($params, $template) case 'assign': break; + case 'strict': break; + + case 'disabled': + case 'readonly': + if (!empty($params['strict'])) { + if (!is_scalar($_val)) { + trigger_error("html_options: $_key attribute must be a scalar, only boolean true or string '$_key' will actually add the attribute", E_USER_NOTICE); + } + + if ($_val === true || $_val === $_key) { + $extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_key) . '"'; + } + + break; + } + // omit break; to fall through! + default: if (!is_array($_val)) { $extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_val) . '"'; diff --git a/tools/smarty/plugins/modifier.date_format.php b/tools/smarty/plugins/modifier.date_format.php index 3cca7d395..f3eaba057 100644 --- a/tools/smarty/plugins/modifier.date_format.php +++ b/tools/smarty/plugins/modifier.date_format.php @@ -35,7 +35,7 @@ function smarty_modifier_date_format($string, $format=null, $default_date='', $f * Include the {@link shared.make_timestamp.php} plugin */ require_once(SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'); - if ($string != '') { + if ($string != '' && $string != '0000-00-00' && $string != '0000-00-00 00:00:00') { $timestamp = smarty_make_timestamp($string); } elseif ($default_date != '') { $timestamp = smarty_make_timestamp($default_date); diff --git a/tools/smarty/plugins/modifier.escape.php b/tools/smarty/plugins/modifier.escape.php index 680bcfe3f..70876293d 100644 --- a/tools/smarty/plugins/modifier.escape.php +++ b/tools/smarty/plugins/modifier.escape.php @@ -21,38 +21,76 @@ * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities() * @return string escaped input string */ -function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true) +/* PrestaShop +change double_encode to false by default +function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true) +*/ +function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = false) +/* END */ { + static $_double_encode = null; + if ($_double_encode === null) { + $_double_encode = version_compare(PHP_VERSION, '5.2.3', '>='); + } + if (!$char_set) { $char_set = Smarty::$_CHARSET; } switch ($esc_type) { case 'html': -/* PrestaShop - return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); - */ - return htmlspecialchars($string, ENT_QUOTES, $char_set); - /* END */ + if ($_double_encode) { + // php >=5.3.2 - go native + return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + // php <5.2.3 - only handle double encoding + return htmlspecialchars($string, ENT_QUOTES, $char_set); + } else { + // php <5.2.3 - prevent double encoding + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string); + return $string; + } + } case 'htmlall': if (Smarty::$_MBSTRING) { // mb_convert_encoding ignores htmlspecialchars() - /* PrestaShop - return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); - */ - return htmlspecialchars($string, ENT_QUOTES, $char_set); - /* END */ + if ($_double_encode) { + // php >=5.3.2 - go native + $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + // php <5.2.3 - only handle double encoding + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + } else { + // php <5.2.3 - prevent double encoding + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string); + return $string; + } + } + // htmlentities() won't convert everything, so use mb_convert_encoding return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set); } // no MBString fallback - /* PrestaShop - return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); - */ - return htmlentities($string, ENT_QUOTES, $char_set); - /* END */ + if ($_double_encode) { + return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + return htmlentities($string, ENT_QUOTES, $char_set); + } else { + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlentities($string, ENT_QUOTES, $char_set); + $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string); + return $string; + } + } case 'url': return rawurlencode($string); @@ -152,4 +190,4 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $ } } -?> \ No newline at end of file +?> diff --git a/tools/smarty/plugins/modifiercompiler.escape.php b/tools/smarty/plugins/modifiercompiler.escape.php index b4f1f6638..f50028bd9 100644 --- a/tools/smarty/plugins/modifiercompiler.escape.php +++ b/tools/smarty/plugins/modifiercompiler.escape.php @@ -25,6 +25,11 @@ require_once( SMARTY_PLUGINS_DIR .'shared.literal_compiler_param.php' ); */ function smarty_modifiercompiler_escape($params, $compiler) { + static $_double_encode = null; + if ($_double_encode === null) { + $_double_encode = version_compare(PHP_VERSION, '5.2.3', '>='); + } + try { $esc_type = smarty_literal_compiler_param($params, 1, 'html'); $char_set = smarty_literal_compiler_param($params, 2, Smarty::$_CHARSET); @@ -36,48 +41,56 @@ function smarty_modifiercompiler_escape($params, $compiler) switch ($esc_type) { case 'html': - /* PrestaShop - return 'htmlspecialchars(' - . $params[0] .', ENT_QUOTES, ' - . var_export($char_set, true) . ', ' - . var_export($double_encode, true) . ')'; - */ - return 'htmlspecialchars(' - . $params[0] .', ENT_QUOTES, ' - . var_export($char_set, true) . ')'; - /* END */ - - case 'htmlall': - /* PrestaShop - if (Smarty::$_MBSTRING) { - return 'mb_convert_encoding(htmlspecialchars(' + if ($_double_encode) { + return 'htmlspecialchars(' . $params[0] .', ENT_QUOTES, ' . var_export($char_set, true) . ', ' - . var_export($double_encode, true) - . '), "HTML-ENTITIES", ' - . var_export($char_set, true) . ')'; - } - */ - if (Smarty::$_MBSTRING) { - return 'mb_convert_encoding(htmlspecialchars(' + . var_export($double_encode, true) . ')'; + } else if ($double_encode) { + return 'htmlspecialchars(' . $params[0] .', ENT_QUOTES, ' - . var_export($char_set, true) - . '), "HTML-ENTITIES", ' . var_export($char_set, true) . ')'; + } else { + // fall back to modifier.escape.php + } + + case 'htmlall': + if (Smarty::$_MBSTRING) { + if ($_double_encode) { + // php >=5.2.3 - go native + return 'mb_convert_encoding(htmlspecialchars(' + . $params[0] .', ENT_QUOTES, ' + . var_export($char_set, true) . ', ' + . var_export($double_encode, true) + . '), "HTML-ENTITIES", ' + . var_export($char_set, true) . ')'; + } else if ($double_encode) { + // php <5.2.3 - only handle double encoding + return 'mb_convert_encoding(htmlspecialchars(' + . $params[0] .', ENT_QUOTES, ' + . var_export($char_set, true) + . '), "HTML-ENTITIES", ' + . var_export($char_set, true) . ')'; + } else { + // fall back to modifier.escape.php + } } - /* END */ // no MBString fallback - /* PrestaShop - return 'htmlentities(' - . $params[0] .', ENT_QUOTES, ' - . var_export($char_set, true) . ', ' - . var_export($double_encode, true) . ')'; - */ - return 'htmlentities(' - . $params[0] .', ENT_QUOTES, ' - . var_export($char_set, true) . ')'; - /* END */ + if ($_double_encode) { + // php >=5.2.3 - go native + return 'htmlentities(' + . $params[0] .', ENT_QUOTES, ' + . var_export($char_set, true) . ', ' + . var_export($double_encode, true) . ')'; + } else if ($double_encode) { + // php <5.2.3 - only handle double encoding + return 'htmlentities(' + . $params[0] .', ENT_QUOTES, ' + . var_export($char_set, true) . ')'; + } else { + // fall back to modifier.escape.php + } case 'url': return 'rawurlencode(' . $params[0] . ')'; diff --git a/tools/smarty/plugins/outputfilter.trimwhitespace.php b/tools/smarty/plugins/outputfilter.trimwhitespace.php index 31a75557c..87cf8c781 100644 --- a/tools/smarty/plugins/outputfilter.trimwhitespace.php +++ b/tools/smarty/plugins/outputfilter.trimwhitespace.php @@ -40,6 +40,7 @@ function smarty_outputfilter_trimwhitespace($source, Smarty_Internal_Template $s } // Strip all HTML-Comments + // yes, even the ones in