From: Tim Otten <totten@civicrm.org>
Date: Thu, 23 Feb 2023 22:03:13 +0000 (-0800)
Subject: Smarty - {htxt} blocks should not be evaluated unless needed
X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=c6c1851c6ee8b148a4a81bc784347e70929ff4d1;p=civicrm-core.git

Smarty - {htxt} blocks should not be evaluated unless needed
---

diff --git a/CRM/Core/Smarty.php b/CRM/Core/Smarty.php
index 41a7020575..09991fb275 100644
--- a/CRM/Core/Smarty.php
+++ b/CRM/Core/Smarty.php
@@ -144,6 +144,7 @@ class CRM_Core_Smarty extends Smarty {
       $this->default_modifiers[] = 'escape:"htmlall"';
     }
     $this->load_filter('pre', 'resetExtScope');
+    $this->load_filter('pre', 'htxtFilter');
 
     $this->assign('crmPermissions', new CRM_Core_Smarty_Permissions());
 
diff --git a/CRM/Core/Smarty/plugins/prefilter.htxtFilter.php b/CRM/Core/Smarty/plugins/prefilter.htxtFilter.php
new file mode 100644
index 0000000000..1a2a56a085
--- /dev/null
+++ b/CRM/Core/Smarty/plugins/prefilter.htxtFilter.php
@@ -0,0 +1,36 @@
+<?php
+
+/**
+ * The content of an "{htxt}" block should not be evaluated unless
+ * the active request is relevant. Otherwise, it will try to
+ * evaluate unassigned variables.
+ *
+ * @param string $tpl_source
+ * @param $smarty
+ * @return string
+ */
+function smarty_prefilter_htxtFilter($tpl_source, &$smarty) {
+  if (strpos($tpl_source, '{htxt') === FALSE) {
+    return $tpl_source;
+  }
+
+  $htxts = 0;
+  $_htxts = 0;
+
+  $result = preg_replace_callback_array([
+    '/\{htxt id=([\'\"][^\'\"]+[\'\"])/' => function ($m) use (&$htxts) {
+      $htxts++;
+      return sprintf('{if $id == %s}%s', $m[1], $m[0]);
+    },
+    ';\{/htxt\};' => function($m) use (&$_htxts) {
+      $_htxts++;
+      return '{/htxt}{/if}';
+    },
+  ], $tpl_source);
+
+  if ($htxts !== $_htxts) {
+    throw new \RuntimeException(sprintf('Invalid {htxt} tag. Wrapped %d opening-tags and %d closing-tags.', $htxts, $_htxts));
+  }
+
+  return $result;
+}