Update Smarty to version 5.8.4

.dist/phpstan.neon.dist

@@ -52,12 +52,12 @@ parameters:
 
   # Scan for type resolution, but do not analyze
   scanDirectories:
-    - ../fp-includes/smarty-5.8.0/src
+    - ../fp-includes/smarty-5.8.4/src
     - ../fp-includes/fp-smartyplugins
 
   excludePaths:
     analyse:
-      - ../fp-includes/smarty-5.8.0/**
+      - ../fp-includes/smarty-5.8.4/**
       - ../fp-content/compile/**
       - ../fp-content/cache/**
 
@@ -68,12 +68,12 @@ parameters:
     # Ignore error “does not accept null” only in Smarty core
     - message: '#Property .* does not accept null#'
       paths:
-        - ../fp-includes/smarty-5.8.0/src/*.php
+        - ../fp-includes/smarty-5.8.4/src/*.php
 
     # Ignore error “Call to undefined method” only in Smarty core
     - message: '#Call to an undefined method Smarty_Internal_.*::.*#'
       paths:
-        - ../fp-includes/smarty-5.8.0/src/.*\.php
+        - ../fp-includes/smarty-5.8.4/src/.*\.php
 
   checkMissingVarTagTypehint: false
   reportUnmatchedIgnoredErrors: false

CHANGELOG.md

@@ -3,7 +3,7 @@
 - Added "Location Migration Mode" ([#897](https://github.com/flatpressblog/flatpress/pull/897))
 - The PHP code is now fully compliant with PHPStan Level 5 ([#893](https://github.com/flatpressblog/flatpress/pull/893), [#894](https://github.com/flatpressblog/flatpress/pull/894))
 - Template engine Smarty:
-  - Updated to version 5.8.0 with PHP 8.5 support ([#893](https://github.com/flatpressblog/flatpress/pull/893))
+  - Updated to version 5.8.4 with PHP 8.5 support ([#932](https://github.com/flatpressblog/flatpress/pull/932))
 - New core helpers: ``date_iso8601($timestamp, $offset = null)`` and ``date_id_to_iso8601($id, $offset = null)``. ([#856](https://github.com/flatpressblog/flatpress/pull/856))
 - RSS and Atom feeds and the Categories widget use the Smarty block cache instead of having to go through the Smarty compiler every time. ([#864](https://github.com/flatpressblog/flatpress/pull/864))
 - If APCu is available, the Smarty cache fragments are stored in the APCu cache instead of on disk. ([#865](https://github.com/flatpressblog/flatpress/pull/865))

fp-includes/smarty-5.8.4/AGENTS.md

@@ -0,0 +1,87 @@
+# AGENTS.md
+
+This file is the single source of truth for AI coding assistants working in this repo (including Claude Code, claude.ai/code).
+
+## Project
+
+Smarty v5 — PHP template engine. Single Composer package (`smarty/smarty`), namespace `Smarty\`, source in `src/`, autoloaded via PSR-4. Supports PHP 7.2–8.5.
+
+Do not use PHP syntax newer than 7.2 in `src/` unless it is guarded for older runtimes.
+
+## Commands
+
+```bash
+# Install dependencies
+composer install
+
+# Regenerate lexers and parsers (required before tests; CI runs this)
+make -B
+
+# Run all tests
+php ./vendor/phpunit/phpunit/phpunit
+
+# Run a single test file
+php ./vendor/phpunit/phpunit/phpunit tests/UnitTests/TemplateSource/TagTests/If/CompileIfTest.php
+
+# Run tests matching a PHPUnit group
+php ./vendor/phpunit/phpunit/phpunit --group 20221124
+
+# Run tests excluding slow group
+php ./vendor/phpunit/phpunit/phpunit --exclude-group slow
+```
+
+There is no linter or static analysis configured. No typecheck step.
+
+## Generated code — do not hand-edit
+
+Four files are generated from grammar/lexer definitions via `make`:
+
+| Source (edit this) | Generated (do not edit) |
+|---|---|
+| `src/Lexer/TemplateLexer.plex` | `src/Lexer/TemplateLexer.php` |
+| `src/Lexer/ConfigfileLexer.plex` | `src/Lexer/ConfigfileLexer.php` |
+| `src/Parser/TemplateParser.y` | `src/Parser/TemplateParser.php` |
+| `src/Parser/ConfigfileParser.y` | `src/Parser/ConfigfileParser.php` |
+
+After editing a `.plex` or `.y` file, run `make -B` to regenerate. The generators require the `smarty/smarty-lexer` dev dependency.
+
+## Architecture
+
+- `src/Smarty.php` — main class, extends `TemplateBase`. Version constant: `Smarty::SMARTY_VERSION`.
+- `src/Compile/`, `src/Compiler/` — template compilation pipeline.
+- `src/Lexer/`, `src/Parser/` — lexer/parser (generated, see above).
+- `src/Extension/` — extension system (`ExtensionInterface`, `CoreExtension`, `DefaultExtension`, `BCPluginsAdapter`).
+- `src/Runtime/` — runtime helpers (foreach, capture, inheritance, tpl functions).
+- `src/Resource/`, `src/Cacheresource/` — template resource and cache resource handlers.
+- `src/BlockHandler/`, `src/FunctionHandler/`, `src/Filter/` — built-in tags, functions, and filters.
+- `libs/Smarty.class.php` — non-Composer autoload stub. Points to `src/`. Not the main source.
+- `src/functions.php` — global helper functions, always loaded via Composer `files` autoload.
+
+## Tests
+
+- Framework: PHPUnit 7.5/8.5 (bootstrap: `tests/Bootstrap.php`).
+- All tests extend `PHPUnit_Smarty` (defined in `tests/PHPUnit_Smarty.php`), which provides `setUpSmarty($dir)`.
+- Test suite root: `tests/UnitTests/`. Typical test `setUp()` calls `$this->setUpSmarty(__DIR__)`.
+- Each test directory may have its own `templates/`, `configs/` subdirectories. Compiled output goes to `templates_c/` and `cache/` (auto-created by the test harness).
+- Running the suite scatters generated `templates_c/`, `cache/`, and `templates_tmp/` directories (and empty runtime `templates/`/`configs/` dirs) throughout `tests/` and the repo root. These are not tracked — treat them as noise in `git status`, never commit them, and clean them with `git clean -fd` (exclude tool dirs like `.serena`).
+- Three test files are excluded in `phpunit.xml`: Memcache, APC, and HttpModifiedSince tests (require external services).
+- Tests needing MySQL/PDO are gated by constants in `tests/Config.php` (disabled by default).
+
+## CI
+
+GitHub Actions (`.github/workflows/ci.yml`): matrix of PHP 7.2–8.5 on ubuntu + windows. Steps: `composer install` → `make -B` → `phpunit`. No deploy step.
+
+## Docs
+
+Markdown in `docs/`, built with mkdocs + Material theme. Install the toolchain with `pip install -r docs/requirements.txt`, then preview with `mkdocs serve`. Published via `mike deploy 5.x`.
+
+## Release
+
+`./make-release.sh <version>` — only v5.x.x. Updates changelog and version constant, creates a merge commit and tag on `master`.
+
+### Changelog
+
+Every change that should appear in `CHANGELOG.md` must add a new markdown file under `changelog/`. At release time `utilities/update-changelog.php` concatenates all `changelog/*.md` files into the `## [Unreleased]` section, so:
+
+- One file per change, containing a single line that starts with a dash (`- ...`). The filename is arbitrary; name it after the issue number (e.g. `1036.md`) when there is one, otherwise use a short descriptive slug.
+- Include a markdown link to the relevant issue when one exists, e.g. `[#1036](https://github.com/smarty-php/smarty/issues/1036)`. Omit the link when there is no public issue (e.g. embargoed security reports).

fp-includes/smarty-5.8.0/CHANGELOG.md → fp-includes/smarty-5.8.4/CHANGELOG.md

@@ -6,6 +6,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.8.4] - 2026-06-29
+- Fixed a `TypeError` on PHP 8 when `Security::$static_classes` was set to a non-array value (e.g. the string `'none'`) to disable static class access; any non-array value now cleanly denies access. Use `Security::$static_classes = null` to disable access to all static classes.
+- Security: the built-in `stream:` resource type now validates the nested stream wrapper against the security policy, so a template such as `stream:php://filter/...` can no longer bypass `Security::$streams` (including `Security::$streams = null`) to read local files (CWE-22)
+
+
+## [5.8.3] - 2026-06-28
+- fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
+
+
+## [5.8.2] - 2026-06-24
+- Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
+- Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
+- Security: `{fetch}` no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing `trusted_uri` (CWE-918 server-side request forgery)
+- Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template [#1036](https://github.com/smarty-php/smarty/issues/1036)
+
+
+## [5.8.1] - 2026-06-23
+- Re-activated unit tests for user literals, which were previously disabled due to a bug in refactoring to v5.
+- fixed a bug where child template's block content leaked into subsequent rendering of the parent template [#1189](https://github.com/smarty-php/smarty/issues/1189)
+- Moved all unit test-generated output from inside the working tree to tmp files [#1178](https://github.com/smarty-php/smarty/issues/1178)
+
+
 ## [5.8.0] - 2026-02-15
 - Added support for Backed Enums for php versions >= 8.1 [#1171](https://github.com/smarty-php/smarty/pull/1171)
 - Added support for new 'matches' operator doing regex matching [#1169](https://github.com/smarty-php/smarty/pull/1169)

fp-includes/smarty-5.8.0/CONTRIBUTING.md → fp-includes/smarty-5.8.4/CONTRIBUTING.md

@@ -100,6 +100,11 @@ Enhancement suggestions are tracked as [GitHub issues](https://github.com/smarty
 The [docs](docs/index.md) are written in markdown, configured in [mkdocs.yml](mkdocs.yml) and published 
 to [GitHub pages](https://smarty-php.github.io/smarty) using [mkdocs](https://www.mkdocs.org/) and [mike](https://github.com/jimporter/mike).
 
+You need Python to build the docs. Install the required packages first:
+```bash
+pip install -r docs/requirements.txt
+```
+
 To preview the docs while you are writing, run:
 ```bash
 mkdocs serve

fp-includes/smarty-5.8.0/TODO.txt → fp-includes/smarty-5.8.4/TODO.txt

@@ -11,10 +11,10 @@
 ## include inline
 - Re-introduce merge_compiled_includes and the {include inline} attribute?
 
-## Output buffering
-- Fix ob_ output buffering commands being scattered around the codebase
+## Output buffering (major)
+- Fix ob_ output buffering commands being scattered around the codebase: Smarty's output model is fundamentally "echo everything, wrap in a buffer to capture". An alternative that would be where rendering returns a string rather than echoing — but that touches the entire compiled template format (the unifunc functions all echo) and is a large change.
 
-## Review public static vars
+## Review public static vars (major)
 - such as _CHARSET and _IS_WINDOWS
 
 ## Block / inheritance
@@ -24,9 +24,8 @@
 ## Plugin system
 - fix template security checks in one place in compiler
 
-## Beatify output
+## Beatify output (major)
 - compiled templates could be proper classes, possibly using [nette/php-generator](https://packagist.org/packages/nette/php-generator)
 
 ## Unrelated / other
 - review (and avoid) use of 'clone' keyword
-- what is 'user literal support', why are unit tests skipped?

fp-includes/smarty-5.8.0/run-tests-for-all-php-versions.sh → fp-includes/smarty-5.8.4/run-tests-for-all-php-versions.sh

@@ -5,7 +5,7 @@
 # - ./run-tests-for-all-php-versions.sh --group 20221124
 # - ./run-tests-for-all-php-versions.sh --exclude-group slow
 
-COMPOSE_CMD="mutagen-compose"
+COMPOSE_CMD="docker compose"
 
 $COMPOSE_CMD run --rm php72 ./run-tests.sh $@ && \
 $COMPOSE_CMD run --rm php73 ./run-tests.sh $@ && \

fp-includes/smarty-5.8.0/src/Cacheresource/File.php → fp-includes/smarty-5.8.4/src/Cacheresource/File.php

@@ -143,7 +143,7 @@ public function storeCachedContent(Template $_template, $content)
      *
      * @param Template $_template template object
      *
-     * @return string  content
+     * @return string|false content
      */
     public function retrieveCachedContent(Template $_template)
     {

fp-includes/smarty-5.8.0/src/Compile/Tag/ForTag.php → fp-includes/smarty-5.8.4/src/Compile/Tag/ForTag.php

@@ -51,8 +51,9 @@ public function compile($args, \Smarty\Compiler\Template $compiler, $parameter =
 					$var = $_statement['var'];
 					$index = '';
 				}
-				$output .= "\$_smarty_tpl->assign($var, null);\n";
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->value{$index} = {$_statement['value']};\n";
+				$itemVar = "\$_smarty_tpl->getVariable({$var})";
+				$output .= "\$_smarty_tpl->assign($var, []);\n";
+				$output .= "{$itemVar}->value{$index} = {$_statement['value']};\n";
 			}
 			if (is_array($_attr['var'])) {
 				$var = $_attr['var']['var'];
@@ -61,7 +62,8 @@ public function compile($args, \Smarty\Compiler\Template $compiler, $parameter =
 				$var = $_attr['var'];
 				$index = '';
 			}
-			$output .= "if ($_attr[ifexp]) {\nfor (\$_foo=true;$_attr[ifexp]; \$_smarty_tpl->tpl_vars[$var]->value{$index}$_attr[step]) {\n";
+			$itemVar = "\$_smarty_tpl->getVariable({$var})";
+			$output .= "if ($_attr[ifexp]) {\nfor (\$_foo=true;$_attr[ifexp]; {$itemVar}->value{$index}$_attr[step]) {\n";
 		} else {
 			$_statement = $_attr['start'];
 			if (is_array($_statement['var'])) {
@@ -71,21 +73,22 @@ public function compile($args, \Smarty\Compiler\Template $compiler, $parameter =
 				$var = $_statement['var'];
 				$index = '';
 			}
-			$output .= "\$_smarty_tpl->assign($var, null);";
+			$itemVar = "\$_smarty_tpl->getVariable({$var})";
+			$output .= "\$_smarty_tpl->assign($var, []);";
 			if (isset($_attr['step'])) {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->step = $_attr[step];";
+				$output .= "{$itemVar}->step = $_attr[step];";
 			} else {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->step = 1;";
+				$output .= "{$itemVar}->step = 1;";
 			}
 			if (isset($_attr['max'])) {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->total = (int) min(ceil((\$_smarty_tpl->tpl_vars[$var]->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs(\$_smarty_tpl->tpl_vars[$var]->step)),$_attr[max]);\n";
+				$output .= "{$itemVar}->total = (int) min(ceil(({$itemVar}->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs({$itemVar}->step)),$_attr[max]);\n";
 			} else {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->total = (int) ceil((\$_smarty_tpl->tpl_vars[$var]->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs(\$_smarty_tpl->tpl_vars[$var]->step));\n";
+				$output .= "{$itemVar}->total = (int) ceil(({$itemVar}->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs({$itemVar}->step));\n";
 			}
-			$output .= "if (\$_smarty_tpl->tpl_vars[$var]->total > 0) {\n";
-			$output .= "for (\$_smarty_tpl->tpl_vars[$var]->value{$index} = $_statement[value], \$_smarty_tpl->tpl_vars[$var]->iteration = 1;\$_smarty_tpl->tpl_vars[$var]->iteration <= \$_smarty_tpl->tpl_vars[$var]->total;\$_smarty_tpl->tpl_vars[$var]->value{$index} += \$_smarty_tpl->tpl_vars[$var]->step, \$_smarty_tpl->tpl_vars[$var]->iteration++) {\n";
-			$output .= "\$_smarty_tpl->tpl_vars[$var]->first = \$_smarty_tpl->tpl_vars[$var]->iteration === 1;";
-			$output .= "\$_smarty_tpl->tpl_vars[$var]->last = \$_smarty_tpl->tpl_vars[$var]->iteration === \$_smarty_tpl->tpl_vars[$var]->total;";
+			$output .= "if ({$itemVar}->total > 0) {\n";
+			$output .= "for ({$itemVar}->value{$index} = $_statement[value], {$itemVar}->iteration = 1;{$itemVar}->iteration <= {$itemVar}->total;{$itemVar}->value{$index} += {$itemVar}->step, {$itemVar}->iteration++) {\n";
+			$output .= "{$itemVar}->first = {$itemVar}->iteration === 1;";
+			$output .= "{$itemVar}->last = {$itemVar}->iteration === {$itemVar}->total;";
 		}
 		$output .= '?>';
 

fp-includes/smarty-5.8.0/src/FunctionHandler/Fetch.php → fp-includes/smarty-5.8.4/src/FunctionHandler/Fetch.php

@@ -189,7 +189,22 @@ public function handle($params, Template $template) {
 				return;
 			}
 		} else {
-			$content = @file_get_contents($params['file']);
+			if ($protocol && isset($template->getSmarty()->security_policy)) {
+				// Remote resource (e.g. https://) reached through file_get_contents().
+				// isTrustedUri() only validates the initial URL, but file_get_contents()
+				// follows redirects by default, so an open redirect on an otherwise
+				// trusted host could be used to reach a non-trusted target (SSRF).
+				// Disable redirect-following while a security policy is in effect.
+				$context = stream_context_create([
+					'http' => [
+						'follow_location' => 0,
+						'max_redirects' => 1,
+					],
+				]);
+				$content = @file_get_contents($params['file'], false, $context);
+			} else {
+				$content = @file_get_contents($params['file']);
+			}
 			if ($content === false) {
 				throw new Exception("{fetch} cannot read resource '" . $params['file'] . "'");
 			}

fp-includes/smarty-5.8.0/src/FunctionHandler/HtmlImage.php → fp-includes/smarty-5.8.4/src/FunctionHandler/HtmlImage.php

@@ -65,7 +65,7 @@ public function handle($params, Template $template) {
 					break;
 				case 'link':
 				case 'href':
-					$prefix = '<a href="' . $_val . '">';
+					$prefix = '<a href="' . smarty_function_escape_special_chars($_val) . '">';
 					$suffix = '</a>';
 					break;
 				default:
@@ -143,7 +143,12 @@ public function handle($params, Template $template) {
 			$width = round($width * $_resize);
 			$height = round($height * $_resize);
 		}
-		return $prefix . '<img src="' . $path_prefix . $file . '" alt="' . $alt . '" width="' . $width . '" height="' .
-			$height . '"' . $extra . ' />' . $suffix;
+		// $alt and the pass-through attributes ($extra) are already escaped above;
+		// escape the remaining value-context params at output time so untrusted
+		// values cannot break out of the attribute (CWE-79). The unescaped $file/
+		// $width/$height are still used for getimagesize()/DPI math above.
+		return $prefix . '<img src="' . smarty_function_escape_special_chars($path_prefix . $file) . '" alt="' . $alt
+			. '" width="' . smarty_function_escape_special_chars($width) . '" height="'
+			. smarty_function_escape_special_chars($height) . '"' . $extra . ' />' . $suffix;
 	}
 }

fp-includes/smarty-5.8.0/src/FunctionHandler/HtmlSelectDate.php → fp-includes/smarty-5.8.4/src/FunctionHandler/HtmlSelectDate.php

@@ -120,9 +120,6 @@ public function handle($params, Template $template) {
 				case 'day_value_format':
 				case 'month_format':
 				case 'month_value_format':
-				case 'day_size':
-				case 'month_size':
-				case 'year_size':
 				case 'all_extra':
 				case 'day_extra':
 				case 'month_extra':
@@ -140,6 +137,13 @@ public function handle($params, Template $template) {
 				case 'year_id':
 					$$_key = (string)$_value;
 					break;
+				case 'day_size':
+				case 'month_size':
+				case 'year_size':
+					// numeric HTML size attribute; cast to int (consistent with
+					// html_select_time) so it cannot break out of size="…" (CWE-79)
+					$$_key = (int)$_value;
+					break;
 				case 'display_days':
 				case 'display_months':
 				case 'display_years':

fp-includes/smarty-5.8.0/src/Resource/StreamPlugin.php → fp-includes/smarty-5.8.4/src/Resource/StreamPlugin.php

@@ -54,8 +54,19 @@ public function getContent(Source $source) {
 			$filepath = str_replace(':', '://', $source->getFullResourceName());
 		}
 
+		// Validate the underlying stream wrapper against the security policy.
+		// When the built-in "stream" resource type is used (e.g.
+		// stream:php://filter/...), BasePlugin::load() matches the "stream"
+		// sysplugin before the stream_get_wrappers()/isTrustedStream() check,
+		// so the nested wrapper ("php" here) is never validated. Parse the
+		// wrapper scheme from the resolved path and check it explicitly so that
+		// e.g. Security::$streams = null blocks it before fopen() (CWE-22/-441).
+		$smarty = $source->getSmarty();
+		if (is_object($smarty->security_policy) && ($_pos = strpos($filepath, '://')) !== false) {
+			$smarty->security_policy->isTrustedStream(strtolower(substr($filepath, 0, $_pos)));
+		}
+
 		$t = '';
-		// the availability of the stream has already been checked in Smarty\Resource\Base::fetch()
 		$fp = fopen($filepath, 'r+');
 		if ($fp) {
 			while (!feof($fp) && ($current_line = fgets($fp)) !== false) {