4.5.3: Function whitelist via Smarty_Security is being ignored

[dc-ao]

Smarty_Internal_TemplateCompilerBase::compilePHPFunctionCall() checks whether the given function $name is a trusted function via $this->smarty->security_policy->isTrustedPhpFunction($name, $this).

However, in Line 661 $name is checked against a hardcoded set of function names instead of using the security policy, completely ignoring the given security policy whitelist and causing errors.