Index: branches/version-2_13-dev/data/module/Smarty/ChangeLog
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/ChangeLog	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/ChangeLog	(revision 23000)
@@ -1,2 +1,11 @@
+2012-09-24  Uwe Tews
+
+    * Fixed  escape Smarty error messages to avoid possible script execution
+
+    
+2010-04-17  Uwe Tews
+
+    * Fixed security hole in {math} plugin
+    
 2007-09-27  TAKAGI Masahiro  <matakagi@gmail.com>
 
@@ -5251,5 +5260,5 @@
     * libs/Smarty.class.php
       libs/Smarty_Compiler.class.php:
-      added CVS $Id: ChangeLog 2746 2007-09-28 01:32:05Z changelog $
+      added CVS $Id: ChangeLog 4660 2012-09-24 20:05:15Z uwe.tews@googlemail.com $
 
 2003-03-31  Messju Mohr  <messju@lammfellpuschen.de>
Index: branches/version-2_13-dev/data/module/Smarty/libs/Smarty.class.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/Smarty.class.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/Smarty.class.php	(revision 23000)
@@ -21,5 +21,5 @@
  * For questions, help, comments, discussion, etc., please join the
  * Smarty mailing list. Send a blank e-mail to
- * smarty-discussion-subscribe@googlegroups.com 
+ * smarty-discussion-subscribe@googlegroups.com
  *
  * @link http://www.smarty.net/
@@ -28,8 +28,8 @@
  * @author Andrei Zmievski <andrei@php.net>
  * @package Smarty
- * @version 2.6.26
+ * @version 2.6.27
  */
 
-/* $Id: Smarty.class.php 3163 2009-06-17 14:39:24Z monte.ohrt $ */
+/* $Id: Smarty.class.php 4660 2012-09-24 20:05:15Z uwe.tews@googlemail.com $ */
 
 /**
@@ -466,5 +466,5 @@
      * @var string
      */
-    var $_version              = '2.6.26';
+    var $_version              = '2.6.27';
 
     /**
@@ -1059,5 +1059,5 @@
             // var non-existant, return valid reference
             $_tmp = null;
-            return $_tmp;   
+            return $_tmp;
         }
     }
@@ -1091,5 +1091,6 @@
     function trigger_error($error_msg, $error_type = E_USER_WARNING)
     {
-        trigger_error("Smarty error: $error_msg", $error_type);
+        $msg = htmlentities($error_msg);
+        trigger_error("Smarty error: $msg", $error_type);
     }
 
@@ -1118,5 +1119,5 @@
     {
         static $_cache_info = array();
-        
+
         $_smarty_old_error_level = $this->debugging ? error_reporting() : error_reporting(isset($this->error_reporting)
                ? $this->error_reporting : error_reporting() & ~E_NOTICE);
@@ -1934,8 +1935,8 @@
         return eval($code);
     }
-    
+
     /**
      * Extracts the filter name from the given callback
-     * 
+     *
      * @param callback $function
      * @return string
@@ -1952,5 +1953,5 @@
 		}
 	}
-  
+
     /**#@-*/
 
Index: branches/version-2_13-dev/data/module/Smarty/libs/Config_File.class.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/Config_File.class.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/Config_File.class.php	(revision 23000)
@@ -23,5 +23,5 @@
  *
  * @link http://www.smarty.net/
- * @version 2.6.26
+ * @version 2.6.25-dev
  * @copyright Copyright: 2001-2005 New Digital Group, Inc.
  * @author Andrei Zmievski <andrei@php.net>
Index: branches/version-2_13-dev/data/module/Smarty/libs/internals/core.write_file.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/internals/core.write_file.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/internals/core.write_file.php	(revision 23000)
Index: branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.math.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.math.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.math.php	(revision 23000)
@@ -38,5 +38,5 @@
 
     // match all vars in equation, make sure all are passed
-    preg_match_all("!(?:0x[a-fA-F0-9]+)|([a-zA-Z][a-zA-Z0-9_]+)!",$equation, $match);
+    preg_match_all("!(?:0x[a-fA-F0-9]+)|([a-zA-Z][a-zA-Z0-9_]*)!",$equation, $match);
     $allowed_funcs = array('int','abs','ceil','cos','exp','floor','log','log10',
                            'max','min','pi','pow','rand','round','sin','sqrt','srand','tan');
Index: branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.fetch.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.fetch.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.fetch.php	(revision 23000)
@@ -182,10 +182,10 @@
                     }
                     fclose($fp);
-                    $csplit = split("\r\n\r\n",$content,2);
+                    $csplit = preg_split("!\r\n\r\n!",$content,2);
 
                     $content = $csplit[1];
 
                     if(!empty($params['assign_headers'])) {
-                        $smarty->assign($params['assign_headers'],split("\r\n",$csplit[0]));
+                        $smarty->assign($params['assign_headers'],preg_split("!\r\n!",$csplit[0]));
                     }
                 }
Index: branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.cycle.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.cycle.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/plugins/function.cycle.php	(revision 23000)
@@ -64,5 +64,9 @@
     }
 
-    $cycle_vars[$name]['delimiter'] = (isset($params['delimiter'])) ? $params['delimiter'] : ',';
+    if (isset($params['delimiter'])) {
+        $cycle_vars[$name]['delimiter'] = $params['delimiter'];
+    } elseif (!isset($cycle_vars[$name]['delimiter'])) {
+        $cycle_vars[$name]['delimiter'] = ',';       
+    }
     
     if(is_array($cycle_vars[$name]['values'])) {
Index: branches/version-2_13-dev/data/module/Smarty/libs/Smarty_Compiler.class.php
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/Smarty_Compiler.class.php	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/libs/Smarty_Compiler.class.php	(revision 23000)
@@ -22,5 +22,5 @@
  * @author Monte Ohrt <monte at ohrt dot com>
  * @author Andrei Zmievski <andrei@php.net>
- * @version 2.6.26
+ * @version 2.6.25-dev
  * @copyright 2001-2005 New Digital Group, Inc.
  * @package Smarty
Index: branches/version-2_13-dev/data/module/Smarty/libs/debug.tpl
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/libs/debug.tpl	(revision 20473)
+++ branches/version-2_13-dev/data/module/Smarty/libs/debug.tpl	(revision 23000)
@@ -10,4 +10,68 @@
 <style type="text/css">
 /* <![CDATA[ */
+body, h1, h2, td, th, p {
+    font-family: sans-serif;
+    font-weight: normal;
+    font-size: 0.9em;
+    margin: 1px;
+    padding: 0;
+}
+
+h1 {
+    margin: 0;
+    text-align: left;
+    padding: 2px;
+    background-color: #f0c040;
+    color:  black;
+    font-weight: bold;
+    font-size: 1.2em;
+ }
+
+h2 {
+    background-color: #9B410E;
+    color: white;
+    text-align: left;
+    font-weight: bold;
+    padding: 2px;
+    border-top: 1px solid black;
+}
+
+body {
+    background: black; 
+}
+
+p, table, div {
+    background: #f0ead8;
+} 
+
+p {
+    margin: 0;
+    font-style: italic;
+    text-align: center;
+}
+
+table {
+    width: 100%;
+}
+
+th, td {
+    font-family: monospace;
+    vertical-align: top;
+    text-align: left;
+    width: 50%;
+}
+
+td {
+    color: green;
+}
+
+.odd {
+    background-color: #eeeeee;
+}
+
+.even {
+    background-color: #fafafa;
+}
+
 .exectime {
     font-size: 0.8em;
@@ -37,5 +101,5 @@
     <font color={if $_debug_tpls[templates].type eq "template"}brown{elseif $_debug_tpls[templates].type eq "insert"}black{else}green{/if}>
         {$_debug_tpls[templates].filename|escape:html}</font>
-    {if isset($_debug_tpls[templates].exec_time|smarty:nodefaults)}
+    {if isset($_debug_tpls[templates].exec_time)}
         <span class="exectime">
         ({$_debug_tpls[templates].exec_time|string_format:"%.5f"})
@@ -75,5 +139,5 @@
 </html>
 {/capture}
-{if isset($_smarty_debug_output|smarty:nodefaults) and $_smarty_debug_output eq "html"}
+{if isset($_smarty_debug_output) and $_smarty_debug_output eq "html"}
     {$debug_output}
 {else}
Index: branches/version-2_13-dev/data/module/Smarty/NEWS
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/NEWS	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/NEWS	(revision 23000)
@@ -1,4 +1,2 @@
-Version 2.6.26 (June 18th, 2009)
--------------------------------
 - revert super global access changes, and instead rely on
   USE_SUPER_GLOBALS for security
Index: branches/version-2_13-dev/data/module/Smarty/README
===================================================================
--- branches/version-2_13-dev/data/module/Smarty/README	(revision 20119)
+++ branches/version-2_13-dev/data/module/Smarty/README	(revision 23000)
@@ -4,5 +4,5 @@
     Smarty - the PHP compiling template engine
 
-VERSION: 2.6.26
+VERSION: 2.6.27
 
 AUTHORS: