mirror of
https://github.com/twigphp/Twig.git
synced 2026-09-13 10:56:38 +00:00
changed autoescape first argument from on/off to the standard true/false
This commit is contained in:
@@ -7,6 +7,7 @@ Backward incompatibilities:
|
||||
* the constant filter has been converted to a function: {{ some_date|date('DATE_W3C'|constant) }} -> {{ some_date|date(constant('DATE_W3C')) }}
|
||||
* the cycle filter has been converted to a function: {{ ['odd', 'even']|cycle(i) }} -> {{ cycle(['odd', 'even'], i) }}
|
||||
* the for tag does not support "joined by" anymore
|
||||
* the autoescape first argument is now true/false (instead of on/off)
|
||||
|
||||
Changes:
|
||||
|
||||
|
||||
+2
-2
@@ -341,7 +341,7 @@ You can also change the escaping mode locally by using the ``autoescape`` tag:
|
||||
|
||||
.. code-block:: jinja
|
||||
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{% var %}
|
||||
{% var|raw %} {# var won't be escaped #}
|
||||
{% var|escape %} {# var won't be doubled-escaped #}
|
||||
@@ -401,7 +401,7 @@ Twig 0.9.9 and above):
|
||||
|
||||
.. code-block:: jinja
|
||||
|
||||
{% autoescape js on %}
|
||||
{% autoescape true js %}
|
||||
{{ var|escape('html') }} {# will be escaped for html and javascript #}
|
||||
{{ var }} {# will be escaped for javascript #}
|
||||
{{ var|escape('js') }} {# won't be double-escaped #}
|
||||
|
||||
+5
-5
@@ -427,15 +427,15 @@ template to be escaped or not by using the ``autoescape`` tag:
|
||||
|
||||
.. code-block:: jinja
|
||||
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
Everything will be automatically escaped in this block
|
||||
{% endautoescape %}
|
||||
|
||||
{% autoescape off %}
|
||||
{% autoescape false %}
|
||||
Everything will be outputed as is in this block
|
||||
{% endautoescape %}
|
||||
|
||||
{% autoescape on js %}
|
||||
{% autoescape true js %}
|
||||
Everything will be automatically escaped in this block
|
||||
using the js escaping strategy
|
||||
{% endautoescape %}
|
||||
@@ -1262,9 +1262,9 @@ the last filter applied to it.
|
||||
|
||||
.. code-block:: jinja
|
||||
|
||||
{% autoescape on }
|
||||
{% autoescape true }
|
||||
{{ var|raw }} {# var won't be escaped #}
|
||||
{% autoescape off %}
|
||||
{% endautoescape %}
|
||||
|
||||
``merge`` (new in Twig 0.9.10)
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
@@ -21,14 +21,14 @@ class Twig_TokenParser_AutoEscape extends Twig_TokenParser
|
||||
{
|
||||
$lineno = $token->getLine();
|
||||
$value = $this->parser->getStream()->expect(Twig_Token::NAME_TYPE)->getValue();
|
||||
if (!in_array($value, array('on', 'off'))) {
|
||||
throw new Twig_Error_Syntax("Autoescape value must be 'on' or 'off'", $lineno);
|
||||
if (!in_array($value, array('true', 'false'))) {
|
||||
throw new Twig_Error_Syntax("Autoescape value must be 'true' or 'false'", $lineno);
|
||||
}
|
||||
$value = 'on' === $value ? 'html' : false;
|
||||
$value = 'true' === $value ? 'html' : false;
|
||||
|
||||
if ($this->parser->getStream()->test(Twig_Token::NAME_TYPE)) {
|
||||
if (false === $value) {
|
||||
throw new Twig_Error_Syntax(sprintf('Unexpected escaping strategy as you set autoescaping to off.', $lineno), -1);
|
||||
throw new Twig_Error_Syntax(sprintf('Unexpected escaping strategy as you set autoescaping to false.', $lineno), -1);
|
||||
}
|
||||
|
||||
$value = $this->parser->getStream()->next()->getValue();
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
--TEST--
|
||||
"autoescape" tag applies escaping on its children
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var }}<br />
|
||||
{% endautoescape %}
|
||||
{% autoescape off %}
|
||||
{% autoescape false %}
|
||||
{{ var }}<br />
|
||||
{% endautoescape %}
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var }}<br />
|
||||
{% endautoescape %}
|
||||
{% autoescape off %}
|
||||
{% autoescape false %}
|
||||
{{ var }}<br />
|
||||
{% endautoescape %}
|
||||
--DATA--
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag applies escaping on embedded blocks
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{% block foo %}
|
||||
{{ var }}
|
||||
{% endblock %}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag does not double-escape
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var|escape }}
|
||||
{% endautoescape %}
|
||||
--DATA--
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
"autoescape" tag applies escaping after calling functions
|
||||
--TEMPLATE--
|
||||
|
||||
autoescape off
|
||||
{% autoescape off %}
|
||||
autoescape false
|
||||
{% autoescape false %}
|
||||
|
||||
safe_br
|
||||
{{ safe_br() }}
|
||||
@@ -13,8 +13,8 @@ unsafe_br
|
||||
|
||||
{% endautoescape %}
|
||||
|
||||
autoescape on
|
||||
{% autoescape on %}
|
||||
autoescape true
|
||||
{% autoescape true %}
|
||||
|
||||
safe_br
|
||||
{{ safe_br() }}
|
||||
@@ -36,8 +36,8 @@ unsafe_br()|escape
|
||||
|
||||
{% endautoescape %}
|
||||
|
||||
autoescape on js
|
||||
{% autoescape on js %}
|
||||
autoescape true js
|
||||
{% autoescape true js %}
|
||||
|
||||
safe_br
|
||||
{{ safe_br() }}
|
||||
@@ -47,7 +47,7 @@ safe_br
|
||||
return array()
|
||||
--EXPECT--
|
||||
|
||||
autoescape off
|
||||
autoescape false
|
||||
|
||||
safe_br
|
||||
<br />
|
||||
@@ -56,7 +56,7 @@ unsafe_br
|
||||
<br />
|
||||
|
||||
|
||||
autoescape on
|
||||
autoescape true
|
||||
|
||||
safe_br
|
||||
<br />
|
||||
@@ -77,7 +77,7 @@ unsafe_br()|escape
|
||||
<br />
|
||||
|
||||
|
||||
autoescape on js
|
||||
autoescape true js
|
||||
|
||||
safe_br
|
||||
\x3cbr \x2f\x3e
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag does not apply escaping on literals
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
|
||||
1. Simple literal
|
||||
{{ "<br />" }}
|
||||
|
||||
@@ -2,11 +2,11 @@
|
||||
"autoescape" tags can be nested at will
|
||||
--TEMPLATE--
|
||||
{{ var }}
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var }}
|
||||
{% autoescape off %}
|
||||
{% autoescape false %}
|
||||
{{ var }}
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var }}
|
||||
{% endautoescape %}
|
||||
{{ var }}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag applies escaping to object method calls
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ user.name }}
|
||||
{{ user.name|lower }}
|
||||
{{ user }}
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
--TEST--
|
||||
"autoescape" tag accepts an escaping strategy
|
||||
--TEMPLATE--
|
||||
{% autoescape on js %}{{ var }}{% endautoescape %}
|
||||
{% autoescape true js %}{{ var }}{% endautoescape %}
|
||||
|
||||
{% autoescape on html %}{{ var }}{% endautoescape %}
|
||||
{% autoescape true html %}{{ var }}{% endautoescape %}
|
||||
--DATA--
|
||||
return array('var' => '<br />"')
|
||||
--EXPECT--
|
||||
|
||||
@@ -2,39 +2,39 @@
|
||||
escape types
|
||||
--TEMPLATE--
|
||||
|
||||
1. autoescape on |escape('js')
|
||||
1. autoescape true |escape('js')
|
||||
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
<a onclick="alert("{{ msg|escape('js') }}")"></a>
|
||||
{% endautoescape %}
|
||||
|
||||
2. autoescape on html |escape('js')
|
||||
2. autoescape true html |escape('js')
|
||||
|
||||
{% autoescape on html %}
|
||||
{% autoescape true html %}
|
||||
<a onclick="alert("{{ msg|escape('js') }}")"></a>
|
||||
{% endautoescape %}
|
||||
|
||||
3. autoescape on js |escape('js')
|
||||
3. autoescape true js |escape('js')
|
||||
|
||||
{% autoescape on js %}
|
||||
{% autoescape true js %}
|
||||
<a onclick="alert("{{ msg|escape('js') }}")"></a>
|
||||
{% endautoescape %}
|
||||
|
||||
4. no escape
|
||||
|
||||
{% autoescape off %}
|
||||
{% autoescape false %}
|
||||
<a onclick="alert("{{ msg }}")"></a>
|
||||
{% endautoescape %}
|
||||
|
||||
5. |escape('js')|escape('html')
|
||||
|
||||
{% autoescape off %}
|
||||
{% autoescape false %}
|
||||
<a onclick="alert("{{ msg|escape('js')|escape('html') }}")"></a>
|
||||
{% endautoescape %}
|
||||
|
||||
6. autoescape on html |escape('js')|escape('html')
|
||||
6. autoescape true html |escape('js')|escape('html')
|
||||
|
||||
{% autoescape on html %}
|
||||
{% autoescape true html %}
|
||||
<a onclick="alert("{{ msg|escape('js')|escape('html') }}")"></a>
|
||||
{% endautoescape %}
|
||||
|
||||
@@ -42,15 +42,15 @@ escape types
|
||||
return array('msg' => "<>\n'\"")
|
||||
--EXPECT--
|
||||
|
||||
1. autoescape on |escape('js')
|
||||
1. autoescape true |escape('js')
|
||||
|
||||
<a onclick="alert("\x3c\x3e\x0a\x27\x22")"></a>
|
||||
|
||||
2. autoescape on html |escape('js')
|
||||
2. autoescape true html |escape('js')
|
||||
|
||||
<a onclick="alert("\x3c\x3e\x0a\x27\x22")"></a>
|
||||
|
||||
3. autoescape on js |escape('js')
|
||||
3. autoescape true js |escape('js')
|
||||
|
||||
<a onclick="alert("\x3c\x3e\x0a\x27\x22")"></a>
|
||||
|
||||
@@ -63,7 +63,7 @@ return array('msg' => "<>\n'\"")
|
||||
|
||||
<a onclick="alert("\x3c\x3e\x0a\x27\x22")"></a>
|
||||
|
||||
6. autoescape on html |escape('js')|escape('html')
|
||||
6. autoescape true html |escape('js')|escape('html')
|
||||
|
||||
<a onclick="alert("\x3c\x3e\x0a\x27\x22")"></a>
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag applies escaping after calling filters
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
|
||||
(escape_and_nl2br is an escaper filter)
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag do not applies escaping on filter arguments
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var|nl2br("<br />") }}
|
||||
{{ var|nl2br("<br />"|escape) }}
|
||||
{{ var|nl2br(sep) }}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag applies escaping after calling filters, and before calling pre_escape filters
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
|
||||
(nl2br is pre_escaped for "html" and declared safe for "html")
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
--TEST--
|
||||
"autoescape" tag does not escape when raw is used as a filter
|
||||
--TEMPLATE--
|
||||
{% autoescape on %}
|
||||
{% autoescape true %}
|
||||
{{ var|raw }}
|
||||
{% endautoescape %}
|
||||
--DATA--
|
||||
|
||||
Reference in New Issue
Block a user