Missed part of commit e751655 in the merge.

smarty-php · Aug 7, 2023 · 515c14b · 515c14b
1 parent 077df8a
commit 515c14b
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/src/Compile/Modifier/EscapeModifierCompiler.php b/src/Compile/Modifier/EscapeModifierCompiler.php
@@ -45,7 +45,9 @@ public function compile($params, \Smarty\Compiler\Template $compiler) {
 					// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
 					return 'strtr((string)' .
 						$params[ 0 ] .
-						', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+						', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", 
+						"\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
+						"`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
 			}
 		} catch (Exception $e) {
 			// pass through to regular plugin fallback

diff --git a/src/Extension/DefaultExtension.php b/src/Extension/DefaultExtension.php
@@ -449,7 +449,9 @@ public function smarty_modifier_escape($string, $esc_type = 'html', $char_set =
 						// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
 						'<!--' => '<\!--',
 						'<s'   => '<\s',
-						'<S'   => '<\S'
+						'<S'   => '<\S',
+						"`" => "\\\\`",
+						"\${" => "\\\\\\$\\{"
 					)
 				);
 			case 'mail':