diff --git a/src/Symfony/Component/Templating/PhpEngine.php b/src/Symfony/Component/Templating/PhpEngine.php index 00dca533889d..f300ee9669dd 100644 --- a/src/Symfony/Component/Templating/PhpEngine.php +++ b/src/Symfony/Component/Templating/PhpEngine.php @@ -42,6 +42,9 @@ class PhpEngine implements EngineInterface, \ArrayAccess protected $globals; protected $parser; + private $evalTemplate; + private $evalParameters; + /** * Constructor. * @@ -156,24 +159,36 @@ public function supports($name) */ protected function evaluate(Storage $template, array $parameters = array()) { - $__template__ = $template; + $this->evalTemplate = $template; + $this->evalParameters = $parameters; + unset($template, $parameters); - if (isset($parameters['__template__'])) { - throw new \InvalidArgumentException('Invalid parameter (__template__)'); + if (isset($this->evalParameters['this'])) { + throw new \InvalidArgumentException('Invalid parameter (this)'); + } + if (isset($this->evalParameters['view'])) { + throw new \InvalidArgumentException('Invalid parameter (view)'); } - if ($__template__ instanceof FileStorage) { - extract($parameters, EXTR_SKIP); - $view = $this; + $view = $this; + if ($this->evalTemplate instanceof FileStorage) { + extract($this->evalParameters, EXTR_SKIP); + $this->evalParameters = null; + ob_start(); - require $__template__; + require $this->evalTemplate; + + $this->evalTemplate = null; return ob_get_clean(); - } elseif ($__template__ instanceof StringStorage) { - extract($parameters, EXTR_SKIP); - $view = $this; + } elseif ($this->evalTemplate instanceof StringStorage) { + extract($this->evalParameters, EXTR_SKIP); + $this->evalParameters = null; + ob_start(); - eval('; ?>'.$__template__.''.$this->evalTemplate.'evalTemplate = null; return ob_get_clean(); } diff --git a/src/Symfony/Component/Templating/Tests/PhpEngineTest.php b/src/Symfony/Component/Templating/Tests/PhpEngineTest.php index 055b1b7173d1..d7fe56165699 100644 --- a/src/Symfony/Component/Templating/Tests/PhpEngineTest.php +++ b/src/Symfony/Component/Templating/Tests/PhpEngineTest.php @@ -116,6 +116,32 @@ public function testExtendRender() $this->assertEquals('bar-foo-', $engine->render('foo.php', array('foo' => 'foo', 'bar' => 'bar')), '->render() supports render() calls in templates'); } + public function testRenderParameter() + { + $engine = new ProjectTemplateEngine(new TemplateNameParser(), $this->loader); + $this->loader->setTemplate('foo.php', ''); + $this->assertEquals('foobar', $engine->render('foo.php', array('template' => 'foo', 'parameters' => 'bar')), '->render() extract variables'); + } + + /** + * @expectedException \InvalidArgumentException + * @dataProvider forbiddenParameterNames + */ + public function testRenderForbiddenParameter($name) + { + $engine = new ProjectTemplateEngine(new TemplateNameParser(), $this->loader); + $this->loader->setTemplate('foo.php', 'bar'); + $engine->render('foo.php', array($name => 'foo')); + } + + public function forbiddenParameterNames() + { + return array( + array('this'), + array('view'), + ); + } + public function testEscape() { $engine = new ProjectTemplateEngine(new TemplateNameParser(), $this->loader);