[-] Core: upgrade smarty to 3.1.13
This commit is contained in:
@@ -116,6 +116,23 @@ function smarty_function_html_checkboxes($params, $template)
|
||||
case 'assign':
|
||||
break;
|
||||
|
||||
case 'strict': break;
|
||||
|
||||
case 'disabled':
|
||||
case 'readonly':
|
||||
if (!empty($params['strict'])) {
|
||||
if (!is_scalar($_val)) {
|
||||
trigger_error("html_options: $_key attribute must be a scalar, only boolean true or string '$_key' will actually add the attribute", E_USER_NOTICE);
|
||||
}
|
||||
|
||||
if ($_val === true || $_val === $_key) {
|
||||
$extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_key) . '"';
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
// omit break; to fall through!
|
||||
|
||||
default:
|
||||
if(!is_array($_val)) {
|
||||
$extra .= ' '.$_key.'="'.smarty_function_escape_special_chars($_val).'"';
|
||||
|
||||
@@ -90,7 +90,24 @@ function smarty_function_html_options($params, $template)
|
||||
$selected = smarty_function_escape_special_chars((string) $_val);
|
||||
}
|
||||
break;
|
||||
|
||||
|
||||
case 'strict': break;
|
||||
|
||||
case 'disabled':
|
||||
case 'readonly':
|
||||
if (!empty($params['strict'])) {
|
||||
if (!is_scalar($_val)) {
|
||||
trigger_error("html_options: $_key attribute must be a scalar, only boolean true or string '$_key' will actually add the attribute", E_USER_NOTICE);
|
||||
}
|
||||
|
||||
if ($_val === true || $_val === $_key) {
|
||||
$extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_key) . '"';
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
// omit break; to fall through!
|
||||
|
||||
default:
|
||||
if (!is_array($_val)) {
|
||||
$extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_val) . '"';
|
||||
@@ -150,6 +167,8 @@ function smarty_function_html_options_optoutput($key, $value, $selected, $id, $c
|
||||
trigger_error("html_options: value is an object of class '". get_class($value) ."' without __toString() method", E_USER_NOTICE);
|
||||
return '';
|
||||
}
|
||||
} else {
|
||||
$value = smarty_function_escape_special_chars((string) $value);
|
||||
}
|
||||
$_html_result .= $_html_class . $_html_id . '>' . $value . '</option>' . "\n";
|
||||
$idx++;
|
||||
|
||||
@@ -102,6 +102,23 @@ function smarty_function_html_radios($params, $template)
|
||||
case 'assign':
|
||||
break;
|
||||
|
||||
case 'strict': break;
|
||||
|
||||
case 'disabled':
|
||||
case 'readonly':
|
||||
if (!empty($params['strict'])) {
|
||||
if (!is_scalar($_val)) {
|
||||
trigger_error("html_options: $_key attribute must be a scalar, only boolean true or string '$_key' will actually add the attribute", E_USER_NOTICE);
|
||||
}
|
||||
|
||||
if ($_val === true || $_val === $_key) {
|
||||
$extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_key) . '"';
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
// omit break; to fall through!
|
||||
|
||||
default:
|
||||
if (!is_array($_val)) {
|
||||
$extra .= ' ' . $_key . '="' . smarty_function_escape_special_chars($_val) . '"';
|
||||
|
||||
@@ -35,7 +35,7 @@ function smarty_modifier_date_format($string, $format=null, $default_date='', $f
|
||||
* Include the {@link shared.make_timestamp.php} plugin
|
||||
*/
|
||||
require_once(SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php');
|
||||
if ($string != '') {
|
||||
if ($string != '' && $string != '0000-00-00' && $string != '0000-00-00 00:00:00') {
|
||||
$timestamp = smarty_make_timestamp($string);
|
||||
} elseif ($default_date != '') {
|
||||
$timestamp = smarty_make_timestamp($default_date);
|
||||
|
||||
@@ -21,38 +21,76 @@
|
||||
* @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities()
|
||||
* @return string escaped input string
|
||||
*/
|
||||
function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true)
|
||||
/* PrestaShop
|
||||
change double_encode to false by default
|
||||
function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true)
|
||||
*/
|
||||
function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = false)
|
||||
/* END */
|
||||
{
|
||||
static $_double_encode = null;
|
||||
if ($_double_encode === null) {
|
||||
$_double_encode = version_compare(PHP_VERSION, '5.2.3', '>=');
|
||||
}
|
||||
|
||||
if (!$char_set) {
|
||||
$char_set = Smarty::$_CHARSET;
|
||||
}
|
||||
|
||||
switch ($esc_type) {
|
||||
case 'html':
|
||||
/* PrestaShop
|
||||
return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
|
||||
*/
|
||||
return htmlspecialchars($string, ENT_QUOTES, $char_set);
|
||||
/* END */
|
||||
if ($_double_encode) {
|
||||
// php >=5.3.2 - go native
|
||||
return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
|
||||
} else {
|
||||
if ($double_encode) {
|
||||
// php <5.2.3 - only handle double encoding
|
||||
return htmlspecialchars($string, ENT_QUOTES, $char_set);
|
||||
} else {
|
||||
// php <5.2.3 - prevent double encoding
|
||||
$string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string);
|
||||
$string = htmlspecialchars($string, ENT_QUOTES, $char_set);
|
||||
$string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string);
|
||||
return $string;
|
||||
}
|
||||
}
|
||||
|
||||
case 'htmlall':
|
||||
if (Smarty::$_MBSTRING) {
|
||||
// mb_convert_encoding ignores htmlspecialchars()
|
||||
/* PrestaShop
|
||||
return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
|
||||
*/
|
||||
return htmlspecialchars($string, ENT_QUOTES, $char_set);
|
||||
/* END */
|
||||
if ($_double_encode) {
|
||||
// php >=5.3.2 - go native
|
||||
$string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
|
||||
} else {
|
||||
if ($double_encode) {
|
||||
// php <5.2.3 - only handle double encoding
|
||||
$string = htmlspecialchars($string, ENT_QUOTES, $char_set);
|
||||
} else {
|
||||
// php <5.2.3 - prevent double encoding
|
||||
$string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string);
|
||||
$string = htmlspecialchars($string, ENT_QUOTES, $char_set);
|
||||
$string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string);
|
||||
return $string;
|
||||
}
|
||||
}
|
||||
|
||||
// htmlentities() won't convert everything, so use mb_convert_encoding
|
||||
return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set);
|
||||
}
|
||||
|
||||
// no MBString fallback
|
||||
/* PrestaShop
|
||||
return htmlentities($string, ENT_QUOTES, $char_set, $double_encode);
|
||||
*/
|
||||
return htmlentities($string, ENT_QUOTES, $char_set);
|
||||
/* END */
|
||||
if ($_double_encode) {
|
||||
return htmlentities($string, ENT_QUOTES, $char_set, $double_encode);
|
||||
} else {
|
||||
if ($double_encode) {
|
||||
return htmlentities($string, ENT_QUOTES, $char_set);
|
||||
} else {
|
||||
$string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string);
|
||||
$string = htmlentities($string, ENT_QUOTES, $char_set);
|
||||
$string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string);
|
||||
return $string;
|
||||
}
|
||||
}
|
||||
|
||||
case 'url':
|
||||
return rawurlencode($string);
|
||||
@@ -152,4 +190,4 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
?>
|
||||
|
||||
@@ -25,6 +25,11 @@ require_once( SMARTY_PLUGINS_DIR .'shared.literal_compiler_param.php' );
|
||||
*/
|
||||
function smarty_modifiercompiler_escape($params, $compiler)
|
||||
{
|
||||
static $_double_encode = null;
|
||||
if ($_double_encode === null) {
|
||||
$_double_encode = version_compare(PHP_VERSION, '5.2.3', '>=');
|
||||
}
|
||||
|
||||
try {
|
||||
$esc_type = smarty_literal_compiler_param($params, 1, 'html');
|
||||
$char_set = smarty_literal_compiler_param($params, 2, Smarty::$_CHARSET);
|
||||
@@ -36,48 +41,56 @@ function smarty_modifiercompiler_escape($params, $compiler)
|
||||
|
||||
switch ($esc_type) {
|
||||
case 'html':
|
||||
/* PrestaShop
|
||||
return 'htmlspecialchars('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ', '
|
||||
. var_export($double_encode, true) . ')';
|
||||
*/
|
||||
return 'htmlspecialchars('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ')';
|
||||
/* END */
|
||||
|
||||
case 'htmlall':
|
||||
/* PrestaShop
|
||||
if (Smarty::$_MBSTRING) {
|
||||
return 'mb_convert_encoding(htmlspecialchars('
|
||||
if ($_double_encode) {
|
||||
return 'htmlspecialchars('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ', '
|
||||
. var_export($double_encode, true)
|
||||
. '), "HTML-ENTITIES", '
|
||||
. var_export($char_set, true) . ')';
|
||||
}
|
||||
*/
|
||||
if (Smarty::$_MBSTRING) {
|
||||
return 'mb_convert_encoding(htmlspecialchars('
|
||||
. var_export($double_encode, true) . ')';
|
||||
} else if ($double_encode) {
|
||||
return 'htmlspecialchars('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true)
|
||||
. '), "HTML-ENTITIES", '
|
||||
. var_export($char_set, true) . ')';
|
||||
} else {
|
||||
// fall back to modifier.escape.php
|
||||
}
|
||||
|
||||
case 'htmlall':
|
||||
if (Smarty::$_MBSTRING) {
|
||||
if ($_double_encode) {
|
||||
// php >=5.2.3 - go native
|
||||
return 'mb_convert_encoding(htmlspecialchars('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ', '
|
||||
. var_export($double_encode, true)
|
||||
. '), "HTML-ENTITIES", '
|
||||
. var_export($char_set, true) . ')';
|
||||
} else if ($double_encode) {
|
||||
// php <5.2.3 - only handle double encoding
|
||||
return 'mb_convert_encoding(htmlspecialchars('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true)
|
||||
. '), "HTML-ENTITIES", '
|
||||
. var_export($char_set, true) . ')';
|
||||
} else {
|
||||
// fall back to modifier.escape.php
|
||||
}
|
||||
}
|
||||
/* END */
|
||||
|
||||
// no MBString fallback
|
||||
/* PrestaShop
|
||||
return 'htmlentities('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ', '
|
||||
. var_export($double_encode, true) . ')';
|
||||
*/
|
||||
return 'htmlentities('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ')';
|
||||
/* END */
|
||||
if ($_double_encode) {
|
||||
// php >=5.2.3 - go native
|
||||
return 'htmlentities('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ', '
|
||||
. var_export($double_encode, true) . ')';
|
||||
} else if ($double_encode) {
|
||||
// php <5.2.3 - only handle double encoding
|
||||
return 'htmlentities('
|
||||
. $params[0] .', ENT_QUOTES, '
|
||||
. var_export($char_set, true) . ')';
|
||||
} else {
|
||||
// fall back to modifier.escape.php
|
||||
}
|
||||
|
||||
case 'url':
|
||||
return 'rawurlencode(' . $params[0] . ')';
|
||||
|
||||
@@ -40,6 +40,7 @@ function smarty_outputfilter_trimwhitespace($source, Smarty_Internal_Template $s
|
||||
}
|
||||
|
||||
// Strip all HTML-Comments
|
||||
// yes, even the ones in <script> - see http://stackoverflow.com/a/808850/515124
|
||||
$source = preg_replace( '#<!--.*?-->#ms', '', $source );
|
||||
|
||||
// capture html elements not to be messed with
|
||||
|
||||
Reference in New Issue
Block a user