search

verzunov / live-nature.journal.kg

0 stars 0 forks source link

Bump smarty/smarty from 3.1.33 to 3.1.47 in /lib/pkp #11

Open dependabot[bot] opened 2 years ago

dependabot[bot] commented 2 years ago

Bumps smarty/smarty from 3.1.33 to 3.1.47.

Release notes

Sourced from smarty/smarty's releases.

v3.1.47

If you use the {mailto} plugin in your templates, please check if you are escaping the address value explicitly like this {mailto address=$htmladdress|escape}. This could cause problems through double escaping.

Security

  • Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks #454

Fixed

  • Fixed use of rand() without a parameter in math function #794
  • Fixed unselected year/month/day not working in html_select_date #395

v3.1.46

What's Changed

Full Changelog: https://github.com/smarty-php/smarty/compare/v3.1.45...v3.1.46

v3.1.45

Security

  • Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221

Fixed

  • Math equation max(x, y) didn't work anymore #721

v3.1.44

What's Changed

  • Fixes illegal characters warning in math

Full Changelog: https://github.com/smarty-php/smarty/compare/v3.1.43...v3.1.44

v3.1.43

Prevent evasion of the static_classes security policy. This addresses CVE-2021-21408

Full Changelog: https://github.com/smarty-php/smarty/compare/v3.1.42...v3.1.43

v3.1.42

Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This addresses CVE-2021-29454

Full Changelog: https://github.com/smarty-php/smarty/compare/v3.1.41...v3.1.42

v3.1.41

Rewrote the mailto function to not use eval when encoding with javascript

Release 3.1.40

Improved javascript escaping. And Smarty now logs a warning if an unsupported escape type is used to stop you from accidentally using $var|escape:quote and not actually quoting anything.

Release 3.1.39

Security release, handling two sandbox security issues.

... (truncated)

Changelog

Sourced from smarty/smarty's changelog.

[3.1.47] - 2022-09-14

Security

  • Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks #454

Fixed

  • Fixed use of rand() without a parameter in math function #794
  • Fixed unselected year/month/day not working in html_select_date #395

[3.1.46] - 2022-08-01

Fixed

  • Fixed problems with smarty_mb_str_replace #549
  • Fixed second parameter of unescape modifier not working #777

[3.1.45] - 2022-05-17

Security

  • Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221

Fixed

  • Math equation max(x, y) didn't work anymore #721

[3.1.44] - 2022-01-18

Fixed

  • Fixed illegal characters bug in math function security check #702

[3.1.43] - 2022-01-10

Security

  • Prevent evasion of the static_classes security policy. This addresses CVE-2021-21408

[3.1.42] - 2022-01-10

Security

  • Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This addresses CVE-2021-29454

[3.1.41] - 2022-01-09

Security

  • Rewrote the mailto function to not use eval when encoding with javascript

[3.1.40] - 2021-10-13

Changed

  • modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used smarty-php/smarty#649

Security

... (truncated)

Commits
  • a09364f Merge branch 'release/3.1.47' into support/3.1
  • c51719b version bump
  • 3f426c4 Test for existence of htmlspecialchars flag (PHP < 5.4)
  • 4d316d3 Smarty5 syntax fix
  • 80e4549 Smarty5 syntax fix
  • 08afb51 Fixed unselected year/month/day not working in html_select_date
  • f1f7ee6 Applied appropriate javascript and html escaping in mailto plugin to counter ...
  • 25051e6 Bugfix/rand without param v3 (#796)
  • b3ade90 Merge branch 'release/3.1.46' into support/3.1
  • 4bcca1a version bump
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/verzunov/live-nature.journal.kg/network/alerts).