diff --git a/CHANGELOG.md b/CHANGELOG.md index 6bcc55559..eb69f5b6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Registered output filters wouldn't run [#899](https://github.com/smarty-php/smarty/issues/899) - Use of negative numbers in {math} equations [#895](https://github.com/smarty-php/smarty/issues/895) +- Do not auto-html-escape custom function results [#906](https://github.com/smarty-php/smarty/issues/906) - Fix case-sensitive tag names [#907](https://github.com/smarty-php/smarty/issues/907) ### Removed diff --git a/src/Compiler/Template.php b/src/Compiler/Template.php index a782eeddf..2eacc5a34 100644 --- a/src/Compiler/Template.php +++ b/src/Compiler/Template.php @@ -1143,7 +1143,7 @@ private function compileTag2($tag, $args, $parameter) { if ($this->smarty->getFunctionHandler($base_tag)) { if (!isset($this->smarty->security_policy) || $this->smarty->security_policy->isTrustedTag($base_tag, $this)) { return (new \Smarty\Compile\PrintExpressionCompiler())->compile( - [], + ['nofilter'], // functions are never auto-escaped $this, ['value' => $this->compileFunctionCall($base_tag, $args, $parameter)] ); diff --git a/tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php b/tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php index f8ea54d59..f26f0f934 100644 --- a/tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php +++ b/tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php @@ -30,4 +30,35 @@ public function testAutoEscape() $tpl->assign('foo', ''); $this->assertEquals("<a@b.c>", $this->smarty->fetch($tpl)); } + + /** + * test 'escapeHtml' property + * @group issue906 + */ + public function testAutoEscapeDoesNotEscapeFunctionPlugins() + { + $this->smarty->registerPlugin( + \Smarty\Smarty::PLUGIN_FUNCTION, + 'horizontal_rule', + function ($params, $smarty) { return "
"; } + ); + $tpl = $this->smarty->createTemplate('eval:{horizontal_rule}'); + $this->assertEquals("
", $this->smarty->fetch($tpl)); + } + + /** + * test 'escapeHtml' property + * @group issue906 + */ + public function testAutoEscapeDoesNotEscapeBlockPlugins() + { + $this->smarty->registerPlugin( + \Smarty\Smarty::PLUGIN_BLOCK, + 'paragraphify', + function ($params, $content) { return $content == null ? null : "

".$content."

"; } + ); + $tpl = $this->smarty->createTemplate('eval:{paragraphify}hi{/paragraphify}'); + $this->assertEquals("

hi

", $this->smarty->fetch($tpl)); + } + }