Smarty no longer accepts TRUE, FALSE, NULL

[iOvergaard]

Since around version 3.1.23 it seems (this commit) Smarty will no longer accept TRUE, FALSE and NULL as language structures (uppercase), but will instead try and access them like constants, which in turn could be disallowed by the security settings.

sysplugins/smarty_security.php:

public function isTrustedConstant($const, $compiler)
{
    if (in_array($const, array('true', 'false', 'null'))) {
        return true;
    }
    [...]
}

The in_array function in PHP is case sensitive, while PHP in fact allows uppercase structures (even though they are inherently slower), using them in a Smarty template will not work.

I was wondering if this is on purpose to try and enforce a better code style?

[iOvergaard]

I should add that the obvious fix is to validate the constants as lowercase in this particular case, but I do not know if this opens up for invulnerabilities?

if (in_array(strtolower($const), array('true', 'false', 'null'))) {
    return true;
}

[uwetews]

This bug is now fixed in the master branch