This PR was squashed before being merged into the 2.x branch.
Discussion
----------
Fix premature loop exit in Security Policy lookup of allowed methods/properties
The current security policy logic exits too soon when checking permissions for allowed classes and their methods/properties, causing false negatives in situations involving classes related by inheritance.
Consider the following configuration:
```
'methods' => [
'App\BasicCollection' => ['sortAlphabetically'],
'App\AdvancedCollection'=> ['sortByTimestamp'],
],
```
where `AdvancedCollection` is a subclass of `BasicCollection`, and `mylist` is an instance of `AdvancedCollection`
If you try to call `{{ mylist.sortByTimestamp() }}`, the current code will first match `mylist` against `App\BasicCollection`. Since `sortByTimestamp` is not an allowed method for `App\BasicCollection`, the code will exit the loop and incorrectly deny access. It will never get to checking `App\AdvancedCollection`.
Note that reordering classes in the config can't solve this issue. If you flipped the order, then it would fail for `{{ mylist.sortAlphabetically() }}` instead.
This pull request fixes the issue by only exiting the loop early when both the class and method/property match.
Commits
-------
5e1838db Fix premature loop exit in Security Policy lookup of allowed methods/properties
This PR was submitted for the 3.x branch but it was merged into the 2.x branch instead.
Discussion
----------
Add `Twig Language Server` and `Modern Twig` extension to docs
Commits
-------
a949600c Add `Twig Language Server` and `Modern Twig` extension to docs
This PR was squashed before being merged into the 2.x branch.
Discussion
----------
Bump PHP version used by Drupal tests
Commits
-------
da38e858 Update Drupal version in tests
64543c3c Fix code
4c4f73ca Bump PHP version used by Drupal tests
This PR was merged into the 2.x branch.
Discussion
----------
add return type for Symfony 7 compatibility
Commits
-------
fac08ec7 add return type for Symfony 7 compatibility
This PR was merged into the 2.x branch.
Discussion
----------
Mention where named arguments are supported
This follows up on #929. I tend to forget this detail, so it confuses me over and over again.
Commits
-------
ef9d7855 Mention where named arguments are supported
This PR was submitted for the 3.x branch but it was merged into the 2.x branch instead.
Discussion
----------
Making the Lexer initialize itself lazily, to avoid loading the extension set early
Hi!
Over on Symfony UX, we are pushing Twig in some crazy, "unconventional" ways by overriding the lexer to add a new HTML-like syntax - e.g. `<twig:Alert type="success">` - https://github.com/symfony/ux/blob/2.x/src/TwigComponent/src/Twig/ComponentLexer.php
Normally, the internal `Lexer` is not instantiated until it's needed - i.e. when a template is rendered. However, when overriding the lexer, our `ComponentLexer` needs to be instantiated early and set onto the `Environment`. And since it needs to extend `Lexer`, `Lexer::__construct()` is called much earlier than normal. One line in the constructor - https://github.com/twigphp/Twig/blob/f5ee1b6815a28fbab6e6fbb8c48b7964f0d93dd4/src/Lexer.php#L108 - causes the "extension set" to be loaded inside `Environment`. Some applications rely on being able to set extra Twig extensions after `Environment` is created, but before a template is rendered and our custom lexer currently breaks that.
So, the suggestion is to make the work inside `__construct()` done later. Everything is private, so I believe this is safe.
Cheers!
Commits
-------
2f7e8680 Making the Lexer initialize itself lazily, to avoid loading the extension set early
This PR was submitted for the 3.x branch but it was squashed and merged into the 2.x branch instead.
Discussion
----------
Minor: Fixing language
Commits
-------
f52b45d2 Minor: Fixing language
This PR was merged into the 2.x branch.
Discussion
----------
do not clean up whitespace text nodes inside if tags
Commits
-------
c8ec092c do not clean up whitespace text nodes inside if tags
This PR was merged into the 2.x branch.
Discussion
----------
Updates CoreExtension::twig_constant to check for definition first to avoid hard crash
The behaviour of PHP's constant() method has been updated after https://github.com/php/php-src/issues/9905 was accepted and fixed in PHP 8.1 (and previously changed post PHP 8.0) . This PR prevents a fatal error in the case a constant is supplied that doesn't actually exist.
Commits
-------
56b31224 Updates CoreExtension::twig_constant to check for definition first to avoid hard crash
This PR was submitted for the 3.x branch but it was merged into the 2.x branch instead.
Discussion
----------
Cycle function: Add output to example code
At first I couldn't grasp the concept of the cycle function, but after I saw the output in twigfiddle it was clear. I can imagine other readers having the same issue. Therefore I suggest to add the output to the example code.
Commits
-------
1e3b126c Add output
This PR was merged into the 2.x branch.
Discussion
----------
Add missing argument for the cycle function
Commits
-------
883fb333 Add missing argument for the cycle function
Ca-Jou
Fabien Potencier
Yaakov Saxon
Stanislav Romanov
Christian Flothmann
Matthias Pigulla
Ryan Weaver
Thomas Landauer
naveen
Alex Henderson-Roche
Katharina Luthe
Christophe Coevoet