{"update": {"autokarma": true, "autotime": true, "stable_karma": 3, "stable_days": 7, "unstable_karma": -3, "require_bugs": false, "require_testcases": false, "display_name": "", "notes": "## [3.1.47] - 2022-09-14\n\n### Security\n- Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks [#454](https://github.com/smarty-php/smarty/issues/454)\n\n### Fixed\n- Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794)\n- Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-php/smarty/issues/395)\n\n## [3.1.46] - 2022-08-01\n\n### Fixed\n- Fixed problems with smarty_mb_str_replace [#549](https://github.com/smarty-php/smarty/issues/549)\n- Fixed second parameter of unescape modifier not working [#777](https://github.com/smarty-php/smarty/issues/777)\n\n## [3.1.45] - 2022-05-17\n\n### Security\n- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221\n\n### Fixed\n- Math equation `max(x, y)` didn't work anymore [#721](https://github.com/smarty-php/smarty/issues/721)\n\n## [3.1.44] - 2022-01-18\n\n### Fixed\n- Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-php/smarty/issues/702)\n\n## [3.1.43] - 2022-01-10\n\n### Security\n- Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408\n\n## [3.1.42] - 2022-01-10\n\n### Security\n- Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This addresses CVE-2021-29454\n\n## [3.1.41] - 2022-01-09\n\n### Security\n- Rewrote the mailto function to not use `eval` when encoding with javascript\n\n## [3.1.40] - 2021-10-13\n\n### Changed\n- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649\n\n### Security\n- More advanced javascript escaping to handle https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks to m-haritonov\n\n## [3.1.39] - 2021-02-17\n\n### Security\n- Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.\n- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120.\n\n## [3.1.38] - 2021-01-08\n\n### Fixed\n- Smarty::SMARTY_VERSION wasn't updated https://github.com/smarty-php/smarty/issues/628\n\n## [3.1.37] - 2021-01-07\n\n### Changed\n- Changed error handlers and handling of undefined constants for php8-compatibility (set $errcontext argument optional) https://github.com/smarty-php/smarty/issues/605\n- Changed expected error levels in unit tests for php8-compatibility\n- Travis unit tests now run for all php versions >= 5.3, including php8\n- Travis runs on Xenial where possible\n\n### Fixed\n- PHP5.3 compatibility fixes\n- Brought lexer source functionally up-to-date with compiled version\n\n## [3.1.36] - 2020-04-14\n\n### Fixed\n - Smarty::SMARTY_VERSION wasn't updated in v3.1.35 https://github.com/smarty-php/smarty/issues/584\n\n## [3.1.35] - 2020-04-14\n - remove whitespaces after comments https://github.com/smarty-php/smarty/issues/447\n - fix foreachelse on arrayiterators https://github.com/smarty-php/smarty/issues/506\n - fix files contained in git export archive for package maintainers https://github.com/smarty-php/smarty/issues/325\n - throw SmartyException when setting caching attributes for cacheable plugin https://github.com/smarty-php/smarty/issues/457\n - fix errors that occured where isset was replaced with null check such as https://github.com/smarty-php/smarty/issues/453\n - unit tests are now in the repository\n\n## 3.1.34 release - 05.11.2019\n13.01.2020\n - fix typo in exception message (JercSi)\n - fix typehint warning with callable (bets4breakfast)\n - add travis badge and compatability info to readme (matks)\n - fix stdClass cast when compiling foreach (carpii)\n - fix wrong set/get methods for memcached (IT-Experte)\n - fix pborm assigning value to object variables in smarty_internal_compile_assign (Hunman)\n - exclude error_reporting.ini from git export (glensc)\n\n## 3.1.34-dev-6 -\n30.10.2018\n - bugfix a nested subblock in an inheritance child template was not replace by\n   outer level block with same name in same child template https://github.com/smarty-php/smarty/issues/500\n\n29.10.2018\n - bugfix Smarty::$php_handling == PHP_PASSTHRU (default) did eat the \"\\n\" (newline) character if it did directly followed\n   a PHP tag like \"?>\" or other https://github.com/smarty-php/smarty/issues/501\n\n14.10.2018\n - bugfix autoloader exit shortcut https://github.com/smarty-php/smarty/issues/467\n\n11.10.2018\n - bugfix {insert} not works when caching is enabled and included template is present\n   https://github.com/smarty-php/smarty/issues/496\n - bugfix in date-format modifier; NULL at date string or default_date did not produce correct output\n   https://github.com/smarty-php/smarty/pull/458\n\n09.10.2018\n - bugfix fix of 26.8.2017 https://github.com/smarty-php/smarty/issues/327\n   modifier is applied to sum expression https://github.com/smarty-php/smarty/issues/491\n - bugfix indexed arrays could not be defined \"array(...)\"\"\n\n18.09.2018\n  - bugfix large plain text template sections without a Smarty tag > 700kB could\n    could fail in version 3.1.32 and 3.1.33 because PHP preg_match() restrictions\n    https://github.com/smarty-php/smarty/issues/488", "type": "security", "status": "stable", "request": null, "severity": "high", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2022-10-15 03:15:19", "date_modified": null, "date_approved": null, "date_testing": "2022-10-15 22:20:36", "date_stable": "2022-10-23 09:02:48", "alias": "FEDORA-2022-52154efd61", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2022-10-23 09:02:48", "meets_testing_requirements": true, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2022-52154efd61", "title": "php-Smarty-3.1.47-1.fc36", "version_hash": "87797e9c5c1c183102db3c7c12b6a27ca53070b5", "release": {"name": "F36", "long_name": "Fedora 36", "version": "36", "id_prefix": "FEDORA", "branch": "f36", "dist_tag": "f36", "stable_tag": "f36-updates", "testing_tag": "f36-updates-testing", "candidate_tag": "f36-updates-candidate", "pending_signing_tag": "f36-signing-pending", "pending_testing_tag": "f36-updates-testing-pending", "pending_stable_tag": "f36-updates-pending", "override_tag": "f36-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": "2023-05-16", "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "siwinski", "email": "shawn@iwin.ski", "id": 130, "avatar": "https://seccdn.libravatar.org/avatar/d42670db55f2a02bd45bb03a22919c9013b73f6ae62d6c1a9a2eab3afefa3334?s=24&d=retro", "openid": "siwinski.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by siwinski. ", "timestamp": "2022-10-15 03:15:19", "update_id": 454704, "user_id": 91, "id": 2751901, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2022-10-15 03:15:20", "update_id": 454704, "user_id": 91, "id": 2751902, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2022-10-15 22:21:48", "update_id": 454704, "user_id": 91, "id": 2753458, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2022-10-22 22:21:59", "update_id": 454704, "user_id": 91, "id": 2760032, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2022-10-23 09:03:57", "update_id": 454704, "user_id": 91, "id": 2760347, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "php-Smarty-3.1.47-1.fc36", "signed": true, "release_id": 56, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 2043595, "title": "CVE-2021-21408 php-Smarty: template authors could run restricted static php methods [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2043596, "title": "CVE-2021-21408 php-Smarty: template authors could run restricted static php methods [epel-7]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2044970, "title": "CVE-2021-29454 php-Smarty: template authors could run arbitrary PHP code by crafting a malicious math string [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2044971, "title": "CVE-2021-29454 php-Smarty: template authors could run arbitrary PHP code by crafting a malicious math string [epel-7]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2088250, "title": "CVE-2022-29221 php-Smarty: php injection via malicious block name or include file name [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2088251, "title": "CVE-2022-29221 php-Smarty: php injection via malicious block name or include file name [epel-7]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2126855, "title": "php-Smarty: javascript injection in mailto function [epel-7]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2126856, "title": "php-Smarty: javascript injection in mailto function [fedora-all]", "security": true, "parent": false, "feedback": []}], "updateid": "FEDORA-2022-52154efd61", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}