[SECURITY] Fedora 28 Update: php-Smarty-3.1.33-1.fc28

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-d248c5aa39
2019-03-06 15:27:20.805844
--------------------------------------------------------------------------------

Name        : php-Smarty
Product     : Fedora 28
Version     : 3.1.33
Release     : 1.fc28
URL         : http://www.smarty.net
Summary     : Smarty - the compiling PHP template engine
Description :
Smarty is a template engine for PHP, facilitating the separation of
presentation (HTML/CSS) from application logic. This implies that PHP
code is application logic, and is separated from the presentation.

Autoloader: /usr/share/php/Smarty/autoload.php

--------------------------------------------------------------------------------
Update Information:

===== 3.1.33 release ===== 12.09.2018  ===== 3.1.33-dev-12 =====  03.09.2018
- bugfix {foreach} using new style property access like {$item@property} on
Smarty 2 style named foreach loop could produce errors
https://github.com/smarty-php/smarty/issues/484  31.08.2018    - bugfix some
custom left and right delimiters like '{^' '^}' did not work
https://github.com/smarty-php/smarty/issues/450 https://github.com/smarty-
php/smarty/pull/482    - reformating for PSR-2 coding standards
https://github.com/smarty-php/smarty/pull/483    - bugfix on Windows absolute
filepathes did fail if the drive letter was followed by a linux
DIRECTORY_SEPARATOR     like C:/  at Smarty > 3.1.33-dev-5
https://github.com/smarty-php/smarty/issues/451    - PSR-2 code style fixes for
config and template file Lexer/Parser generated with     the Smarty Lexer/Parser
generator from https://github.com/smarty-php/smarty-lexer
https://github.com/smarty-php/smarty/pull/483  26.08.2018    -
bugfix/enhancement {capture} allow variable as capture block name in Smarty
special variable     like $smarty.capture.$foo https://github.com/smarty-
php/smarty/issues/478 https://github.com/smarty-php/smarty/pull/481  =====
3.1.33-dev-6 =====  19.08.2018    - fix PSR-2 coding standards and PHPDoc blocks
https://github.com/smarty-php/smarty/pull/452     https://github.com/smarty-
php/smarty/pull/475     https://github.com/smarty-php/smarty/pull/473   - bugfix
PHP5.2 compatibility https://github.com/smarty-php/smarty/pull/472  =====
3.1.33-dev-4 =====  17.05.2018   - bugfix strip-block produces different output
in Smarty v3.1.32 https://github.com/smarty-php/smarty/issues/436  - bugfix
Smarty::compileAllTemplates ignores `$extension` parameter
https://github.com/smarty-php/smarty/issues/437    https://github.com/smarty-
php/smarty/pull/438  - improvement do not compute total property in {foreach} if
not needed https://github.com/smarty-php/smarty/issues/443  - bugfix  plugins
may not be loaded when setMergeCompiledIncludes is true
https://github.com/smarty-php/smarty/issues/435  26.04.2018   - bugfix
regarding Security Vulnerability did not solve the problem under Linux.
Security issue CVE-2018-16831  ===== 3.1.32 ===== (24.04.2018)  24.04.2018   -
bugfix  possible Security Vulnerability in Smarty_Security class.  26.03.2018
- bugfix plugins may not be loaded if {function} or {block} tags are executed in
nocache mode    https://github.com/smarty-php/smarty/issues/371  26.03.2018   -
new feature {parent} =  {$smarty.block.parent} {child} =  {$smarty.block.child}
23.03.2018   - bugfix preg_replace could fail on large content resulting in a
blank page https://github.com/smarty-php/smarty/issues/417  21.03.2018   -
bugfix {$smarty.section...} used outside {section}{/section} showed incorrect
values if {section}{/section} was called inside    another loop
https://github.com/smarty-php/smarty/issues/422  - bugfix short form of
{section} attributes did not work https://github.com/smarty-
php/smarty/issues/428  17.03.2018   - improvement Smarty::compileAllTemplates()
exit with a non-zero status code if max errors is reached
https://github.com/smarty-php/smarty/pull/402  16.03.2018   - bugfix extends
resource did not work with user defined left/right delimiter
https://github.com/smarty-php/smarty/issues/419  22.11.2017   - bugfix {break}
and {continue} could fail if {foreach}{/foreach} did contain other    looping
tags like {for}, {section} and {while} https://github.com/smarty-
php/smarty/issues/323  20.11.2017    - bugfix rework of newline spacing between
tag code and template text.     now again identical with Smarty2 (forum topic
26878)   - replacement of " by '  05.11.2017    - lexer/parser optimization   -
code cleanup and optimizations   - bugfix {$smarty.section.name.loop} used
together with {$smarty.section.name.total} could produce     wrong results
(forum topic 27041)  26.10.2017    - bugfix Smarty version was  not filled in
header comment of compiled and cached  files   - optimization replace internal
Smarty::$ds property by DIRECTORY_SEPARATOR   - deprecate functions
Smarty::muteExpectedErrors() and Smarty::unmuteExpectedErrors()     as Smarty
does no longer use error suppression like @filemtime().     for backward
compatibility code is moved from Smarty class to an external class and still can
be     called.   - correction of PHPDoc blocks   - minor code cleanup
21.10.2017    - bugfix custom delimiters could fail since modification of
version 3.1.32-dev-23     https://github.com/smarty-php/smarty/issues/394
18.10.2017    - bugfix fix implementation of unclosed block tag in double quoted
string of 12.10.2017     https://github.com/smarty-php/smarty/issues/396
https://github.com/smarty-php/smarty/issues/397     https://github.com/smarty-
php/smarty/issues/391 https://github.com/smarty-php/smarty/issues/392
12.10.2017    - bugfix $smarty.block.child and $smarty.block.parent could not be
used like any     $smarty special variable https://github.com/smarty-
php/smarty/issues/393   - unclosed block tag in double quoted string must throw
compiler exception.      https://github.com/smarty-php/smarty/issues/391
https://github.com/smarty-php/smarty/issues/392  07.10.2017    - bugfix
modification of 9.8.2017 did fail on some recursive     tag nesting.
https://github.com/smarty-php/smarty/issues/389  26.8.2017    - bugfix chained
modifier failed when last modifier parameter is a signed value
https://github.com/smarty-php/smarty/issues/327   - bugfix templates filepath
with multibyte characters did not work     https://github.com/smarty-
php/smarty/issues/385   - bugfix {make_nocache} did display code if the template
did not contain other nocache code     https://github.com/smarty-
php/smarty/issues/369  09.8.2017    - improvement repeated delimiter like {{ and
}} will be treated as literal
https://groups.google.com/forum/#!topic/smarty-developers/h9r82Bx4KZw  05.8.2017
- bugfix wordwrap modifier could fail if used in nocache code.     converted
plugin file shared.mb_wordwrap.php into modifier.mb_wordwrap.php   - cleanup of
_getSmartyObj()  31.7.2017    - Call clearstatcache() after mkdir() failure
https://github.com/smarty-php/smarty/pull/379  30.7.2017    - rewrite mkdir()
bugfix to retry automatically see https://github.com/smarty-php/smarty/pull/377
https://github.com/smarty-php/smarty/pull/379  21.7.2017    - security possible
PHP code injection on custom resources at display() or fetch()     calls if the
resource does not sanitize the template name   - bugfix fix 'mkdir(): File
exists' error on create directory from parallel     processes
https://github.com/smarty-php/smarty/pull/377   - bugfix solve preg_match() hhvm
parameter problem https://github.com/smarty-php/smarty/pull/372  27.5.2017    -
bugfix change compiled code for registered function and modifiers to called as
callable to allow closures     https://github.com/smarty-php/smarty/pull/368,
https://github.com/smarty-php/smarty/issues/273   - bugfix
https://github.com/smarty-php/smarty/pull/368 did break the default plugin
handler   - improvement replace phpversion() by PHP_VERSION constant.
https://github.com/smarty-php/smarty/pull/363  21.5.2017    - performance store
flag for already required shared plugin functions in static variable or
Smarty's $_cache to improve performance when plugins are often called
https://github.com/smarty-php/smarty/commit/51e0d5cd405d764a4ea257d1bac1f...
4528#commitcomment-22280086   - bugfix remove special treatment of classes
implementing ArrayAccess in {foreach}     https://github.com/smarty-
php/smarty/issues/332   - bugfix remove deleted files by clear_cache() and
clear_compiled_template() from     ACP cache if present, add some is_file()
checks to avoid possible warnings on filemtime()     caused by above functions.
https://github.com/smarty-php/smarty/issues/341   - bugfix version 3.1.31 did
fail under PHP 5.2     https://github.com/smarty-php/smarty/issues/365
19.5.2017    - change properties $accessMap and $obsoleteProperties from private
to protected     https://github.com/smarty-php/smarty/issues/351   - new feature
The named capture buffers can now be accessed also as array     See
NEWS_FEATURES.txt https://github.com/smarty-php/smarty/issues/366   -
improvement check if ini_get() and ini_set() not disabled
https://github.com/smarty-php/smarty/pull/362  24.4.2017    - fix spelling
https://github.com/smarty-php/smarty/commit/e3eda8a5f5653d8abb960eb1bc47e...
b1b4#commitcomment-21803095  17.4.2017    - correct generated code on empty()
and isset() call, observe change PHP behaviour since PHP 5.5
https://github.com/smarty-php/smarty/issues/347  14.4.2017    - merge pull
requests https://github.com/smarty-php/smarty/pull/349,
https://github.com/smarty-php/smarty/pull/322 and    https://github.com/smarty-
php/smarty/pull/337 to fix spelling and annotation  13.4.2017    - bugfix
array_merge() parameter should be checked https://github.com/smarty-
php/smarty/issues/350  ===== 3.1.31 ===== (14.12.2016)    23.11.2016     - move
template object cache into static variables    19.11.2016    - bugfix
inheritance root child templates containing nested {block}{/block} could call
sub-bock content from parent     template https://github.com/smarty-
php/smarty/issues/317   - change version checking   11.11.2016    - bugfix when
Smarty is using a cached template object on Smarty::fetch() or
Smarty::isCached() the inheritance data     must be removed
https://github.com/smarty-php/smarty/issues/312   - smaller speed optimization
08.11.2016    - add bootstrap file to load and register Smarty_Autoloader.
Change composer.json to make it known to composer   07.11.2016    - optimization
of lexer speed https://github.com/smarty-php/smarty/issues/311   27.10.2016    -
bugfix template function definitions array has not been cached between
Smarty::fetch() and Smarty::display() calls     https://github.com/smarty-
php/smarty/issues/301   23.10.2016    - improvement/bugfix when Smarty::fetch()
is called on a template object the inheritance and tplFunctions property
should be copied to the called template object   21.10.2016    - bugfix for
compile locking touched timestamp of old compiled file was not restored on
compilation error https://github.com/smarty-php/smarty/issues/308   20.10.2016
- bugfix nocache code was not removed in cache file when subtemplate did contain
PHP short tags in text but no other     nocache code https://github.com/smarty-
php/smarty/issues/300   19.10.2016    - bugfix {make_nocache $var} did fail when
variable value did contain '\' https://github.com/smarty-php/smarty/issues/305
- bugfix {make_nocache $var} remove spaces from variable value
https://github.com/smarty-php/smarty/issues/304   12.10.2016    - bugfix
{include} with template names including variable or constants could fail after
bugfix from      28.09.2016 https://github.com/smarty-php/smarty/issues/302
08.10.2016    - optimization move runtime extension for template functions into
Smarty objects   29.09.2016    - improvement new Smarty::$extends_recursion
property to disable execution of {extends} in templates called by extends
resource      https://github.com/smarty-php/smarty/issues/296   28.09.2016    -
bugfix the generated code for calling a subtemplate must pass the template
resource name in single quotes https://github.com/smarty-php/smarty/issues/299
- bugfix nocache hash was not removed for <?xml ?> tags in subtemplates
https://github.com/smarty-php/smarty/issues/300   27.09.2016    - bugfix when
Smarty does use an internally cached template object on Smarty::fetch() calls
the template and config variables must be cleared https://github.com/smarty-
php/smarty/issues/297   20.09.2016    - bugfix some $smarty special template
variables are no longer accessed as real variable.     using them on calls like
{if isset($smarty.foo)} or {if empty($smarty.foo)} will fail
http://www.smarty.net/forums/viewtopic.php?t=26222   - temporary fix for
https://github.com/smarty-php/smarty/issues/293 main reason still under
investigation   - improvement new tags {block_parent} {block_child} in template
inheritance   19.09.2016    - optimization clear compiled and cached folder
completely on detected version change   - cleanup convert cache resource file
method clear into runtime extension   15.09.2016    - bugfix assigning a
variable in if condition by function like {if $value = array_shift($array)} the
function got called twice https://github.com/smarty-php/smarty/issues/291   -
bugfix function plugins called with assign attribute like {foo assign='bar'} did
not output returned content because            because assumption was made that
it was assigned to a variable https://github.com/smarty-php/smarty/issues/292
- bugfix calling $smarty->isCached() on a not existing cache file with
$smarty->cache_locking = true; could cause a 10 second delay
http://www.smarty.net/forums/viewtopic.php?t=26282   - improvement make
Smarty::clearCompiledTemplate() on custom resource independent from changes of
templateId computation   11.09.2016    - improvement {math} misleading
E_USER_WARNING messages when parameter value = null https://github.com/smarty-
php/smarty/issues/288   - improvement move often used code snippets into methods
- performance Smarty::configLoad() did load unneeded template source object
09.09.2016    - bugfix/optimization {foreach} did not execute the {foreachelse}
when iterating empty objects https://github.com/smarty-php/smarty/pull/287   -
bugfix {foreach} must keep the @properties when restoring a saved $item variable
as the properties might be used outside {foreach} https://github.com/smarty-
php/smarty/issues/267   - improvement {foreach} observe {break n} and {continue
n} nesting levels when restoring saved $item and $key variables   08.09.2016
- bugfix implement wrapper for removed method getConfigVariable()
https://github.com/smarty-php/smarty/issues/286   07.09.2016    - bugfix using
nocache like attribute with value true like {plugin nocache=true} did not work
https://github.com/smarty-php/smarty/issues/285   - bugfix uppercase TRUE, FALSE
and NULL did not work when security was enabled https://github.com/smarty-
php/smarty/issues/282   - bugfix when {foreach} was looping over an object the
total property like {$item@total} did always return 1 https://github.com/smarty-
php/smarty/issues/281   - bugfix {capture}{/capture} did add in 3.1.30
unintended additional blank lines https://github.com/smarty-
php/smarty/issues/268   01.09.2016    - performance require_once should be
called only once for shared plugins https://github.com/smarty-
php/smarty/issues/280   26.08.2016    - bugfix change of 23.08.2016 failed on
linux when use_include_path = true   23.08.2016    - bugfix remove constant DS
as shortcut for DIRECTORY_SEPARATOR as the user may have defined it to something
else https://github.com/smarty-php/smarty/issues/277   20.08-2016    - bugfix
{config_load ... scope="global"} shall not throw an arror but fallback to
scope="smarty" https://github.com/smarty-php/smarty/issues/274   - bugfix
{make_nocache} failed when using composer autoloader https://github.com/smarty-
php/smarty/issues/275   14.08.2016    - bugfix $smarty_>debugging = true; did
E_NOTICE messages when {eval} tag was used https://github.com/smarty-
php/smarty/issues/266   - bugfix Class
'Smarty_Internal_Runtime_ValidateCompiled' not found when upgrading from some
older Smarty versions with existing            compiled or cached template files
https://github.com/smarty-php/smarty/issues/269   - optimization remove unneeded
call to update acopes when {assign} scope and template scope was local (default)
===== 3.1.30 ===== (07.08.2016)   07.08.2016    - bugfix update of 04.08.2016
was incomplete   05.08.2016    - bugfix compiling of templates failed when the
Smarty delimiter did contain '/' https://github.com/smarty-php/smarty/issues/264
- updated error checking at template and config default handler   04.08.2016
- improvement move template function source parameter into extension
26.07.2016    - optimization unneeded loading of compiled resource   24.07.2016
- regression this->addPluginsDir('/abs/path/to/dir') adding absolute path
without trailing '/' did fail https://github.com/smarty-php/smarty/issues/260
23.07.2016    - bugfix setTemplateDir('/') and setTemplateDir('') did
create
wrong absolute filepath https://github.com/smarty-php/smarty/issues/245   -
optimization of filepath normalization   - improvement remove double function
declaration in plugin shared.escape_special_cars.php https://github.com/smarty-
php/smarty/issues/229   19.07.2016    - bugfix multiple {include} with relative
filepath within {block}{/block} could fail https://github.com/smarty-
php/smarty/issues/246   - bugfix {math} shell injection vulnerability patch
provided by Tim Weber   18.07.2016    - bugfix {foreach} if key variable and
item@key attribute have been used both the key variable was not updated
https://github.com/smarty-php/smarty/issues/254   - bugfix modifier on plugins
like {plugin|modifier ... } did fail when the plugin does return an array
https://github.com/smarty-php/smarty/issues/228   - bugfix avoid
opcache_invalidate to result in ErrorException when opcache.restrict_api is not
empty https://github.com/smarty-php/smarty/pull/244   - bugfix multiple
{include} with relative filepath within {block}{/block} could fail
https://github.com/smarty-php/smarty/issues/246   14.07.2016    - bugfix wrong
parameter on compileAllTemplates() and compileAllConfig()
https://github.com/smarty-php/smarty/issues/231   13.07.2016    - bugfix PHP 7
compatibility on registered compiler plugins https://github.com/smarty-
php/smarty/issues/241   - update testInstall() https://github.com/smarty-
php/smarty/issues/248https://github.com/smarty-php/smarty/issues/248   - bugfix
enable debugging could fail when template objects did already exists
https://github.com/smarty-php/smarty/issues/237   - bugfix template function
data should be merged when loading subtemplate https://github.com/smarty-
php/smarty/issues/240   - bugfix wrong parameter on compileAllTemplates()
https://github.com/smarty-php/smarty/issues/231   12.07.2016    - bugfix
{foreach} item variable must be created also on empty from array
https://github.com/smarty-php/smarty/issues/238 and https://github.com/smarty-
php/smarty/issues/239   - bugfix enableSecurity() must init cache flags
https://github.com/smarty-php/smarty/issues/247   27.05.2016    -
bugfix/improvement of compileAlltemplates() follow symlinks in template folder
(PHP >= 5.3.1) https://github.com/smarty-php/smarty/issues/224       clear
internal cache and expension handler for each template to avoid possible
conflicts https://github.com/smarty-php/smarty/issues/231   16.05.2016    -
optimization {foreach} compiler and processing   - broken PHP 5.3 and 5.4
compatibility   15.05.2016    - optimization and cleanup of resource code
10.05.2016    - optimization of inheritance processing   07.05.2016    -bugfix
Only variables should be assigned by reference https://github.com/smarty-
php/smarty/issues/227   02.05.2016    - enhancement {block} tag names can now be
variable https://github.com/smarty-php/smarty/issues/221   01.05.2016    -
bugfix same relative filepath at {include} called from template in different
folders could display wrong sub-template   29.04.2016    - bugfix {strip} remove
space on linebreak between html tags https://github.com/smarty-
php/smarty/issues/213   24.04.2016    - bugfix nested {include} with relative
file path could fail when called in {block} ... {/block}
https://github.com/smarty-php/smarty/issues/218   14.04.2016    - bugfix special
variable {$smarty.capture.name} was not case sensitive on name
https://github.com/smarty-php/smarty/issues/210   - bugfix the default template
handler must calculate the source uid https://github.com/smarty-
php/smarty/issues/205   13.04.2016    - bugfix template inheritance status must
be saved when calling sub-templates https://github.com/smarty-
php/smarty/issues/215   27.03.2016    - bugfix change of 11.03.2016 cause again
{capture} data could not been seen in other templates with
{$smarty.capture.name} https://github.com/smarty-php/smarty/issues/153
11.03.2016    - optimization of capture and security handling   - improvement
$smarty->clearCompiledTemplate() should return on recompiled or uncompiled
resources   10.03.2016    - optimization of resource processing   09.03.2016
- improvement rework of 'scope' attribute handling see see NEW_FEATURES.txt
https://github.com/smarty-php/smarty/issues/194     https://github.com/smarty-
php/smarty/issues/186 https://github.com/smarty-php/smarty/issues/179   - bugfix
correct Autoloader update of 2.3.2014 https://github.com/smarty-
php/smarty/issues/199   04.03.2016    - bugfix change from 01.03.2016 will cause
$smarty->isCached(..) failure if called multiple time for same template
(forum topic 25935)   02.03.2016    - revert autoloader optimizations because of
unexplainable warning when using plugins https://github.com/smarty-
php/smarty/issues/199   01.03.2016    - bugfix template objects must be cached
on $smarty->fetch('foo.tpl) calls incase the template is fetched     multiple
times (forum topic 25909)   25.02.2016    - bugfix wrong _realpath with 4 or
more parent-directories https://github.com/smarty-php/smarty/issues/190   -
optimization of _realpath   - bugfix instanceof expression in template code must
be treated as value https://github.com/smarty-php/smarty/issues/191   20.02.2016
- bugfix {strip} must keep space between hmtl tags. Broken by changes of
10.2.2016 https://github.com/smarty-php/smarty/issues/184   - new feature/bugfix
{foreach}{section} add 'properties' attribute to force compilation of loop
properties     see NEW_FEATURES.txt https://github.com/smarty-
php/smarty/issues/189   19.02.2016    - revert output buffer flushing on
display, echo content again because possible problems when PHP files had
characters (newline} after ?> at file end https://github.com/smarty-
php/smarty/issues/187   14.02.2016    - new tag {make_nocache} read
NEW_FEATURES.txt https://github.com/smarty-php/smarty/issues/110   -
optimization of sub-template processing   - bugfix using extendsall as default
resource and {include} inside {block} tags could produce unexpected results
https://github.com/smarty-php/smarty/issues/183   - optimization of tag
attribute compiling   - optimization make compiler tag object cache static for
higher compilation speed   11.02.2016    - improvement added KnockoutJS comments
to trimwhitespace outputfilter https://github.com/smarty-php/smarty/issues/82
https://github.com/smarty-php/smarty/pull/181   10.02.2016    - bugfix {strip}
must keep space on output creating smarty tags within html tags
https://github.com/smarty-php/smarty/issues/177   - bugfix wrong precedence on
special if conditions like '$foo is ... by $bar' could cause wrong code
https://github.com/smarty-php/smarty/issues/178   - improvement because of
ambiguities the inline constant support has been removed from the $foo.bar
syntax https://github.com/smarty-php/smarty/issues/149   - bugfix other {strip}
error with output tags between hmtl https://github.com/smarty-
php/smarty/issues/180   09.02.2016    - move some code from parser into compiler
- reformat all code for unique style   - update/bugfix scope attribute handling
reworked. Read the newfeatures.txt file   05.02.2016    - improvement internal
compiler changes   01.02.2016    - bugfix {foreach} compilation failed when
$smarty->merge_compiled_includes = true and pre-filters are used.   29.01.2016
- bugfix implement replacement code for _tag_stack property
https://github.com/smarty-php/smarty/issues/151   28.01.2016    - bugfix allow
windows network filepath or wrapper (forum topic 25876)
https://github.com/smarty-php/smarty/issues/170   - bugfix if fetch('foo.tpl')
is called on a template object the $parent parameter should default to the
calling template object https://github.com/smarty-php/smarty/issues/152
27.01.2016    - revert bugfix compiling {section} did create warning   - bugfix
{$smarty.section.customer.loop} did throw compiler error
https://github.com/smarty-php/smarty/issues/161     update of yesterdays fix   -
bugfix string resource could inject code at {block} or inline subtemplates
through PHP comments https://github.com/smarty-php/smarty/issues/157
- bugfix output filters did not observe nocache code
flhttps://github.com/smarty-php/smarty/issues/154g https://github.com/smarty-
php/smarty/issues/160   - bugfix {extends} with relative file path did not work
https://github.com/smarty-php/smarty/issues/154     https://github.com/smarty-
php/smarty/issues/158   - bugfix {capture} data could not been seen in other
templates with {$smarty.capture.name} https://github.com/smarty-
php/smarty/issues/153   26.01.2016    - improvement observe Smarty::$_CHARSET in
debugging console https://github.com/smarty-php/smarty/issues/169   - bugfix
compiling {section} did create warning   - bugfix
{$smarty.section.customer.loop} did throw compiler error
https://github.com/smarty-php/smarty/issues/161   02.01.2016    - update scope
handling   - optimize block plugin compiler   - improvement runtime checks if
registered block plugins are callable   01.01.2016    - remove
Smarty::$resource_cache_mode property   31.12.2015    - optimization of
{assign}, {if} and {while} compiled code   30.12.2015    - bugfix plugin names
starting with "php" did not compile https://github.com/smarty-
php/smarty/issues/147   29.12.2015    - bugfix Smarty::error_reporting was not
observed when display() or fetch() was called on template objects
https://github.com/smarty-php/smarty/issues/145   28.12.2015    - optimization
of {foreach} code size and processing   27.12.2015    - improve inheritance code
- update external methods   - code fixes   - PHPdoc updates   25.12.2015    -
compile {block} tag code and its processing into classes   - optimization
replace hhvm extension by inline code   - new feature If ACP is enabled force an
apc_compile_file() when compiled or cached template was updated   24.12.2015
- new feature Compiler does now observe the template_dir setting and will create
separate compiled files if required   - bugfix post filter did fail on template
inheritance https://github.com/smarty-php/smarty/issues/144   23.12.2015    -
optimization move internal method decodeProperties back into template object   -
optimization move subtemplate processing back into template object   - new
feature Caching does now observe the template_dir setting and will create
separate cache files if required   22.12.2015    - change $xxx_dir properties
from private to protected in case Smarty class gets extended   - code
optimizations   21.12.2015    - bugfix a filepath starting with '/' or '\'
on
windows should normalize to the root dir     of current working drive
https://github.com/smarty-php/smarty/issues/134   - optimization of filepath
normalization   - bugfix {strip} must remove all blanks between html tags
https://github.com/smarty-php/smarty/issues/136   ===== 3.1.29 =====
(21.12.2015)   21.12.2015    - optimization improve speed of filetime checks on
extends and extendsall resource   20.12.2015    - bugfix failure when the
default resource type was set to 'extendsall' https://github.com/smarty-
php/smarty/issues/123   - update compilation of Smarty special variables   -
bugfix add addition check for OS type on normalization of file path
https://github.com/smarty-php/smarty/issues/134   - bugfix the source uid of the
extendsall resource must contain $template_dir settings
https://github.com/smarty-php/smarty/issues/123   19.12.2015    - bugfix using
$smarty.capture.foo in expressions could fail https://github.com/smarty-
php/smarty/pull/138   - bugfix broken PHP 5.2 compatibility
https://github.com/smarty-php/smarty/issues/139   - remove no longer used code
- improvement make sure that compiled and cache templates never can contain a
trailing '?>?   18.12.2015    - bugfix regression when modifier parameter was
followed by math https://github.com/smarty-php/smarty/issues/132   17.12.2015
- bugfix {$smarty.capture.nameFail} did lowercase capture name
https://github.com/smarty-php/smarty/issues/135   - bugfix using {block
append/prepend} on same block in multiple levels of inheritance templates could
fail (forum topic 25827)   - bugfix text content consisting of just a single '0'
like in {if true}0{/if} was suppressed (forum topic 25834)   16.12.2015    -
bugfix {foreach} did fail if from atrribute is a Generator class
https://github.com/smarty-php/smarty/issues/128   - bugfix direct access
$smarty->template_dir = 'foo'; should call Smarty::setTemplateDir()
https://github.com/smarty-php/smarty/issues/121   15.12.2015    - bugfix
{$smarty.cookies.foo} did return the $_COOKIE array not the 'foo' value
https://github.com/smarty-php/smarty/issues/122   - bugfix  a call to
clearAllCache() and other should clear all internal template object caches
(forum topic 25828)   14.12.2015    - bugfix  {$smarty.config.foo} broken in
3.1.28 https://github.com/smarty-php/smarty/issues/120   - bugfix  multiple
calls of {section} with same name droped E_NOTICE error
https://github.com/smarty-php/smarty/issues/118   ===== 3.1.28 =====
(13.12.2015)   13.12.2015    - bugfix {foreach} and {section} with uppercase
characters in name attribute did not work (forum topic 25819)   - bugfix
$smarty->debugging_ctrl = 'URL' did not work (forum topic 25811)   - bugfix
Debug Console could display incorrect data when using subtemplates   09.12.2015
- bugfix Smarty did fail under PHP 7.0.0 with use_include_path = true;
09.12.2015    - bugfix {strip} should exclude some html tags from stripping,
related to fix for https://github.com/smarty-php/smarty/issues/111   08.12.2015
- bugfix internal template function data got stored in wrong compiled file
https://github.com/smarty-php/smarty/issues/114   05.12.2015    -bugfix {strip}
should insert a single space https://github.com/smarty-php/smarty/issues/111
25.11.2015    -bugfix a left delimter like '[%' did fail on
[%$var_[%$variable%]%] (forum topic 25798)   02.11.2015    - bugfix {include}
with variable file name like {include file="foo_`$bar`.tpl"} did fail in
3.1.28-dev https://github.com/smarty-php/smarty/issues/102   01.11.2015    -
update config file processing   31.10.2015    - bugfix add missing $trusted_dir
property to SmartyBC class (forum topic 25751)   29.10.2015    - improve
template scope handling   24.10.2015    - more optimizations of template
processing   - bugfix Error when using {include} within {capture}
https://github.com/smarty-php/smarty/issues/100   21.10.2015    - move some code
into runtime extensions   18.10.2015    - optimize filepath normalization   -
rework of template inheritance   - speed and size optimizations   - bugfix under
HHVM temporary cache file must only be created when caches template was updated
- fix compiled code for new {block} assign attribute   - update code generated
by template function call handler   18.09.2015    - bugfix {if $foo instanceof
$bar} failed to compile if 2nd value is a variable https://github.com/smarty-
php/smarty/issues/92   17.09.2015    - bugfix {foreach} first attribute was not
correctly reset since commit 05a8fa2 of 02.08.2015 https://github.com/smarty-
php/smarty/issues/90   16.09.2015    - update compiler by moving no longer
needed properties, code optimizations and other   14.09.2015    - optimize
autoloader   - optimize subtemplate handling   - update template inheritance
processing   - move code of {call} processing back into Smarty_Internal_Template
class   - improvement invalidate OPCACHE for cleared compiled and cached
template files (forum topic 25557)   - bugfix unintended multiple debug windows
(forum topic 25699)   30.08.2015    - size optimization move some runtime
functions into extension   - optimize inline template processing   -
optimization merge inheritance child and parent templates into one compiled
template file   29.08.2015    - improvement convert template inheritance into
runtime processing   - bugfix {$smarty.block.parent} did always reference the
root parent block https://github.com/smarty-php/smarty/issues/68   23.08.2015
- introduce Smarty::$resource_cache_mode and cache template object of {include}
inside loop   - load seldom used Smarty API methods dynamically to reduce memory
footprint   - cache template object of {include} if same template is included
several times   - convert debug console processing to object   - use output
buffers for better performance and less memory usage   - optimize nocache hash
processing   - remove not really needed properties   - optimize rendering   -
move caching to Smarty::_cache   - remove properties with redundant content   -
optimize Smarty::templateExists()   - optimize use_include_path processing   -
relocate properties for size optimization   - remove redundant code   - bugfix
compiling super globals like {$smarty.get.foo} did fail in the master branch
https://github.com/smarty-php/smarty/issues/77   06.08.2015    - avoid possible
circular object references caused by parser/lexer objects   - rewrite
compileAll... utility methods   - commit several  internal improvements   -
bugfix Smarty failed when compile_id did contain "|"   03.08.2015    - rework
clear cache methods   - bugfix compileAllConfig() was broken since 3.1.22
because of the changes in config file processing   - improve getIncludePath() to
return directory if no file was given   02.08.2015    - optimization and code
cleanup of {foreach} and {section} compiler   - rework {capture} compiler
01.08.2015    - update DateTime object can be instance of DateTimeImmutable
since PHP5.5 https://github.com/smarty-php/smarty/pull/75   - improvement show
resource type and start of template source instead of uid on eval: and string:
resource (forum topic 25630)   31.07.2015    - optimize {foreach} and {section}
compiler   29.07.2015    - optimize {section} compiler for speed and size of
compiled code   28.07.2015    - update for PHP 7 compatibility   26.07.2015    -
improvement impement workaround for HHVM PHP incompatibillity
https://github.com/facebook/hhvm/issues/4797   25.07.2015    - bugfix parser did
hang on text starting <?something https://github.com/smarty-php/smarty/issues/74
20.07.2015    - bugfix config files got recompiled on each request   -
improvement invalidate PHP 5.5 opcache for recompiled and cached templates
https://github.com/smarty-php/smarty/issues/72   12.07.2015    - optimize
{extends} compilation   10.07.2015    - bugfix force file: resource in demo
resource.extendsall.php   08.07.2015    - bugfix convert each word of class
names to ucfirst in in compiler. (forum topic 25588)   07.07.2015    -
improvement allow fetch() or display() called on a template object to get output
from other template      like $template->fetch('foo.tpl')
https://github.com/smarty-php/smarty/issues/70   - improvement Added $limit
parameter to regex_replace modifier #71   - new feature multiple indices on
file: resource   06.07.2015    - optimize {block} compilation   - optimization
get rid of __get and __set in source object   01.07.2015    - optimize compile
check handling   - update {foreach} compiler   - bugfix debugging console did
not display string values containing \n, \r or \t correctly
https://github.com/smarty-php/smarty/issues/66   - optimize source resources
28.06.2015    - move $smarty->enableSecurity() into Smarty_Security class   -
optimize security isTrustedResourceDir()   - move auto load filter methods into
extension   - move $smarty->getTemplateVars() into extension   - move
getStreamVariable() into extension   - move $smarty->append() and
$smarty->appendByRef() into extension   - optimize autoloader   - optimize file
path normalization   - bugfix PATH_SEPARATOR was replaced by mistake in
autoloader   - remove redundant code   27.06.2015    - bugfix resolve naming
conflict between custom Smarty delimiter '<%' and PHP ASP tags
https://github.com/smarty-php/smarty/issues/64   - update $smarty->_realpath for
relative path not starting with './'   - update Smarty security with new
realpath handling   - update {include_php} with new realpath handling   - move
$smarty->loadPlugin() into extension   - minor compiler optimizations   - bugfix
allow function plugins with name ending with 'close' https://github.com/smarty-
php/smarty/issues/52   - rework of $smarty->clearCompiledTemplate() and move it
to its own extension   19.06.2015    - improvement allow closures as callback at
$smarty->registerFilter() https://github.com/smarty-php/smarty/issues/59   =====
3.1.27===== (18.06.2015)   18.06.2015    - bugfix another update on file path
normalization failed on path containing something like "/.foo/"
https://github.com/smarty-php/smarty/issues/56   ===== 3.1.26===== (18.06.2015)
18.06.2015    - bugfix file path normalization failed on path containing
something like "/.foo/" https://github.com/smarty-php/smarty/issues/56
17.06.2015    - bugfix calling a plugin with nocache option but no other
attributes like {foo nocache} caused call to undefined function
https://github.com/smarty-php/smarty/issues/55   ===== 3.1.25===== (15.06.2015)
15.06.2015    - optimization of smarty_cachereource_keyvaluestore.php code
14.06.2015    - bugfix a relative sub template path could fail if template_dir
path did contain /../ https://github.com/smarty-php/smarty/issues/50   -
optimization rework of path normalization   - bugfix an output tag with
variable, modifier followed by an operator like {$foo|modifier+1} did fail
https://github.com/smarty-php/smarty/issues/53   13.06.2015    - bugfix a custom
cache resource using smarty_cachereource_keyvaluestore.php did fail if php.ini
mbstring.func_overload = 2 (forum topic 25568)   11.06.2015    - bugfix the
lexer could hang on very large quoted strings (forum topic 25570)   08.06.2015
- bugfix using {$foo} as array index like $bar.{$foo} or in double quoted string
like "some {$foo} thing" failed https://github.com/smarty-php/smarty/issues/49
04.06.2015    - bugfix possible error message on unset() while compiling {block}
tags https://github.com/smarty-php/smarty/issues/46   01.06.2015    - bugfix
<?xml ... ?> including template variables broken  since 3.1.22
https://github.com/smarty-php/smarty/issues/47   27.05.2015    - bugfix
{include} with variable file name must not create by default individual cache
file (since 3.1.22) https://github.com/smarty-php/smarty/issues/43   24.05.2015
- bugfix if condition string 'neq' broken due to a typo
https://github.com/smarty-php/smarty/issues/42   ===== 3.1.24===== (23.05.2015)
23.05.2015    - improvement on php_handling to allow very large PHP sections,
better error handling   - improvement allow extreme large comment sections
(forum 25538)   21.05.2015    - bugfix broken PHP 5.2 compatibility when
compiling <?php tags https://github.com/smarty-php/smarty/issues/40   - bugfix
named {foreach} comparison like $smarty.foreach.foobar.index > 1 did compile
into wrong code https://github.com/smarty-php/smarty/issues/41   19.05.2015    -
bugfix compiler did overwrite existing variable value when setting the nocache
attribute https://github.com/smarty-php/smarty/issues/39   - bugfix output
filter trimwhitespace could run into the pcre.backtrack_limit on large output
(code.google issue 220)   - bugfix compiler could run into the
pcre.backtrack_limit on larger comment or {php} tag sections (forum 25538)
18.05.2015    - improvement introduce shortcuts in lexer/parser rules for most
frequent terms for higher     compilation speed   16.05.2015    - bugfix
{php}{/php} did work just for single lines https://github.com/smarty-
php/smarty/issues/33   - improvement remove not needed ?><?php transitions from
compiled code   - improvement reduce number of lexer tokens on operators and if
conditions   - improvement higher compilation speed by modified lexer/parser
generator at "smarty/smarty-lexer"   13.05.2015    - improvement remove not
needed ?><?php transitions from compiled code   - improvement of debugging:
- use fresh Smarty object to display the debug console because of possible
problems when the Smarty         was extended or Smarty properties had been
modified in the class source       - display Smarty version number       -
Truncate lenght of Origin display and extend strin value display to 80 character
- bugfix in Smarty_Security  'nl2br' should be a trusted modifier, not PHP
function (code.google issue 223)   12.05.2015    - bugfix
{$smarty.constant.TEST} did fail  on undefined constant
https://github.com/smarty-php/smarty/issues/28   - bugfix access to undefined
config variable like {#undef#} did fail https://github.com/smarty-
php/smarty/issues/29   - bugfix in nested {foreach} saved item attributes got
overwritten https://github.com/smarty-php/smarty/issues/33   ===== 3.1.23 =====
(12.05.2015)   12.05.2015    - bugfix of smaller performance issue introduce in
3.1.22 when caching is enabled   - bugfix missig entry for smarty-temmplate-
config in autoloader   ===== 3.1.22 ===== tag was deleted because 3.1.22 did
fail caused by the missing entry for smarty-temmplate-config in autoloader
10.05.2015    - bugfix custom cache resource did not observe compile_id and
cache_id when $cache_locking == true   - bugfix cache lock was not handled
correctly after timeout when $cache_locking == true   - improvement added
constants for $debugging   07.05.2015    - improvement of the debugging console.
Read NEW_FEATURES.txt   - optimization of resource class loading   06.05.2015
- bugfix in 3.1.22-dev cache resource must not be loaded for subtemplates   -
bugfix/improvement in 3.1.22-dev cache locking did not work as expected
05.05.2015    - optimization on cache update when main template is modified   -
optimization move <?php ?> handling from parser to new compiler module
05.05.2015    - bugfix code could be messed up when {tags} are used in multiple
attributes https://github.com/smarty-php/smarty/issues/23   04.05.2015    -
bugfix Smarty_Resource::parseResourceName incompatible with Google AppEngine
(https://github.com/smarty-php/smarty/issues/22)   - improvement use is_file()
checks to avoid errors suppressed by @ which could still cause problems
(https://github.com/smarty-php/smarty/issues/24)   28.04.2015    - bugfix
plugins of merged subtemplates not loaded in 3.1.22-dev (forum topic 25508) 2nd
fix   28.04.2015    - bugfix plugins of merged subtemplates not loaded in
3.1.22-dev (forum topic 25508)   23.04.2015    - bugfix a nocache template
variable used as parameter at {insert} was by mistake cached   20.04.2015    -
bugfix at a template function containing nocache code a parmeter could overwrite
a template variable of same name   27.03.2015    - bugfix
Smarty_Security->allow_constants=false; did also disable true, false and null
(change of 16.03.2015)   - improvement added a whitelist for trusted constants
to security Smarty_Security::$trusted_constants (forum topic 25471)   20.03.2015
- bugfix make sure that function properties get saved only in compiled files
containing the fuction definition {forum topic 25452}   - bugfix correct update
of global variable values on exit of template functions. (reported under Smarty
Developers)   16.03.2015   - bugfix  problems with {function}{/function} and
{call} tags in different subtemplate cache files {forum topic 25452}  - bugfix
Smarty_Security->allow_constants=false; did not disallow direct usage of defined
constants like {SMARTY_DIR} {forum topic 25457}  - bugfix  {block}{/block} tags
did not work inside double quoted strings https://github.com/smarty-
php/smarty/issues/18    15.03.2015   - bugfix  $smarty->compile_check must be
restored before rendering of a just updated cache file {forum 25452}
14.03.2015   - bugfix  {nocache}  {/nocache} tags corrupted code when used
within a nocache section caused by a nocache template variable.   - bugfix
template functions defined with {function} in an included subtemplate could not
be called in nocache            mode with {call... nocache} if the subtemplate
had it's own cache file {forum 25452}   10.03.2015   - bugfix {include ...
nocache} whith variable file or compile_id attribute was not executed in nocache
mode.   12.02.2015   - bugfix multiple Smarty::fetch() of same template when
$smarty->merge_compiled_includes = true; could cause function already defined
error   11.02.2015   - bugfix recursive {includes} did create E_NOTICE message
when $smarty->merge_compiled_includes = true; (github issue #16)   22.01.2015
- new feature security can now control access to static methods and properties
see also NEW_FEATURES.txt   21.01.2015   - bugfix clearCompiledTemplates(),
clearAll() and clear() could try to delete whole drive at wrong path permissions
because realpath() fail (forum 25397)  - bugfix 'self::' and 'parent::'
was
interpreted in template syntax as static class   04.01.2015   - push last weeks
changes to github  - different optimizations  - improvement automatically create
different versions of compiled templates and config files depending    on
property settings.  - optimization restructure template processing by moving
code into classes it better belongs to  - optimization restructure config file
processing   31.12.2014  - bugfix use function_exists('mb_get_info') for setting
Smarty::$_MBSTRING.    Function mb_split could be overloaded depending on
php.ini mbstring.func_overload    29.12.2014   - new feature security can now
limit the template nesting level by property $max_template_nesting
see also NEW_FEATURES.txt (forum 25370)   29.12.2014   - new feature security
can now disable special $smarty variables listed in property
$disabled_special_smarty_vars                 see also NEW_FEATURES.txt (forum
25370)   27.12.2014    - bugfix clear internal _is_file_cache when plugins_dir
was modified   13.12.2014    - improvement optimization of lexer and parser
resulting in a up to 30% higher compiling speed   11.12.2014    - bugfix resolve
parser ambiguity between constant print tag {CONST} and other smarty tags after
change of 09.12.2014   09.12.2014    - bugfix variables $null, $true and $false
did not work after the change of 12.11.2014 (forum 25342)   - bugfix call of
template function by a variable name did not work after latest changes (forum
25342)   23.11.2014    - bugfix a plugin with attached modifier could fail if
the tag was immediately followed by another Smarty tag (since 3.1.21) (forum
25326)   13.11.2014    - improvement move autoload code into Autoloader.php. Use
Composer autoloader when possible   12.11.2014   - new feature added support of
namespaces to template code   08.11.2014 - 10.11.2014   - bugfix subtemplate
called in nocache mode could be called with wrong compile_id when it did change
on one of the calling templates  - improvement add code of template functions
called in nocache mode dynamically to cache file (related to bugfix of
01.11.2014)  - bugfix Debug Console did not include all data from merged
compiled subtemplates   04.11.2014   - new feature $smarty->debugging = true; =>
overwrite existing Debug Console window (old behaviour)
$smarty->debugging = 2; => individual Debug Console window by template name
03.11.2014   - bugfix Debug Console did not show included subtemplates since
3.1.17 (forum 25301)  - bugfix Modifier debug_print_var did not limit recursion
or prevent recursive object display at Debug Console     (ATTENTION: parameter
order has changed to be able to specify maximum recursion)  - bugfix Debug
consol did not include subtemplate information with
$smarty->merge_compiled_includes = true  - improvement The template variables
are no longer displayed as objects on the Debug Console  - improvement
$smarty->createData($parent = null, $name = null) new optional name parameter
for display at Debug Console  - addition of some hooks for future extension of
Debug Console   01.11.2014   - bugfix and enhancement on subtemplate {include}
and template {function} tags.    * Calling a template which has a nocache
section could fail if it was called from a cached and a not cached subtemplate.
* Calling the same subtemplate cached and not cached with the
$smarty->merge_compiled_includes enabled could cause problems    * Many smaller
related changes   30.10.2014   - bugfix access to class constant by object like
{$object::CONST} or variable class name {$class::CONST} did not work (forum
25301)   26.10.2014   - bugfix E_NOTICE message was created during compilation
when ASP tags '<%' or '%>' are in template source text  - bugfix
merge_compiled_includes option failed when caching  enables and same subtemplate
was included cached and not cached
--------------------------------------------------------------------------------
ChangeLog:

* Fri Feb 22 2019 Shawn Iwinski <shawn(a)iwin.ski&gt; - 3.1.33-1
- Update to 3.1.33
- RHBZ #s: 1532492, 1532493, 1532494, 1628739, 1628740, 1628741, 1631095, 1631096,
1631098
- CVEs: CVE-2017-1000480, CVE-2018-13982, CVE-2018-16831
- License LGPLv2+ => LGPLv3
* Sat Feb  2 2019 Fedora Release Engineering <releng(a)fedoraproject.org&gt; - 3.1.21-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org&gt; - 3.1.21-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1631098 - CVE-2018-13982 php-Smarty: Path traversal vulnerability in
Smarty_Security::isTrustedResourceDir() [epel-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1631098
  [ 2 ] Bug #1628740 - CVE-2018-16831 php-Smarty: trusted_dir protection mechanism bypass
[epel-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1628740
  [ 3 ] Bug #1532493 - CVE-2017-1000480 php-Smarty: Code injection when calling fetch() or
display() on unsanitized template names [epel-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1532493
  [ 4 ] Bug #1631096 - CVE-2018-13982 php-Smarty: Path traversal vulnerability in
Smarty_Security::isTrustedResourceDir() [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1631096
  [ 5 ] Bug #1628741 - CVE-2018-16831 php-Smarty: trusted_dir protection mechanism bypass
[fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1628741
  [ 6 ] Bug #1532494 - CVE-2017-1000480 php-Smarty: Code injection when calling fetch() or
display() on unsanitized template names [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1532494
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-d248c5aa39' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------