smarty3 (3.1.21-1ubuntu1+esm1) xenial-security; urgency=medium

  * SECURITY UPDATE: execution of restricted php methods
    - debian/patches/CVE-2021-21408.patch: Prevent evasion of the
      static_classes security policy in 
      lexer/smarty_internal_templateparser.y and
      libs/sysplugins/smarty_internal_templateparser.php.
    - CVE-2021-21408
  * SECURITY UPDATE: sandbox escape by accessing public object
    - debian/patches/CVE-2021-26119.patch: Prevent access to
      $smarty.template_object in sandbox mode in
      libs/sysplugins/
      smarty_internal_compile_private_special_variable.php.
    - CVE-2021-26119
  * SECURITY UPDATE: code injection through function name
    - debian/patches/CVE-2021-26120.patch: perform validation over
      the function name supplied in
      libs/sysplugins/smarty_internal_compile_function.php.
    - CVE-2021-26120
  * SECURITY UPDATE: code injection through math function
    - debian/patches/CVE-2021-29454.patch: verify if the input to
      the math function is a mathematical expression in
      libs/plugins/function.math.php.
    - CVE-2021-29454

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Thu, 24 Mar 2022 12:41:19 +0100

smarty3 (3.1.21-1ubuntu1) xenial; urgency=medium

  * Update to PHP7.0 dependencies (LP: #1565154).

 -- Nishanth Aravamudan <nish.aravamudan@canonical.com>  Fri, 01 Apr 2016 17:10:04 -0700

smarty3 (3.1.21-1) unstable; urgency=medium

  * New upstream release. (Closes: #765920).
  * debian/smarty3-lexer:
    + Add 4 files from smarty3 SVN that are used to generate some PHP
      files in the upstream tarball. See README.lexer for details.
      (Closes: #636148).
  * debian/copyright:
    + Add copyright information for debian/smarty3-lexer/*.
    + Fix upstream license (LGPL-3 -> LGPL-3+) after reading the upstream-
      shipped COPYING.lib file more thoroughly.
    + Relicense debian/* under same license as upstream sources (LGPL-3+).
  * debian/control:
    + Bump Standards: to 3.9.6. No changes needed.

 -- Mike Gabriel <sunweaver@debian.org>  Sun, 19 Oct 2014 23:45:18 +0200

smarty3 (3.1.19-1) unstable; urgency=medium

  * New upstream release.
    + Obtain upstream sources as zip files from upstream. Stop checking out
      SVN tags. This change drops three embedded PHP libraries and files with
      problematic PHP licenses. (Closes: #752614).
  * debian/control:
    + Alioth-canonicalize Vcs-Git field.
    + Bump Standards: to 3.9.5. No changes needed.
  * lintian:
    + Drop unused override: embedded-php-library.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 04 Aug 2014 21:32:20 +0200

smarty3 (3.1.13-1) unstable; urgency=low

  * New upstream release.
  * /debian/control:
    + Use my DD address in Maintainer: field.
    + Bump Standards: to 3.9.4. No changes needed.
  * /debian/patches:
    + Drop patch: 001_escape-smarty-exception-messages.patch, included in new
      upstream release.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 06 May 2013 10:19:14 +0200

smarty3 (3.1.10-2) unstable; urgency=low

  * Fix CVE-2012-4437: Add patch 001_escape-smarty-exception-messages.patch.
    Closes: #688153.

 -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Sat, 22 Sep 2012 21:32:58 +0200

smarty3 (3.1.10-1) unstable; urgency=low

  * New upstream release. Closes: #678095.

 -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Tue, 19 Jun 2012 16:41:06 +0200

smarty3 (3.1.8-2) unstable; urgency=low

  * Package smarty3 provides smarty (closes: #657536).
  * Make /debian/copyright machine parsable, explicitly names files that
    have dissenting licenses, license /debian folder under GPLv2+.

 -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Thu, 17 May 2012 00:32:29 +0200

smarty3 (3.1.8-1) experimental; urgency=low

  * New upstream release (rev. 4611).
  * New package maintainer (closes: #668200).
  * Add watch file (closes: #657385).
  * Add Vcs-* lines to control file.
  * Add README.source that explains how we obtain code from
    upstream SVN. Make sure all upstream source files are
    shipped with the Debian source package (closes: #636148).

 -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Thu, 10 May 2012 10:44:55 +0200

smarty3 (3.1.0-1) experimental; urgency=low

  * New upstream release (rev. 4284)
  * Used the code source from subversion (Closes: #636148)
  * debian/copyright:
    + added LexerGenerator copyright
    + added ParserGenerator copyright
  * Fixed security holes:
    + multiple unspecified vulnerabilities (CVE-2009-5052, CVE-2009-5053, 
      CVE-2010-4722, CVE-2010-4724, CVE-2010-4726)
    + not consider the umask value when setting the permissions of files
      (CVE-2009-5054)
    + not prevent access to the dynamic and private object members of an 
      assigned object (CVE-2010-4723)
    + not properly handle an on value of the asp_tags option in the php.ini file
      (CVE-2010-4725)
    + not properly handle the <?php and ?> tags (CVE-2010-4727)

 -- Thierry Randrianiriana <thierry@debian.org>  Sat, 17 Sep 2011 21:22:11 +0300

smarty3 (3.0.8-1) unstable; urgency=low

  * New upstream release (Closes: #631619)
  * Bumped Standards-Version to 3.9.2
  * Updated licence to LGPL-3

 -- Thierry Randrianiriana <thierry@debian.org>  Wed, 20 Jul 2011 11:29:24 +0300

smarty3 (3.0~rc1-2) unstable; urgency=low

  * Bumped Standards-Version to 3.9.1
  * Removed debian/watch

 -- Thierry Randrianiriana <thierry@debian.org>  Tue, 21 Sep 2010 14:45:44 +0300

smarty3 (3.0~rc1-1) unstable; urgency=low

  * Initial release (Closes: #580754)

 -- Thierry Randrianiriana <thierry@debian.org>  Sat, 08 May 2010 14:36:04 +0300
