113 Commits

Author SHA1 Message Date
Fabien Potencier 2102dd1359 Fix a security issue when an included sandboxed template has been loaded before without the sandbox context 2024-09-09 19:08:51 +02:00
Yaakov Saxon a18da1614a Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source 2023-12-19 08:18:35 +01:00
Yaakov Saxon 5e1838dbca Fix premature loop exit in Security Policy lookup of allowed methods/properties 2023-10-26 17:37:13 -07:00
Fabien Potencier 974c866961 Remove Drupal tests 2023-09-11 17:40:51 +02:00
Fabien Potencier da38e858e3 Update Drupal version in tests 2023-07-28 12:21:15 +02:00
Christian Flothmann c8ec092ceb do not clean up whitespace text nodes inside if tags 2022-12-26 18:04:52 +01:00
Fabien Potencier ef7a5ef2e3 Remove a test that was a regression test for the C extension 2022-12-26 12:42:02 +01:00
Christophe Coevoet f3b8c01262 Fix the drupal testing script 2022-12-15 11:35:27 +01:00
Fabien Potencier d6ea14aa84 Merge branch '1.x' into 2.x
* 1.x:
  Fix a security issue on filesystem loader (possibility to load a template outside a configured directory)
2022-09-28 10:36:46 +02:00
Fabien Potencier f2cb718bdb Fix CS 2022-08-12 08:33:05 +02:00
Fabien Potencier f8009347c4 Fix a security issue on filesystem loader (possibility to load a template outside a configured directory) 2022-07-13 16:03:29 +02:00
Ben Thomson d1457a40b6 Allow inherited magic method to still run with calling class
If a static method cannot be resolved to the calling class, but the calling class has, or inherits, a `__callStatic` handler, this allows the `__callStatic` handler to be used with the calling class, and not the inherited class as would occur with reflection. This allows systems such as Laravel facades to still work.

Fixes https://github.com/twigphp/Twig/issues/3716
2022-07-06 10:46:46 +02:00
Fabien Potencier 3aba62185d Removed unneeded ext refs 2022-06-02 20:36:38 +02:00
ju1ius e333ccc9f6 Fixes CallExpression::reflectCallable() throwing TypeError 2022-06-02 20:33:33 +02:00
Nicolas Grekas dd34e9f5c9 Fix optimizing non-public named closures 2022-05-16 17:47:23 +02:00
Nicolas Grekas 163f07400a Fix support for named closures 2022-05-13 17:01:54 +02:00
Fabien Potencier beea1a7c4a Add a test 2022-03-25 09:18:53 +01:00
Fabien Potencier 9c03ef0d21 Fix custom escapers when using multiple Twig environments 2022-03-25 08:56:44 +01:00
Christian Flothmann 1411c454c1 do not reuse internally generated variable names during parsing 2022-02-24 17:25:50 +01:00
Fabien Potencier 2eb3308055 Disallow non closures in sort filter when the sanbox mode is enabled 2022-02-04 07:52:21 +01:00
v.arsentev 7d0e5d6a1e The deprecated null value for the method round has been changed to zero. 2022-01-11 16:12:44 +01:00
Ruud Kamphuis e9cd55def5 Allow null for nl2br, striptags and format filters
Same as https://github.com/twigphp/Twig/pull/3617
2022-01-03 14:28:28 +01:00
Fabien Potencier 92bc110bcf Allow null when Twig expects a string 2022-01-02 16:05:53 +01:00
Jérôme TAMARELLE 4fcc6b1c47 Use faster hash algorithm (xxh128) on PHP 8.1 2021-12-15 06:29:16 +01:00
Fabien Potencier 3a18bb3a6b Fix CS 2021-09-22 17:05:23 +02:00
Remi Collet 61df934a7e Missing Environment and LoaderInterface 2021-09-22 11:33:46 +02:00
Nicolas Grekas 1d0bab9d63 Add explicit @return type next to #[ReturnTypeWillChange] 2021-08-10 18:49:26 +02:00
Alex Pott 98c2233e47 Twig2 PHP 8.1 beta compatibility 2021-07-28 09:49:43 +01:00
Fabien Potencier feeaba3fea Merge branch '1.x' into 2.x
* 1.x:
  Explicitly specify the encoding for mb_ord in JS escaper
2021-07-08 13:01:04 +02:00
Oleg Stepanischev da24c9340e Explicitly specify the encoding for mb_ord in JS escaper
Explicitly specify the encoding for mb_ord in JS escaper - fix
2021-07-08 12:58:33 +02:00
Fabien Potencier 7926399e0a Merge branch '1.x' into 2.x
* 1.x:
  Fix implicit flot to int casts
2021-06-06 18:31:25 +02:00
Alexander M. Turek de9cd76d7c Fix implicit flot to int casts 2021-06-06 00:32:22 +02:00
Fabien Potencier 66fa6d37f7 Merge branch '1.x' into 2.x
* 1.x:
  Move Drupal test file to tests/
  fix file permissions
  Bump version
  Prepare the 1.44.4 release
2021-05-18 13:10:20 +02:00
Fabien Potencier 2fa8bce914 Move Drupal test file to tests/ 2021-05-18 13:09:01 +02:00
Fabien Potencier ceb4de0448 Merge branch '1.x' into 2.x
* 1.x:
  Update CHANGELOG
  Revert "bug #3499 Fix: A template name cannot be an absolute path (mvorisek)"
2021-05-16 14:07:24 +02:00
Fabien Potencier 124f10c27e Revert "bug #3499 Fix: A template name cannot be an absolute path (mvorisek)"
This reverts commit 83f26e402b, reversing
changes made to f5d3c704df.
2021-05-16 14:06:26 +02:00
Fabien Potencier 157fa56829 Merge branch '1.x' into 2.x
* 1.x:
  Fix CS
  Migrate to the new PHP CS Fixer config file
2021-05-12 09:27:30 +02:00
Fabien Potencier 59f3e8e5dc Fix CS 2021-05-12 09:19:37 +02:00
Fabien Potencier 953974a7b3 Fix code for PHP 8.1 2021-04-10 10:14:28 +02:00
Fabien Potencier 02fe3a544c Merge branch '1.x' into 2.x
* 1.x:
  Fix: A template name cannot be an absolute path
2021-04-07 17:57:49 +02:00
Michael Voříšek 3a67fc7dc5 Fix: A template name cannot be an absolute path 2021-04-07 17:57:24 +02:00
Fabien Potencier c2a264a91d Merge branch '1.x' into 2.x
* 1.x:
  Enhancement: Introduce DOCtor-RST config + Sphinx build + GithubActions
  Enhancement: Use GithubActions instead of Travis for tests
  Fix `odd` not working for negative numbers
  Bump version to 1.44.2-DEV
  Prepare the 1.44.1 release
2020-11-05 13:31:01 +01:00
Harry Bournis 53a3ccd2d2 Fix odd not working for negative numbers 2020-11-05 11:55:45 +01:00
Fabien Potencier 497f027cd4 Merge branch '1.x' into 2.x
* 1.x:
  Fix "include(template_from_string())"
  Fix PHPUnit config
2020-10-27 15:14:55 +01:00
Fabien Potencier df9c9f2165 Fix "include(template_from_string())" 2020-10-27 13:39:31 +01:00
Fabien Potencier 53650c55c1 Merge branch '1.x' into 2.x
* 1.x:
  Fix PHP 8 support
2020-10-21 14:27:01 +02:00
Fabien Potencier b1c9faa33e Fix PHP 8 support 2020-10-21 14:08:16 +02:00
Fabien Potencier 2ffab581fe Merge branch '1.x' into 2.x
* 1.x:
  Fix PHP 8 support
2020-10-21 13:43:35 +02:00
Fabien Potencier d46aeb0724 Fix PHP 8 support 2020-10-21 13:43:26 +02:00
Fabien Potencier ab6695b580 Merge branch '1.x' into 2.x
* 1.x:
  Fix sandbox support when using include(template_from_string())
  Add test to verify that filter is not working when template_from_string is used.
  In |filter(), |map(), and |reduce(), throw a RuntimeError instead of a TypeError
2020-08-23 17:55:14 +02:00