5 files changed, 37 insertions, 10 deletions
diff --git a/phpBB/phpbb/console/command/db/migrate.php b/phpBB/phpbb/console/command/db/migrate.php
index c7ccd4646e..16a09af6fc 100644
--- a/phpBB/phpbb/console/command/db/migrate.php
+++ b/phpBB/phpbb/console/command/db/migrate.php
@@ -115,6 +115,7 @@ class migrate extends \phpbb\console\command\command
 		$migrations = $this->extension_manager
 			->get_finder()
 			->core_path('phpbb/db/migration/data/')
+			->extension_directory('/migrations')
 			->get_classes();
 		$this->migrator->set_migrations($migrations);
 	}
diff --git a/phpBB/phpbb/controller/provider.php b/phpBB/phpbb/controller/provider.php
index 9df8130210..2c7493f64c 100644
--- a/phpBB/phpbb/controller/provider.php
+++ b/phpBB/phpbb/controller/provider.php
@@ -46,7 +46,7 @@ class provider
 			// We hardcode the path to the core config directory
 			// because the finder cannot find it
 			$this->routing_files = array_merge($this->routing_files, array('config/routing.yml'), array_keys($finder
-					->directory('config')
+					->directory('/config')
 					->suffix('routing.yml')
 					->find()
 			));
diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index f530d30f1f..c9e04e1401 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1045,8 +1045,9 @@ class session
 	* @param string $name		Name of the cookie, will be automatically prefixed with the phpBB cookie name. track becomes [cookie_name]_track then.
 	* @param string $cookiedata	The data to hold within the cookie
 	* @param int $cookietime	The expiration time as UNIX timestamp. If 0 is provided, a session cookie is set.
+	* @param int $httponly		Use HttpOnly. Defaults to true. Use false to make cookie accessible by client-side scripts.
 	*/
-	function set_cookie($name, $cookiedata, $cookietime)
+	function set_cookie($name, $cookiedata, $cookietime, $httponly = true)
 	{
 		global $config;
 
@@ -1054,7 +1055,7 @@ class session
 		$expire = gmdate('D, d-M-Y H:i:s \\G\\M\\T', $cookietime);
 		$domain = (!$config['cookie_domain'] || $config['cookie_domain'] == 'localhost' || $config['cookie_domain'] == '127.0.0.1') ? '' : '; domain=' . $config['cookie_domain'];
 
-		header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . '; HttpOnly', false);
+		header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . ';' . (($httponly) ? ' HttpOnly' : ''), false);
 	}
 
 	/**
diff --git a/phpBB/phpbb/template/twig/lexer.php b/phpBB/phpbb/template/twig/lexer.php
index f4efc58540..49577f6e95 100644
--- a/phpBB/phpbb/template/twig/lexer.php
+++ b/phpBB/phpbb/template/twig/lexer.php
@@ -191,9 +191,16 @@ class lexer extends \Twig_Lexer
 		$parent_class = $this;
 		$callback = function ($matches) use ($parent_class, $parent_nodes)
 		{
-			$name = $matches[1];
-			$subset = trim(substr($matches[2], 1, -1)); // Remove parenthesis
-			$body = $matches[3];
+			$hard_parents = explode('.', $matches[1]);
+			array_pop($hard_parents); // ends with .
+			if ($hard_parents)
+			{
+				$parent_nodes = array_merge($hard_parents, $parent_nodes);
+			}
+
+			$name = $matches[2];
+			$subset = trim(substr($matches[3], 1, -1)); // Remove parenthesis
+			$body = $matches[4];
 
 			// Replace <!-- BEGINELSE -->
 			$body = str_replace('<!-- BEGINELSE -->', '{% else %}', $body);
@@ -242,7 +249,7 @@ class lexer extends \Twig_Lexer
 			return "{% for {$name} in {$parent}{$name}{$subset} %}{$body}{% endfor %}";
 		};
 
-		return preg_replace_callback('#<!-- BEGIN ([!a-zA-Z0-9_]+)(\([0-9,\-]+\))? -->(.+?)<!-- END \1 -->#s', $callback, $code);
+		return preg_replace_callback('#<!-- BEGIN ((?:[a-zA-Z0-9_]+\.)*)([!a-zA-Z0-9_]+)(\([0-9,\-]+\))? -->(.+?)<!-- END \1\2 -->#s', $callback, $code);
 	}
 
 	/**
diff --git a/phpBB/phpbb/user.php b/phpBB/phpbb/user.php
index 18b7a3d096..f8e473dcad 100644
--- a/phpBB/phpbb/user.php
+++ b/phpBB/phpbb/user.php
@@ -69,7 +69,7 @@ class user extends \phpbb\session
 	*/
 	function setup($lang_set = false, $style_id = false)
 	{
-		global $db, $template, $config, $auth, $phpEx, $phpbb_root_path, $cache;
+		global $db, $request, $template, $config, $auth, $phpEx, $phpbb_root_path, $cache;
 		global $phpbb_dispatcher;
 
 		if ($this->data['user_id'] != ANONYMOUS)
@@ -80,7 +80,25 @@ class user extends \phpbb\session
 		}
 		else
 		{
-			$user_lang_name = basename($config['default_lang']);
+			$lang_override = $request->variable('language', '');
+			if ($lang_override)
+			{
+				$this->set_cookie('lang', $lang_override, 0, false);
+			}
+			else
+			{
+				$lang_override = $request->variable($config['cookie_name'] . '_lang', '', true, \phpbb\request\request_interface::COOKIE);
+			}
+			if ($lang_override)
+			{
+				$use_lang = basename($lang_override);
+				$user_lang_name = (file_exists($this->lang_path . $use_lang . "/common.$phpEx")) ? $use_lang : basename($config['default_lang']);
+				$this->data['user_lang'] = $user_lang_name;
+			}
+			else
+			{
+				$user_lang_name = basename($config['default_lang']);
+			}
 			$user_date_format = $config['default_dateformat'];
 			$user_timezone = $config['board_timezone'];
 
@@ -190,7 +208,7 @@ class user extends \phpbb\session
 		}
 		unset($lang_set_ext);
 
-		$style_request = request_var('style', 0);
+		$style_request = $request->variable('style', 0);
 		if ($style_request && (!$config['override_user_style'] || $auth->acl_get('a_styles')) && !defined('ADMIN_START'))
 		{
 			global $SID, $_EXTRA_URL;