From b49d3a1851330d64009c8050132e50b093172559 Mon Sep 17 00:00:00 2001
From: Nathan Guse <nathaniel.guse@gmail.com>
Date: Mon, 4 Nov 2013 12:21:12 -0600
Subject: [ticket/11943] Do not quote the value when it is exactly true, false,
 or null

Quoting these can change the meaning of the value (e.g. 'false' == true)

PHPBB3-11943
---
 phpBB/phpbb/template/twig/lexer.php | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'phpBB/phpbb/template')

diff --git a/phpBB/phpbb/template/twig/lexer.php b/phpBB/phpbb/template/twig/lexer.php
index be53b3eb5b..8c52fa65b2 100644
--- a/phpBB/phpbb/template/twig/lexer.php
+++ b/phpBB/phpbb/template/twig/lexer.php
@@ -129,6 +129,14 @@ class lexer extends \Twig_Lexer
 			// Replace template variables with start/end to parse variables (' ~ TEST ~ '.html)
 			$matches[2] = preg_replace('#{([a-zA-Z0-9_\.$]+)}#', "'~ \$1 ~'", $matches[2]);
 
+			// If the second item is exactly one of a few key words,
+			// do not quote it as it changes the meaning
+			// http://tracker.phpbb.com/browse/PHPBB3-11943
+			if (in_array($matches[2], array('false', 'true', 'null')))
+			{
+				return "<!-- {$matches[1]} {$matches[2]} -->";
+			}
+
 			// Surround the matches in single quotes ('' ~ TEST ~ '.html')
 			return "<!-- {$matches[1]} '{$matches[2]}' -->";
 		};
-- 
cgit v1.2.1


From da332aa0a5cbeabbcce5551ee955c701fc2a1d73 Mon Sep 17 00:00:00 2001
From: Nathan Guse <nathaniel.guse@gmail.com>
Date: Fri, 8 Nov 2013 19:55:16 -0600
Subject: [ticket/11943] Require stricter DEFINE statements for templates

PHPBB3-11943
---
 phpBB/phpbb/template/twig/lexer.php | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

(limited to 'phpBB/phpbb/template')

diff --git a/phpBB/phpbb/template/twig/lexer.php b/phpBB/phpbb/template/twig/lexer.php
index 8c52fa65b2..efd6a0bd84 100644
--- a/phpBB/phpbb/template/twig/lexer.php
+++ b/phpBB/phpbb/template/twig/lexer.php
@@ -69,7 +69,7 @@ class lexer extends \Twig_Lexer
 
 		// Fix tokens that may have inline variables (e.g. <!-- DEFINE $TEST = '{FOO}')
 		$code = $this->fix_inline_variable_tokens(array(
-			'DEFINE \$[a-zA-Z0-9_]+ =',
+			//'DEFINE \$[a-zA-Z0-9_]+ =', // Disabling for ticket 11943
 			'INCLUDE',
 			'INCLUDEPHP',
 			'INCLUDEJS',
@@ -129,14 +129,6 @@ class lexer extends \Twig_Lexer
 			// Replace template variables with start/end to parse variables (' ~ TEST ~ '.html)
 			$matches[2] = preg_replace('#{([a-zA-Z0-9_\.$]+)}#', "'~ \$1 ~'", $matches[2]);
 
-			// If the second item is exactly one of a few key words,
-			// do not quote it as it changes the meaning
-			// http://tracker.phpbb.com/browse/PHPBB3-11943
-			if (in_array($matches[2], array('false', 'true', 'null')))
-			{
-				return "<!-- {$matches[1]} {$matches[2]} -->";
-			}
-
 			// Surround the matches in single quotes ('' ~ TEST ~ '.html')
 			return "<!-- {$matches[1]} '{$matches[2]}' -->";
 		};
-- 
cgit v1.2.1


From 6370970f13d58f617379da64efb1f88a522f3f03 Mon Sep 17 00:00:00 2001
From: Nathan Guse <nathaniel.guse@gmail.com>
Date: Fri, 8 Nov 2013 22:30:58 -0600
Subject: [ticket/11943] Split fix_inline_variable_tokens into 3 steps

DEFINE shouldn't add/remove surrounding quotes, but must have the inline
variable tokens fixed

PHPBB3-11943
---
 phpBB/phpbb/template/twig/lexer.php | 60 ++++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 10 deletions(-)

(limited to 'phpBB/phpbb/template')

diff --git a/phpBB/phpbb/template/twig/lexer.php b/phpBB/phpbb/template/twig/lexer.php
index efd6a0bd84..f4efc58540 100644
--- a/phpBB/phpbb/template/twig/lexer.php
+++ b/phpBB/phpbb/template/twig/lexer.php
@@ -68,8 +68,20 @@ class lexer extends \Twig_Lexer
 		);
 
 		// Fix tokens that may have inline variables (e.g. <!-- DEFINE $TEST = '{FOO}')
+		$code = $this->strip_surrounding_quotes(array(
+			'INCLUDE',
+			'INCLUDEPHP',
+			'INCLUDEJS',
+			'INCLUDECSS',
+		), $code);
 		$code = $this->fix_inline_variable_tokens(array(
-			//'DEFINE \$[a-zA-Z0-9_]+ =', // Disabling for ticket 11943
+			'DEFINE \$[a-zA-Z0-9_]+ =',
+			'INCLUDE',
+			'INCLUDEPHP',
+			'INCLUDEJS',
+			'INCLUDECSS',
+		), $code);
+		$code = $this->add_surrounding_quotes(array(
 			'INCLUDE',
 			'INCLUDEPHP',
 			'INCLUDEJS',
@@ -107,10 +119,30 @@ class lexer extends \Twig_Lexer
 		return parent::tokenize($code, $filename);
 	}
 
+	/**
+	* Strip surrounding quotes
+	*
+	* First step to fix tokens that may have inline variables
+	* E.g. <!-- INCLUDE '{TEST}.html' to <!-- INCLUDE {TEST}.html
+	*
+	* @param array $tokens array of tokens to search for (imploded to a regular expression)
+	* @param string $code
+	* @return string
+	*/
+	protected function strip_surrounding_quotes($tokens, $code)
+	{
+		// Remove matching quotes at the beginning/end if a statement;
+		// E.g. 'asdf'"' -> asdf'"
+		// E.g. "asdf'"" -> asdf'"
+		// E.g. 'asdf'" -> 'asdf'"
+		return preg_replace('#<!-- (' . implode('|', $tokens) . ') (([\'"])?(.*?)\1) -->#', '<!-- $1 $2 -->', $code);
+	}
+
 	/**
 	* Fix tokens that may have inline variables
 	*
-	* E.g. <!-- INCLUDE {TEST}.html
+	* Second step to fix tokens that may have inline variables
+	* E.g. <!-- INCLUDE '{TEST}.html' to <!-- INCLUDE ' ~ {TEST} ~ '.html
 	*
 	* @param array $tokens array of tokens to search for (imploded to a regular expression)
 	* @param string $code
@@ -120,22 +152,30 @@ class lexer extends \Twig_Lexer
 	{
 		$callback = function($matches)
 		{
-			// Remove matching quotes at the beginning/end if a statement;
-			// E.g. 'asdf'"' -> asdf'"
-			// E.g. "asdf'"" -> asdf'"
-			// E.g. 'asdf'" -> 'asdf'"
-			$matches[2] = preg_replace('#^([\'"])?(.*?)\1$#', '$2', $matches[2]);
-
 			// Replace template variables with start/end to parse variables (' ~ TEST ~ '.html)
 			$matches[2] = preg_replace('#{([a-zA-Z0-9_\.$]+)}#', "'~ \$1 ~'", $matches[2]);
 
-			// Surround the matches in single quotes ('' ~ TEST ~ '.html')
-			return "<!-- {$matches[1]} '{$matches[2]}' -->";
+			return "<!-- {$matches[1]} {$matches[2]} -->";
 		};
 
 		return preg_replace_callback('#<!-- (' . implode('|', $tokens) . ') (.+?) -->#', $callback, $code);
 	}
 
+	/**
+	* Add surrounding quotes
+	*
+	* Last step to fix tokens that may have inline variables
+	* E.g. <!-- INCLUDE '{TEST}.html' to <!-- INCLUDE '' ~ {TEST} ~ '.html'
+	*
+	* @param array $tokens array of tokens to search for (imploded to a regular expression)
+	* @param string $code
+	* @return string
+	*/
+	protected function add_surrounding_quotes($tokens, $code)
+	{
+		return preg_replace('#<!-- (' . implode('|', $tokens) . ') (.+?) -->#', '<!-- $1 \'$2\' -->', $code);
+	}
+
 	/**
 	* Fix begin tokens (convert our BEGIN to Twig for)
 	*
-- 
cgit v1.2.1


From 2e5117a71eb64c734e5738235c44ef92818ca33b Mon Sep 17 00:00:00 2001
From: Nathan Guse <nathaniel.guse@gmail.com>
Date: Sat, 9 Nov 2013 11:14:55 -0600
Subject: [ticket/11943] Throw an exception if DEFINE is setup improperly

PHPBB3-11943
---
 phpBB/phpbb/template/twig/tokenparser/defineparser.php | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'phpBB/phpbb/template')

diff --git a/phpBB/phpbb/template/twig/tokenparser/defineparser.php b/phpBB/phpbb/template/twig/tokenparser/defineparser.php
index 21add0c17c..8484f2e81a 100644
--- a/phpBB/phpbb/template/twig/tokenparser/defineparser.php
+++ b/phpBB/phpbb/template/twig/tokenparser/defineparser.php
@@ -30,6 +30,13 @@ class defineparser extends \Twig_TokenParser
 			$stream->next();
 			$value = $this->parser->getExpressionParser()->parseExpression();
 
+			if ($value instanceof \Twig_Node_Expression_Name)
+			{
+				// This would happen if someone improperly formed their DEFINE syntax
+				// e.g. <!-- DEFINE $VAR = foo -->
+				throw new \Twig_Error_Syntax('Invalid DEFINE', $token->getLine(), $this->parser->getFilename());
+			}
+
 			$stream->expect(\Twig_Token::BLOCK_END_TYPE);
 		} else {
 			$capture = true;
-- 
cgit v1.2.1