XOOPS Smarty Extensions 2.0.0 Beta1

XOOPS Smarty Extensions 2.0.0 Beta1

This beta is a security-hardening release. It closes several XSS, CSRF-token
and cache-leak paths across the template plugins, and it makes output escaping
consistent: plugins that print text now return it already HTML-escaped.

It is a major version because that escaping change breaks templates that
add |escape after these plugins. Projects pinned to ^1.x (XOOPS core pins
^1.3) will not receive it until they raise their constraint to ^2.0.

Requires PHP 8.2+. Supports Smarty 4 and Smarty 5.

⚠️ Breaking changes in template output. Read Upgrading before deploying,
and test your themes and module templates.

Upgrading

1. Raise your Composer constraint to "xoops/smartyextensions": "^2.0@beta".

2. Clear compiled templates and the Smarty output cache after updating.

3. Remove |escape after these plugins. They now escape their own output,
   so an extra |escape double-encodes it (&, broken & in query strings):

   • |sanitize_url
   • format_date, relative_time, format_currency, number_format,
     mask_email, datetime_diff (direct output), format_phone_number,
     pretty_print_json
   • xo_get_config, get_session_data (direct output)

   Values captured with assign= stay raw: keep escaping them where you print them.

4. Under $escape_html, print the self-escaping plugins with nofilter.

5. format_currency / number_format: pass a literal £ or no-break space
   instead of £ /   as symbol or separator.

6. linkify now takes plain text. HTML passed in is shown as text instead of
   being rendered. Run it on plain text, before any other HTML formatting.

7. User-dependent assign results are still cached. If you write
   <{is_user_logged_in assign="loggedIn"}><{if $loggedIn}>…, wrap the call and
   every tag that reads the variable in <{nocache}>…<{/nocache}>.

Security

• Smarty 4 output caching: functions and block handlers are now registered
  non-cacheable, as they already were under Smarty 5. A cached page no longer
  replays xo_permission content or a form_open CSRF token to the next visitor.
• URL scheme checks: embed_pdf, form_open (action), form_input (src,
  formaction), render_breadcrumbs, render_pagination and generate_url now
  reject javascript:, data: and other executable schemes, including
  entity-encoded forms such as javascript:. They share one check with
  sanitize_url and the asset queue.
• CSRF token scope: form_open injects the token only when the action is
  relative or matches the XOOPS_URL origin. form_input drops a formaction
  that leaves the site.
• Attribute injection: form_input drops attribute names that are not plain
  names, and on* event handlers.
• highlight_text keeps the custom class literal (no $1 expansion) and limits
  it to [A-Za-z0-9_ -]{1,64}.
• Output escaping: the formatting, config and session plugins listed above
  now HTML-escape their output. Invalid UTF-8 in that output is replaced with U+FFFD.
• mask_email masks by character, not byte, so multibyte addresses are no
  longer cut mid-character.
• File helpers: base64_encode_file, get_file_size and get_mime_type
  reject stream wrappers (ftp://, phar://, php://), UNC paths and //host
  paths before touching the filesystem.

Changed

• render_pagination lists every page up to 100 pages, then switches to a
  window of 2 pages; a caller-supplied window is capped at 20.
• number_format clamps decimals to 0–20.
• xo_get_config and get_session_data print nothing for an array value
  instead of Array.

Maintenance

• Updated CI actions (checkout, setup-php, Codecov, Qodana, SonarQube scan) and
  widened the PHP_CodeSniffer constraint to 3.11 or 4.0.
• Expanded the tutorial and contributor guidance on escaping, $escape_html
  and nocache.

Full changelog: https://github.com/XOOPS/smartyextensions/blob/master/CHANGELOG.md
Compare: v1.3.0...v2.0.0-Beta1