diff --git a/core/model/modx/smarty/modsmarty.class.php b/core/model/modx/smarty/modsmarty.class.php
index 63437e1cf67..889d055e827 100644
--- a/core/model/modx/smarty/modsmarty.class.php
+++ b/core/model/modx/smarty/modsmarty.class.php
@@ -74,7 +74,7 @@ function __construct(modX &$modx, $params= array ()) {
$this->_blocks = array();
$this->_derived = null;
-
+
$this->muteExpectedErrors();
}
@@ -91,7 +91,7 @@ public function setCachePath($path = '') {
$this->modx->getCacheManager();
$this->modx->cacheManager->writeTree($path);
}
- $this->compile_dir = $path;
+ $this->setCompileDir($path);
}
/**
diff --git a/core/model/smarty/Smarty.class.php b/core/model/smarty/Smarty.class.php
index d708ce3ba5c..a34c55e4d63 100644
--- a/core/model/smarty/Smarty.class.php
+++ b/core/model/smarty/Smarty.class.php
@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
/**
* smarty version
*/
- const SMARTY_VERSION = '3.1.44';
+ const SMARTY_VERSION = '3.1.48';
/**
* define variable scopes
*/
diff --git a/core/model/smarty/plugins/function.html_select_date.php b/core/model/smarty/plugins/function.html_select_date.php
index 86403e3dc04..0791f1a310b 100644
--- a/core/model/smarty/plugins/function.html_select_date.php
+++ b/core/model/smarty/plugins/function.html_select_date.php
@@ -101,6 +101,7 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
$field_separator = "\n";
$option_separator = "\n";
$time = null;
+
// $all_empty = null;
// $day_empty = null;
// $month_empty = null;
@@ -113,17 +114,7 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
foreach ($params as $_key => $_value) {
switch ($_key) {
case 'time':
- if (!is_array($_value) && $_value !== null) {
- $template->_checkPlugins(
- array(
- array(
- 'function' => 'smarty_make_timestamp',
- 'file' => SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'
- )
- )
- );
- $time = smarty_make_timestamp($_value);
- }
+ $$_key = $_value; // we'll handle conversion below
break;
case 'month_names':
if (is_array($_value) && count($_value) === 12) {
@@ -178,43 +169,59 @@ function smarty_function_html_select_date($params, Smarty_Internal_Template $tem
}
// Note: date() is faster than strftime()
// Note: explode(date()) is faster than date() date() date()
- if (isset($params[ 'time' ]) && is_array($params[ 'time' ])) {
- if (isset($params[ 'time' ][ $prefix . 'Year' ])) {
+
+ if (isset($time) && is_array($time)) {
+ if (isset($time[$prefix . 'Year'])) {
// $_REQUEST[$field_array] given
foreach (array(
- 'Y' => 'Year',
- 'm' => 'Month',
- 'd' => 'Day'
- ) as $_elementKey => $_elementName) {
+ 'Y' => 'Year',
+ 'm' => 'Month',
+ 'd' => 'Day'
+ ) as $_elementKey => $_elementName) {
$_variableName = '_' . strtolower($_elementName);
$$_variableName =
- isset($params[ 'time' ][ $prefix . $_elementName ]) ? $params[ 'time' ][ $prefix . $_elementName ] :
+ isset($time[$prefix . $_elementName]) ? $time[$prefix . $_elementName] :
date($_elementKey);
}
- } elseif (isset($params[ 'time' ][ $field_array ][ $prefix . 'Year' ])) {
+ } elseif (isset($time[$field_array][$prefix . 'Year'])) {
// $_REQUEST given
foreach (array(
- 'Y' => 'Year',
- 'm' => 'Month',
- 'd' => 'Day'
- ) as $_elementKey => $_elementName) {
+ 'Y' => 'Year',
+ 'm' => 'Month',
+ 'd' => 'Day'
+ ) as $_elementKey => $_elementName) {
$_variableName = '_' . strtolower($_elementName);
- $$_variableName = isset($params[ 'time' ][ $field_array ][ $prefix . $_elementName ]) ?
- $params[ 'time' ][ $field_array ][ $prefix . $_elementName ] : date($_elementKey);
+ $$_variableName = isset($time[$field_array][$prefix . $_elementName]) ?
+ $time[$field_array][$prefix . $_elementName] : date($_elementKey);
}
} else {
// no date found, use NOW
- list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d'));
+ list($_year, $_month, $_day) = explode('-', date('Y-m-d'));
}
+ } elseif (isset($time) && preg_match("/(\d*)-(\d*)-(\d*)/", $time, $matches)) {
+ $_year = $_month = $_day = null;
+ if ($matches[1] > '') $_year = (int) $matches[1];
+ if ($matches[2] > '') $_month = (int) $matches[2];
+ if ($matches[3] > '') $_day = (int) $matches[3];
} elseif ($time === null) {
if (array_key_exists('time', $params)) {
- $_year = $_month = $_day = $time = null;
+ $_year = $_month = $_day = null;
} else {
- list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d'));
+ list($_year, $_month, $_day) = explode('-', date('Y-m-d'));
}
} else {
- list($_year, $_month, $_day) = $time = explode('-', date('Y-m-d', $time));
+ $template->_checkPlugins(
+ array(
+ array(
+ 'function' => 'smarty_make_timestamp',
+ 'file' => SMARTY_PLUGINS_DIR . 'shared.make_timestamp.php'
+ )
+ )
+ );
+ $time = smarty_make_timestamp($time);
+ list($_year, $_month, $_day) = explode('-', date('Y-m-d', $time));
}
+
// make syntax "+N" or "-N" work with $start_year and $end_year
// Note preg_match('!^(\+|\-)\s*(\d+)$!', $end_year, $match) is slower than trim+substr
foreach (array(
diff --git a/core/model/smarty/plugins/function.mailto.php b/core/model/smarty/plugins/function.mailto.php
index 8faf696afe2..5119a153452 100644
--- a/core/model/smarty/plugins/function.mailto.php
+++ b/core/model/smarty/plugins/function.mailto.php
@@ -48,8 +48,13 @@
*/
function smarty_function_mailto($params)
{
- static $_allowed_encoding =
- array('javascript' => true, 'javascript_charcode' => true, 'hex' => true, 'none' => true);
+ static $_allowed_encoding = array(
+ 'javascript' => true,
+ 'javascript_charcode' => true,
+ 'hex' => true,
+ 'none' => true
+ );
+
$extra = '';
if (empty($params[ 'address' ])) {
trigger_error("mailto: missing 'address' parameter", E_USER_WARNING);
@@ -57,11 +62,11 @@ function smarty_function_mailto($params)
} else {
$address = $params[ 'address' ];
}
+
$text = $address;
+
// netscape and mozilla do not decode %40 (@) in BCC field (bug?)
// so, don't encode it.
- $search = array('%40', '%2C');
- $replace = array('@', ',');
$mail_parms = array();
foreach ($params as $var => $value) {
switch ($var) {
@@ -69,7 +74,7 @@ function smarty_function_mailto($params)
case 'bcc':
case 'followupto':
if (!empty($value)) {
- $mail_parms[] = $var . '=' . str_replace($search, $replace, rawurlencode($value));
+ $mail_parms[] = $var . '=' . str_replace(array('%40', '%2C'), array('@', ','), rawurlencode($value));
}
break;
case 'subject':
@@ -83,6 +88,7 @@ function smarty_function_mailto($params)
default:
}
}
+
if ($mail_parms) {
$address .= '?' . join('&', $mail_parms);
}
@@ -94,19 +100,26 @@ function smarty_function_mailto($params)
);
return;
}
+
+ $flags = ENT_QUOTES;
+ if (defined('ENT_SUBSTITUTE') && defined('ENT_HTML401')) {
+ $flags |= ENT_SUBSTITUTE | ENT_HTML401;
+ }
+
+ $string = '' . htmlspecialchars($text, $flags, Smarty::$_CHARSET) . '';
+
if ($encode === 'javascript') {
- $string = '' . $text . '';
$js_encode = '';
for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
$js_encode .= '%' . bin2hex($string[ $x ]);
}
return '';
} elseif ($encode === 'javascript_charcode') {
- $string = '' . $text . '';
for ($x = 0, $_length = strlen($string); $x < $_length; $x++) {
$ord[] = ord($string[ $x ]);
}
- return '';
+ return '';
} elseif ($encode === 'hex') {
preg_match('!^(.*)(\?.*)$!', $address, $match);
if (!empty($match[ 2 ])) {
@@ -129,6 +142,6 @@ function smarty_function_mailto($params)
return '' . $text_encode . '';
} else {
// no encoding
- return '' . $text . '';
+ return $string;
}
}
diff --git a/core/model/smarty/plugins/function.math.php b/core/model/smarty/plugins/function.math.php
index c50a0806161..e2f8e04c834 100644
--- a/core/model/smarty/plugins/function.math.php
+++ b/core/model/smarty/plugins/function.math.php
@@ -69,8 +69,8 @@ function smarty_function_math($params, $template)
// Adapted from https://www.php.net/manual/en/function.eval.php#107377
$number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
$functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
- $operators = '[+\/*\^%-]'; // Allowed math operators
- $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?1))?)+$/';
+ $operators = '[,+\/*\^%-]'; // Allowed math operators
+ $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)*\)|\((?1)*\)))(?:'.$operators.'(?1))?)+$/';
if (!preg_match($regexp, $equation)) {
trigger_error("math: illegal characters", E_USER_WARNING);
diff --git a/core/model/smarty/plugins/modifier.escape.php b/core/model/smarty/plugins/modifier.escape.php
index 43353cfc6db..c2563589e7b 100644
--- a/core/model/smarty/plugins/modifier.escape.php
+++ b/core/model/smarty/plugins/modifier.escape.php
@@ -188,7 +188,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
'