issue #1845 update Smarty from 4.1.0 to 4.3.1 (compat PHP 8.2)

2026-08-09 10:13:00 +02:00 · 2023-04-17 10:49:21 +02:00
parent ea53750bfe
commit 7752138b04
186 changed files with 4513 additions and 4665 deletions
@@ -1,7 +1,7 @@
 Objects {#advanced.features.objects}
 =======

-Smarty allows access to PHP [objects](&url.php-manual;object) through
+Smarty allows access to PHP [objects](https://www.php.net/object) through
 the templates.

 > **Note**
@@ -29,7 +29,7 @@ determined by your needs, but use the first method whenever possible to
 keep template syntax to a minimum.

 If security is enabled, no private methods or functions can be accessed
-(beginningwith \'\_\'). If a method and property of the same name exist,
+(beginning with \'\_\'). If a method and property of the same name exist,
 the method will be used.

 You can restrict the methods and properties that can be accessed by
@@ -2,36 +2,20 @@ Security {#advanced.features.security}
 ========

 Security is good for situations when you have untrusted parties editing
-the templates eg via ftp, and you want to reduce the risk of system
+the templates e.g. via ftp, and you want to reduce the risk of system
 security compromises through the template language.

 The settings of the security policy are defined by properties of an
 instance of the Smarty\_Security class. These are the possible settings:

-   `$php_handling` determines how Smarty to handle PHP code embedded in
-    templates. Possible values are:
-
-    -   Smarty::PHP\_PASSTHRU -\> echo PHP tags as they are
-
-    -   Smarty::PHP\_QUOTE -\> escape tags as entities
-
-    -   Smarty::PHP\_REMOVE -\> remove php tags
-
-    -   Smarty::PHP\_ALLOW -\> execute php tags
-
-    The default value is Smarty::PHP\_PASSTHRU.
-
-    If security is enabled the [`$php_handling`](#variable.php.handling)
-    setting of the Smarty object is not checked for security.
-
 -   `$secure_dir` is an array of template directories that are
    considered secure. [`$template_dir`](#variable.template.dir)
-    concidered secure implicitly. The default is an empty array.
+    considered secure implicitly. The default is an empty array.

 -   `$trusted_dir` is an array of all directories that are considered
    trusted. Trusted directories are where you keep php scripts that are
    executed directly from the templates with
-    [`{include_php}`](#language.function.include.php). The default is an
+    [`{insert}`](#language.function.insert.php). The default is an
    empty array.

 -   `$trusted_uri` is an array of regular expressions matching URIs that
@@ -43,7 +27,7 @@ instance of the Smarty\_Security class. These are the possible settings:
    like authentication-tokens).

    The expression `'#https?://.*smarty.net$#i'` would allow accessing
-    the follwing URIs:
+    the following URIs:

    -   `http://smarty.net/foo`

@@ -110,12 +94,8 @@ instance of the Smarty\_Security class. These are the possible settings:
    super globals can be accessed by the template. The default is
    \"true\".

-   `$allow_php_tag` is a boolean flag which controls if {php} and
-    {include\_php} tags can be used by the template. The default is
-    \"false\".
-
 If security is enabled, no private methods, functions or properties of
-static classes or assigned objects can be accessed (beginningwith
+static classes or assigned objects can be accessed (beginning with
 \'\_\') by the template.

 To customize the security policy settings you can extend the
@@ -128,8 +108,6 @@ Smarty\_Security class or create an instance of it.
    class My_Security_Policy extends Smarty_Security {
      // disable all PHP functions
      public $php_functions = null;
-      // remove PHP tags
-      public $php_handling = Smarty::PHP_REMOVE;
      // allow everthing as modifier
      public $php_modifiers = array();
    }
@@ -145,8 +123,6 @@ Smarty\_Security class or create an instance of it.
    $my_security_policy = new Smarty_Security($smarty);
    // disable all PHP functions
    $my_security_policy->php_functions = null;
-    // remove PHP tags
-    $my_security_policy->php_handling = Smarty::PHP_REMOVE;
    // allow everthing as modifier
    $my_security_policy->php_modifiers = array();
    // enable security
@@ -164,5 +140,5 @@ Smarty\_Security class or create an instance of it.
 > **Note**
 >
 > Most security policy settings are only checked when the template gets
-> compiled. For that reasion you should delete all cached and compiled
+> compiled. For that reason you should delete all cached and compiled
 > template files when you change your security settings.
@@ -33,7 +33,7 @@ can override all or some of the parent named block areas.
    you can define the whole template inheritance tree in the PHP script
    when you are calling [`fetch()`](#api.fetch) or
    [`display()`](#api.display) with the `extends:` template resource
-    type. The later provides even more flexibillity.
+    type. The later provides even more flexibility.

 > **Note**
 >
@@ -8,7 +8,7 @@ Modifications done to the Smarty object will be global for all
 templates.

 However the Smarty class variables and functions can be accessed or
-called by induvidual template objects. Modification done to a template
+called by individual template objects. Modification done to a template
 object will apply only for that template and its included subtemplates.


@@ -21,7 +21,7 @@ key
    <?php

    // add directory where config files are stored
-    $smarty->addConigDir('./config_1');
+    $smarty->addConfigDir('./config_1');

    // add directory where config files are stored and specify array-key
    $smarty->addConfigDir('./config_1', 'one');
@@ -26,7 +26,7 @@ the following parameters:
    variables assigned to any of the objects in it\'s parent chain.

 Data objects are used to create scopes for assigned variables. They can
-be used to have controll which variables are seen by which templates.
+be used to control which variables are seen by which templates.


    <?php
@@ -9,7 +9,7 @@ string

 disableSecurity

-This disables securty checking on templates.
+This disables security checking on templates.

 See also [`enableSecurity()`](#api.enable.security), and
 [Security](#advanced.features.security).
@@ -25,7 +25,7 @@ string

 enableSecurity

-This enables securty checking on templates. It uses the following
+This enables security checking on templates. It uses the following
 parameters:

 -   `securityclass` is an optional parameter. It\'s the name of the
@@ -69,7 +69,7 @@ The `email_body.tpl` template

        

-The php script using the PHP [`mail()`](&url.php-manual;function.mail)
+The php script using the PHP [`mail()`](https://www.php.net/function.mail)
 function


@@ -10,12 +10,12 @@ string
 muteExpectedErrors

 muteExpectedErrors() registers a custom error handler using
-[set\_error\_handler()](&url.php-manual;set_error_handler). The error
+[set\_error\_handler()](https://www.php.net/set_error_handler). The error
 handler merely inspects `$errno` and `$errfile` to determine if the
 given error was produced deliberately and must be ignored, or should be
 passed on to the next error handler.

 `Smarty::unmuteExpectedErrors()` removes the current error handler.
-Please note, that if you\'ve registerd any custom error handlers after
+Please note, that if you\'ve registered any custom error handlers after
 the muteExpectedErrors() call, the unmute will not remove Smarty\'s
 muting error handler, but the one registered last.
@@ -18,7 +18,7 @@ not find a definition for a tag otherwise. It uses the following
 parameters:

 If during compilation Smarty encounters tag which is not defined
-internal, registered or loacted in the plugins folder it tries to
+internal, registered or located in the plugins folder it tries to
 resolve it by calling the registered default plugin handler. The handler
 may be called several times for same undefined tag looping over valid
 plugin types.
@@ -10,7 +10,7 @@ void
 testInstall

 This function verifies that all required working folders of the Smarty
-installation can be accessed. It does output a corresponding protocoll.
+installation can be accessed. It does output a corresponding protocol.


    <?php
@@ -39,7 +39,6 @@ them directly, or use the corresponding setter/getter methods.
 - [$left_delimiter](./api-variables/variable-left-delimiter.md)
 - [$locking_timeout](./api-variables/variable-locking-timeout.md)
 - [$merge_compiled_includes](./api-variables/variable-merge-compiled-includes.md)
- [$php_handling](./api-variables/variable-php-handling.md)
 - [$plugins_dir](./api-variables/variable-plugins-dir.md)
 - [$right_delimiter](./api-variables/variable-right-delimiter.md)
 - [$smarty_debug_id](./api-variables/variable-smarty-debug-id.md)
@@ -14,4 +14,4 @@ auto\_literal to false.
            
 :::

-See also [Escaping Smarty Parsing](#language.escaping),
+See also [Escaping Smarty parsing](#language.escaping),
@@ -13,6 +13,9 @@ changing), the compile check step is no longer needed. Be sure to set
 change this to FALSE and a template file is changed, you will \*not\*
 see the change since the template will not get recompiled.

+Note that up to Smarty 4.x, Smarty will check for the existence of 
+the source template even if `$compile_check` is disabled.
+
 If [`$caching`](#variable.caching) is enabled and `$compile_check` is
 enabled, then the cache files will get regenerated if an involved
 template file or config file was updated.
@@ -1,7 +1,7 @@
 \$compile\_id {#variable.compile.id}
 =============

-Persistant compile identifier. As an alternative to passing the same
+Persistent compile identifier. As an alternative to passing the same
 `$compile_id` to each and every function call, you can set this
 `$compile_id` and it will be used implicitly thereafter.

@@ -10,7 +10,7 @@ post-filters](#plugins.prefilters.postfilters) you must use a unique
 `$compile_id` to keep the compiled template files separated.

 For example a [prefilter](#plugins.prefilters.postfilters) that
-localizes your templates (that is: translates language dependend parts)
+localizes your templates (that is: translates language dependent parts)
 at compile time, then you could use the current language as
 `$compile_id` and you will get a set of compiled templates for each
 language you use.
@@ -2,7 +2,7 @@
 ==================

 When this value is set to a non-null-value it\'s value is used as php\'s
-[`error_reporting`](&url.php-manual;error_reporting) level inside of
+[`error_reporting`](https://www.php.net/error_reporting) level inside of
 [`display()`](#api.display) and [`fetch()`](#api.fetch).

 Smarty 3.1.2 introduced the
@@ -3,7 +3,7 @@

 Setting `$escape_html` to TRUE will escape all template variable output
 by wrapping it in
-`htmlspecialchars({$output}, ENT_QUOTES, SMARTY_RESOURCE_CHAR_SET);`,
+`htmlspecialchars({$output}, ENT_QUOTES, $char_set);`,
 which is the same as `{$variable|escape:"html"}`.

 Template designers can choose to selectively disable this feature by
@@ -2,6 +2,6 @@
 ==================

 This is maximum time in seconds a cache lock is valid to avoid dead
-locks. The deafult value is 10 seconds.
+locks. The default value is 10 seconds.

 See also [`$cache_locking`](#variable.cache.locking)
@@ -1,21 +0,0 @@
-\$php\_handling {#variable.php.handling}
-===============
-
-This tells Smarty how to handle PHP code embedded in the templates.
-There are four possible settings, the default being
-`Smarty::PHP_PASSTHRU`. Note that this does NOT affect php code within
-[`{php}{/php}`](#language.function.php) tags in the template.
-
-   `Smarty::PHP_PASSTHRU` - Smarty echos tags as-is.
-
-   `Smarty::PHP_QUOTE` - Smarty quotes the tags as html entities.
-
-   `Smarty::PHP_REMOVE` - Smarty removes the tags from the templates.
-
-   `Smarty::PHP_ALLOW` - Smarty will execute the tags as PHP code.
-
-> **Note**
->
-> Embedding PHP code into templates is highly discouraged. Use [custom
-> functions](#plugins.functions) or [modifiers](#plugins.modifiers)
-> instead.
@@ -18,7 +18,7 @@ found.
 >
 > If the directories known to `$template_dir` are relative to
 > directories known to the
-> [include\_path](&url.php-manual;ini.core.php#ini.include-path) you
+> [include\_path](https://www.php.net/ini.core.php#ini.include-path) you
 > need to activate the [`$use_include_path`](#variable.use.include.path)
 > option.

@@ -5,4 +5,4 @@
 array of all directories that are considered trusted. Trusted
 directories are where you keep php scripts that are executed directly
 from the templates with
-[`{include_php}`](#language.function.include.php).
+[`{insert}`](#language.function.insert.php).
@@ -2,7 +2,7 @@
 ====================

 This tells smarty to respect the
-[include\_path](&url.php-manual;ini.core.php#ini.include-path) within
+[include\_path](https://www.php.net/ini.core.php#ini.include-path) within
 the [`File Template Resource`](#resources.file) handler and the plugin
 loader to resolve the directories known to
 [`$template_dir`](#variable.template.dir). The flag also makes the
@@ -23,14 +23,14 @@ If use\_include\_path is enabled, file discovery for
    \$plugins\_dir) do

 -   Test if requested file is in `$directory` relative to the [current
-    working directory](&url.php-manual;function.getcwd.php). If file
+    working directory](https://www.php.net/function.getcwd.php). If file
    found, return it.

 -   For each `$path` in include\_path do

 -   Test if requested file is in `$directory` relative to the `$path`
    (possibly relative to the [current working
-    directory](&url.php-manual;function.getcwd.php)). If file found,
+    directory](https://www.php.net/function.getcwd.php)). If file found,
    return it.

 -   Try default\_handler or fail.
@@ -10,7 +10,7 @@ environments do not allow PHP processes to create directories, so this
 must be disabled which is the default.

 Sub directories are more efficient, so use them if you can.
-Theoretically you get much better perfomance on a filesystem with 10
+Theoretically you get much better performance on a filesystem with 10
 directories each having 100 files, than with 1 directory having 1000
 files. This was certainly the case with Solaris 7 (UFS)\... with newer
 filesystems such as ext3 and especially reiserfs, the difference is
@@ -19,7 +19,7 @@ almost nothing.
 > **Note**
 >
 > -   `$use_sub_dirs=true` doesn\'t work with
->     [safe\_mode=On](&url.php-manual;features.safe-mode), that\'s why
+>     [safe\_mode=On](https://www.php.net/features.safe-mode), that\'s why
 >     it\'s switchable and why it\'s off by default.
 >
 > -   `$use_sub_dirs=true` on Windows can cause problems.
@@ -25,10 +25,10 @@ like.
 -   You CANNOT remove a specified template name under multiple cache
    groups such as `'/a/b/*/foo.tpl'`, the cache grouping works
    left-to-right ONLY. You will need to group your templates under a
-    single cache group heirarchy to be able to clear them as a group.
+    single cache group hierarchy to be able to clear them as a group.

 Cache grouping should not be confused with your template directory
-heirarchy, the cache grouping has no knowledge of how your templates are
+hierarchy, the cache grouping has no knowledge of how your templates are
 structured. So for example, if you have a template structure like
 `themes/blue/index.tpl` and you want to be able to clear all the cache
 files for the "blue" theme, you will need to create a cache group
@@ -5,17 +5,17 @@ Charset Encoding {#charset.encoding}
 ================

 There are a variety of encodings for textual data, ISO-8859-1 (Latin1)
-and UTF-8 being the most popular. Unless specified otherwise with the
-`SMARTY_RESOURCE_CHAR_SET` constant, Smarty recognizes `UTF-8` as the
-internal charset if [Multibyte String](https://www.php.net/mbstring) is
-available, `ISO-8859-1` if not.
+and UTF-8 being the most popular. Unless you change `Smarty::$_CHARSET`, 
+Smarty recognizes `UTF-8` as the internal charset if 
+[Multibyte String](https://www.php.net/mbstring) is available, 
+`ISO-8859-1` if not.

 > **Note**
 >
 > `ISO-8859-1` has been PHP\'s default internal charset since the
 > beginning. Unicode has been evolving since 1991. Since then it has
 > become the one charset to conquer them all, as it is capable of
-> encoding most of the known characters even accross different character
+> encoding most of the known characters even across different character
 > systems (latin, cyrillic, japanese, ...). `UTF-8` is unicode\'s most
 > used encoding, as it allows referencing the thousands of character
 > with the smallest size overhead possible.
@@ -36,8 +36,9 @@ available, `ISO-8859-1` if not.
    if (function_exists('mb_internal_charset')) {
      mb_internal_charset('EUC-JP');
    }
-    define('SMARTY_RESOURCE_CHAR_SET', 'EUC-JP');
+
    require_once 'libs/Smarty.class.php';
+    Smarty::$_CHARSET = 'EUC-JP';
    $smarty = new Smarty();
      
     
@@ -62,7 +62,7 @@ cannot have both custom function `{func}` and block function

 If you have nested block functions, it\'s possible to find out what the
 parent block function is by accessing `$smarty->_tag_stack` variable.
-Just do a [`var_dump()`](&url.php-manual;var_dump) on it and the
+Just do a [`var_dump()`](https://www.php.net/var_dump) on it and the
 structure should be apparent.


@@ -25,7 +25,7 @@ The first parameter to the modifier plugin is the value on which the
 modifier is to operate. The rest of the parameters are optional,
 depending on what kind of operation is to be performed.

-The modifier has to [return](&url.php-manual;return) the result of its
+The modifier has to [return](https://www.php.net/return) the result of its
 processing.

 This plugin basically aliases one of the built-in PHP functions. It does
@@ -32,7 +32,7 @@ in order to be located by Smarty.

 -   And `name` should be a valid identifier; letters, numbers, and
    underscores only, see [php
-    variables](&url.php-manual;language.variables).
+    variables](https://www.php.net/language.variables).

 -   Some examples: `function.html_select_date.php`, `resource.db.php`,
    `modifier.spacify.php`.
@@ -3,20 +3,20 @@ Extends Template Resources {#resources.extends}

 The `extends:` resource is used to define child/parent relationships for
 template inheritance from the PHP script. For details see section of
-[Template Interitance](#advanced.features.template.inheritance).
+[Template Inheritance](#advanced.features.template.inheritance).

 As of Smarty 3.1 the `extends:` resource may use any available [template
 resource](#resources), including `string:` and `eval:`. When [templates
 from strings](#resources.string) are used, make sure they are properly
 (url or base64) encoded. Is an `eval:` resource found within an
 inheritance chain, its \"don\'t save a compile file\" property is
-superseeded by the `extends:` resource. The templates within an
+superseded by the `extends:` resource. The templates within an
 inheritance chain are not compiled separately, though. Only a single
 compiled template will be generated.

 > **Note**
 >
-> Use this when inheritance is required programatically. When inheriting
+> Use this when inheritance is required programmatically. When inheriting
 > within PHP, it is not obvious from the child template what inheritance
 > took place. If you have a choice, it is normally more flexible and
 > intuitive to handle inheritance chains from within the templates.
@@ -14,7 +14,7 @@ is invoked.
 > **Note**
 >
 > As of Smarty 3.1 the file resource no longer walks through the
-> [include\_path](&url.php-manual;ini.core.php#ini.include-path) unless
+> [include\_path](https://www.php.net/ini.core.php#ini.include-path) unless
 > [`$use_include_path` is activated](#variable.use.include.path)

 Templates from \$template\_dir {#templates.from.template.dir}
@@ -47,7 +47,7 @@ Templates from a specific \$template\_dir {#templates.from.specified.template.di
 Smarty 3.1 introduced the bracket-syntax for specifying an element from
 [`$template_dir`](#variable.template.dir). This allows websites
 employing multiple sets of templates better control over which template
-to acces.
+to access.

 The bracket-syntax can be used from anywhere you can specify the `file:`
 resource type.
@@ -46,8 +46,8 @@ From within a Smarty template
      

 Both `string:` and `eval:` resources may be encoded with
-[`urlencode()`](&url.php-manual;urlencode) or
-[`base64_encode()`](&url.php-manual;urlencode). This is not necessary
+[`urlencode()`](https://www.php.net/urlencode) or
+[`base64_encode()`](https://www.php.net/urlencode). This is not necessary
 for the usual use of `string:` and `eval:`, but is required when using
 either of them in conjunction with
 [`Extends Template Resource`](#resources.extends)
@@ -23,5 +23,4 @@ to determine the appropriate value automatically. If defined, the path

         

-See also [`$smarty.const`](../designers/language-variables/language-variables-smarty.md) and
-[`$php_handling constants`](./api-variables/variable-php-handling.md)
+See also [`$smarty.const`](../designers/language-variables/language-variables-smarty.md).