Merge branch 'develop' of github.com:phpbb/phpbb3 into ticket/11832

# By Nathan Guse (22) and others
# Via Nathan Guse (10) and others
* 'develop' of github.com:phpbb/phpbb3: (39 commits)
  [ticket/11843] Added newlines and included numbers in the DEFINE vars test
  [ticket/11843] Add checking DEFINE variables with underscores to template_test
  [ticket/11843] The twig lexer fixes DEFINE variables with underscores again
  [ticket/11727] Fix indentation
  [ticket/11727] Fix indentation
  [ticket/11745] Correct language, coding guidelines
  [ticket/11828] Fix greedy operators in lexer
  [ticket/11833] Prevent Twig errors from invalid template loops using BEGINELSE
  [ticket/11833] Fix bad template loop
  [ticket/11816] !$DOESNT_EXIST test
  [ticket/9550] Add the core.viewtopic_post_rowset_data event to viewtopic.php
  [ticket/11829] Use report_closed to determine status in MCP report_details
  [ticket/11816] Test !$DEFINITION
  [ticket/11822] Use namespace lookup order for asset loading
  [ticket/11727] Template loader support for safe directories to load files from
  [ticket/11816] Fix define/loop checks in IF statements containing parenthesis
  [ticket/11373] Use inheritdoc
  [ticket/11637] generate_text_for_display on search.php
  [ticket/11744] Cast to int
  [ticket/11744] Inheritdoc
  ...

phpBB/phpbb/cron/task/core/prune_notifications.php

@@ -0,0 +1,65 @@
+<?php
+/**
+*
+* @package phpBB3
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
+/**
+* Prune notifications cron task.
+*
+* @package phpBB3
+*/
+class phpbb_cron_task_core_prune_notifications extends phpbb_cron_task_base
+{
+	protected $config;
+	protected $notification_manager;
+
+	/**
+	* Constructor.
+	*
+	* @param phpbb_config $config The config
+	* @param phpbb_notification_manager $notification_manager Notification manager
+	*/
+	public function __construct(phpbb_config $config, phpbb_notification_manager $notification_manager)
+	{
+		$this->config = $config;
+		$this->notification_manager = $notification_manager;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function run()
+	{
+		// time minus expire days in seconds
+		$timestamp = time() - ($this->config['read_notification_expire_days'] * 60 * 60 * 24);
+		$this->notification_manager->prune_notifications($timestamp);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_runnable()
+	{
+		return (bool) $this->config['read_notification_expire_days'];
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function should_run()
+	{
+		return $this->config['read_notification_last_gc'] < time() - $this->config['read_notification_gc'];
+	}
+}

phpBB/phpbb/db/migration/data/310/notifications_cron.php

@@ -0,0 +1,25 @@
+<?php
+/**
+*
+* @package migration
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+class phpbb_db_migration_data_310_notifications_cron extends phpbb_db_migration
+{
+	static public function depends_on()
+	{
+		return array('phpbb_db_migration_data_310_notifications');
+	}
+
+	public function update_data()
+	{
+		return array(
+			array('config.add', array('read_notification_expire_days', 30)),
+			array('config.add', array('read_notification_last_gc', 0)), // last run
+			array('config.add', array('read_notification_gc', (60 * 60 * 24))), // seconds between run; 1 day
+		);
+	}
+}

phpBB/phpbb/log/null.php

@@ -0,0 +1,78 @@
+<?php
+/**
+*
+* @package phpbb_log
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
+/**
+* Null logger
+*
+* @package phpbb_log
+*/
+class phpbb_log_null implements phpbb_log_interface
+{
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_enabled($type = '')
+	{
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function disable($type = '')
+	{
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function enable($type = '')
+	{
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function add($mode, $user_id, $log_ip, $log_operation, $log_time = false, $additional_data = array())
+	{
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_logs($mode, $count_logs = true, $limit = 0, $offset = 0, $forum_id = 0, $topic_id = 0, $user_id = 0, $log_time = 0, $sort_by = 'l.log_time DESC', $keywords = '')
+	{
+		return array();
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_log_count()
+	{
+		return 0;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_valid_offset()
+	{
+		return 0;
+	}
+}

phpBB/phpbb/notification/manager.php

@@ -59,7 +59,7 @@ class phpbb_notification_manager
 
 	/**
 	* Notification Constructor
-	* 
+	*
 	* @param array $notification_types
 	* @param array $notification_methods
 	* @param ContainerBuilder $phpbb_container
@@ -490,15 +490,15 @@ class phpbb_notification_manager
 	*
 	* @param string|array $notification_type_name Type identifier or array of item types (only acceptable if the $item_id is identical for the specified types)
 	* @param int|array $item_id Identifier within the type (or array of ids)
-	* @param array $data Data specific for this type that will be updated
+	* @param mixed $parent_id Parent identifier within the type (or array of ids), used in combination with item_id if specified (Default: false; not checked)
 	*/
-	public function delete_notifications($notification_type_name, $item_id)
+	public function delete_notifications($notification_type_name, $item_id, $parent_id = false)
 	{
 		if (is_array($notification_type_name))
 		{
 			foreach ($notification_type_name as $type)
 			{
-				$this->delete_notifications($type, $item_id);
+				$this->delete_notifications($type, $item_id, $parent_id);
 			}
 
 			return;
@@ -508,7 +508,8 @@ class phpbb_notification_manager
 
 		$sql = 'DELETE FROM ' . $this->notifications_table . '
 			WHERE notification_type_id = ' . (int) $notification_type_id . '
-				AND ' . (is_array($item_id) ? $this->db->sql_in_set('item_id', $item_id) : 'item_id = ' . (int) $item_id);
+				AND ' . (is_array($item_id) ? $this->db->sql_in_set('item_id', $item_id) : 'item_id = ' . (int) $item_id) .
+				(($parent_id !== false) ? ' AND ' . ((is_array($parent_id) ? $this->db->sql_in_set('item_parent_id', $parent_id) : 'item_parent_id = ' . (int) $parent_id)) : '');
 		$this->db->sql_query($sql);
 	}
 
@@ -796,11 +797,13 @@ class phpbb_notification_manager
 	* Delete all notifications older than a certain time
 	*
 	* @param int $timestamp Unix timestamp to delete all notifications that were created before
+	* @param bool $only_unread True (default) to only prune read notifications
 	*/
-	public function prune_notifications($timestamp)
+	public function prune_notifications($timestamp, $only_read = true)
 	{
 		$sql = 'DELETE FROM ' . $this->notifications_table . '
-			WHERE notification_time < ' . (int) $timestamp;
+			WHERE notification_time < ' . (int) $timestamp .
+				(($only_read) ? ' AND notification_read = 1' : '');
 		$this->db->sql_query($sql);
 	}
 
@@ -834,12 +837,12 @@ class phpbb_notification_manager
 	protected function load_object($object_name)
 	{
 		$object = $this->phpbb_container->get($object_name);
-		
+
 		if (method_exists($object, 'set_notification_manager'))
 		{
 			$object->set_notification_manager($this);
 		}
-		
+
 		return $object;
 	}
 

phpBB/phpbb/notification/type/group_request.php

@@ -0,0 +1,163 @@
+<?php
+/**
+*
+* @package notifications
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
+class phpbb_notification_type_group_request extends phpbb_notification_type_base
+{
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_type()
+	{
+		return 'group_request';
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public static $notification_option = array(
+		'lang'	=> 'NOTIFICATION_TYPE_GROUP_REQUEST',
+	);
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_available()
+	{
+		// Leader of any groups?
+		$sql = 'SELECT group_id
+			FROM ' . USER_GROUP_TABLE . '
+			WHERE user_id = ' . (int) $this->user->data['user_id'] . '
+				AND group_leader = 1';
+		$result = $this->db->sql_query_limit($sql, 1);
+		$row = $this->db->sql_fetchrow($result);
+		$this->db->sql_freeresult($result);
+
+		return (!empty($row)) ? true : false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public static function get_item_id($group)
+	{
+		return (int) $group['user_id'];
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public static function get_item_parent_id($group)
+	{
+		// Group id is the parent
+		return (int) $group['group_id'];
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function find_users_for_notification($group, $options = array())
+	{
+		$options = array_merge(array(
+			'ignore_users'		=> array(),
+		), $options);
+
+		$sql = 'SELECT user_id
+			FROM ' . USER_GROUP_TABLE . '
+			WHERE group_leader = 1
+				AND group_id = ' . (int) $group['group_id'];
+		$result = $this->db->sql_query($sql);
+
+		$user_ids = array();
+		while ($row = $this->db->sql_fetchrow($result))
+		{
+			$user_ids[] = (int) $row['user_id'];
+		}
+		$this->db->sql_freeresult($result);
+
+		$this->user_loader->load_users($user_ids);
+
+		return $this->check_user_notification_options($user_ids, $options);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_avatar()
+	{
+		return $this->user_loader->get_avatar($this->item_id);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_title()
+	{
+		$username = $this->user_loader->get_username($this->item_id, 'no_profile');
+
+		return $this->user->lang('NOTIFICATION_GROUP_REQUEST', $username, $this->get_data('group_name'));
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_email_template()
+	{
+		return 'group_request';
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_email_template_variables()
+	{
+		$user_data = $this->user_loader->get_user($this->item_id);
+
+		return array(
+			'GROUP_NAME'		   		=> htmlspecialchars_decode($this->get_data('group_name')),
+			'REQUEST_USERNAME' 	   		=> htmlspecialchars_decode($user_data['username']),
+
+			'U_PENDING'			  		=> generate_board_url() . "/ucp.{$this->php_ext}?i=groups&mode=manage&action=list&g={$this->item_parent_id}",
+			'U_GROUP'					=> generate_board_url() . "/memberlist.{$this->php_ext}?mode=group&g={$this->item_parent_id}",
+		);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_url()
+	{
+		return append_sid($this->phpbb_root_path . 'ucp.' . $this->php_ext, "i=groups&mode=manage&action=list&g={$this->item_parent_id}");
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function users_to_query()
+	{
+		return array($this->item_id);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function create_insert_array($group, $pre_create_data = array())
+	{
+		$this->set_data('group_name', $group['group_name']);
+
+		return parent::create_insert_array($group, $pre_create_data);
+	}
+}

phpBB/phpbb/notification/type/group_request_approved.php

@@ -0,0 +1,118 @@
+<?php
+/**
+*
+* @package notifications
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
+class phpbb_notification_type_group_request_approved extends phpbb_notification_type_base
+{
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_type()
+	{
+		return 'group_request_approved';
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_available()
+	{
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public static function get_item_id($group)
+	{
+		return (int) $group['group_id'];
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public static function get_item_parent_id($group)
+	{
+		return 0;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function find_users_for_notification($group, $options = array())
+	{
+		$users = array();
+
+		$group['user_ids'] = (!is_array($group['user_ids'])) ? array($group['user_ids']) : $group['user_ids'];
+
+		foreach ($group['user_ids'] as $user_id)
+		{
+			$users[$user_id] = array('');
+		}
+
+		return $users;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_title()
+	{
+		return $this->user->lang('NOTIFICATION_GROUP_REQUEST_APPROVED', $this->get_data('group_name'));
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_url()
+	{
+		return append_sid($this->phpbb_root_path . 'memberlist.' . $this->php_ext, "mode=group&g={$this->item_id}");
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function create_insert_array($group, $pre_create_data = array())
+	{
+		$this->set_data('group_name', $group['group_name']);
+
+		return parent::create_insert_array($group, $pre_create_data);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function users_to_query()
+	{
+		return array();
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_email_template()
+	{
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_email_template_variables()
+	{
+		return array();
+	}
+}

phpBB/phpbb/template/twig/environment.php

@@ -137,4 +137,39 @@ class phpbb_template_twig_environment extends Twig_Environment
 			return parent::loadTemplate($name, $index);
 		}
 	}
+
+	/**
+	 * Finds a template by name.
+	 *
+	 * @param string  $name  The template name
+	 * @return string
+	 */
+	public function findTemplate($name)
+	{
+		if (strpos($name, '@') === false)
+		{
+			foreach ($this->getNamespaceLookUpOrder() as $namespace)
+			{
+				try
+				{
+					if ($namespace === '__main__')
+					{
+						return parent::getLoader()->getCacheKey($name);
+					}
+
+					return parent::getLoader()->getCacheKey('@' . $namespace . '/' . $name);
+				}
+				catch (Twig_Error_Loader $e)
+				{
+				}
+			}
+
+			// We were unable to load any templates
+			throw $e;
+		}
+		else
+		{
+			return parent::getLoader()->getCacheKey($name);
+		}
+	}
 }

phpBB/phpbb/template/twig/lexer.php

@@ -75,7 +75,7 @@ class phpbb_template_twig_lexer extends Twig_Lexer
 
 		// Fix tokens that may have inline variables (e.g. <!-- DEFINE $TEST = '{FOO}')
 		$code = $this->fix_inline_variable_tokens(array(
-			'DEFINE.+=',
+			'DEFINE \$[a-zA-Z0-9_]+ =',
 			'INCLUDE',
 			'INCLUDEPHP',
 			'INCLUDEJS',
@@ -161,6 +161,9 @@ class phpbb_template_twig_lexer extends Twig_Lexer
 			$subset = trim(substr($matches[2], 1, -1)); // Remove parenthesis
 			$body = $matches[3];
 
+			// Replace <!-- BEGINELSE -->
+			$body = str_replace('<!-- BEGINELSE -->', '{% else %}', $body);
+
 			// Is the designer wanting to call another loop in a loop?
 			// <!-- BEGIN loop -->
 			// <!-- BEGIN !loop2 -->
@@ -205,9 +208,6 @@ class phpbb_template_twig_lexer extends Twig_Lexer
 			return "{% for {$name} in {$parent}{$name}{$subset} %}{$body}{% endfor %}";
 		};
 
-		// Replace <!-- BEGINELSE --> correctly, only needs to be done once
-		$code = str_replace('<!-- BEGINELSE -->', '{% else %}', $code);
-
 		return preg_replace_callback('#<!-- BEGIN ([!a-zA-Z0-9_]+)(\([0-9,\-]+\))? -->(.+?)<!-- END \1 -->#s', $callback, $code);
 	}
 
@@ -229,18 +229,18 @@ class phpbb_template_twig_lexer extends Twig_Lexer
 		{
 			$inner = $matches[2];
 			// Replace $TEST with definition.TEST
-			$inner = preg_replace('#\s\$([a-zA-Z_0-9]+)#', ' definition.$1', $inner);
+			$inner = preg_replace('#(\s\(?!?)\$([a-zA-Z_0-9]+)#', '$1definition.$2', $inner);
 
 			// Replace .foo with loops.foo|length
-			$inner = preg_replace('#\s\.([a-zA-Z_0-9]+)([^a-zA-Z_0-9\.])#', ' loops.$1|length$2', $inner);
+			$inner = preg_replace('#(\s\(?!?)\.([a-zA-Z_0-9]+)([^a-zA-Z_0-9\.])#', '$1loops.$2|length$3', $inner);
 
 			// Replace .foo.bar with foo.bar|length
-			$inner = preg_replace('#\s\.([a-zA-Z_0-9\.]+)([^a-zA-Z_0-9\.])#', ' $1|length$2', $inner);
+			$inner = preg_replace('#(\s\(?!?)\.([a-zA-Z_0-9\.]+)([^a-zA-Z_0-9\.])#', '$1$2|length$3', $inner);
 
 			return "<!-- {$matches[1]}IF{$inner}-->";
 		};
 
-		return preg_replace_callback('#<!-- (ELSE)?IF((.*)[\s][\$|\.|!]([^\s]+)(.*))-->#', $callback, $code);
+		return preg_replace_callback('#<!-- (ELSE)?IF((.*?) \(?!?[\$|\.]([^\s]+)(.*?))-->#', $callback, $code);
 	}
 
 	/**
@@ -264,10 +264,10 @@ class phpbb_template_twig_lexer extends Twig_Lexer
 		*/
 
 		// Replace <!-- DEFINE $NAME with {% DEFINE definition.NAME
-		$code = preg_replace('#<!-- DEFINE \$(.*)-->#', '{% DEFINE $1 %}', $code);
+		$code = preg_replace('#<!-- DEFINE \$(.*?) -->#', '{% DEFINE $1 %}', $code);
 
 		// Changing UNDEFINE NAME to DEFINE NAME = null to save from creating an extra token parser/node
-		$code = preg_replace('#<!-- UNDEFINE \$(.*)-->#', '{% DEFINE $1= null %}', $code);
+		$code = preg_replace('#<!-- UNDEFINE \$(.*?)-->#', '{% DEFINE $1= null %}', $code);
 
 		// Replace all of our variables, {$VARNAME}, with Twig style, {{ definition.VARNAME }}
 		$code = preg_replace('#{\$([a-zA-Z0-9_\.]+)}#', '{{ definition.$1 }}', $code);

phpBB/phpbb/template/twig/loader.php

@@ -0,0 +1,150 @@
+<?php
+/**
+*
+* @package phpBB3
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
+/**
+* Twig Template loader
+* @package phpBB3
+*/
+class phpbb_template_twig_loader extends Twig_Loader_Filesystem
+{
+	protected $safe_directories = array();
+
+	/**
+	* Set safe directories
+	*
+	* @param array $directories Array of directories that are safe (empty to clear)
+	* @return Twig_Loader_Filesystem
+	*/
+	public function setSafeDirectories($directories = array())
+	{
+		$this->safe_directories = array();
+
+		if (!empty($directories))
+		{
+			foreach ($directories as $directory)
+			{
+				$this->addSafeDirectory($directory);
+			}
+		}
+
+		return $this;
+	}
+
+	/**
+	* Add safe directory
+	*
+	* @param string $directory Directory that should be added
+	* @return Twig_Loader_Filesystem
+	*/
+	public function addSafeDirectory($directory)
+	{
+		$directory = phpbb_realpath($directory);
+
+		if ($directory !== false)
+		{
+			$this->safe_directories[] = $directory;
+		}
+
+		return $this;
+	}
+
+	/**
+	* Get current safe directories
+	*
+	* @return array
+	*/
+	public function getSafeDirectories()
+	{
+		return $this->safe_directories;
+	}
+
+	/**
+	* Override for parent::validateName()
+	*
+	* This is done because we added support for safe directories, and when Twig
+	*	findTemplate() is called, validateName() is called first, which would
+	*	always throw an exception if the file is outside of the configured
+	*	template directories.
+	*/
+	protected function validateName($name)
+	{
+		return;
+	}
+
+	/**
+	* Find the template
+	*
+	* Override for Twig_Loader_Filesystem::findTemplate to add support
+	*	for loading from safe directories.
+	*/
+	protected function findTemplate($name)
+	{
+		$name = (string) $name;
+
+		// normalize name
+		$name = preg_replace('#/{2,}#', '/', strtr($name, '\\', '/'));
+
+		// If this is in the cache we can skip the entire process below
+		//	as it should have already been validated
+		if (isset($this->cache[$name])) {
+			return $this->cache[$name];
+		}
+
+		// First, find the template name. The override above of validateName
+		//	causes the validateName process to be skipped for this call
+		$file = parent::findTemplate($name);
+
+		try
+		{
+			// Try validating the name (which may throw an exception)
+			parent::validateName($name);
+		}
+		catch (Twig_Error_Loader $e)
+		{
+			if (strpos($e->getRawMessage(), 'Looks like you try to load a template outside configured directories') === 0)
+			{
+				// Ok, so outside of the configured template directories, we
+				//	can now check if we're within a "safe" directory
+
+				// Find the real path of the directory the file is in
+				$directory = phpbb_realpath(dirname($file));
+
+				if ($directory === false)
+				{
+					// Some sort of error finding the actual path, must throw the exception
+					throw $e;
+				}
+
+				foreach ($this->safe_directories as $safe_directory)
+				{
+					if (strpos($directory, $safe_directory) === 0)
+					{
+						// The directory being loaded is below a directory
+						// that is "safe". We're good to load it!
+						return $file;
+					}
+				}
+			}
+
+			// Not within any safe directories
+			throw $e;
+		}
+
+		// No exception from validateName, safe to load.
+		return $file;
+	}
+}

phpBB/phpbb/template/twig/node/includeasset.php

@@ -40,10 +40,10 @@ abstract class phpbb_template_twig_node_includeasset extends Twig_Node
 				->write("\$local_file = \$this->getEnvironment()->get_phpbb_root_path() . \$asset_path;\n")
 				->write("if (!file_exists(\$local_file)) {\n")
 				->indent()
-					->write("\$local_file = \$this->getEnvironment()->getLoader()->getCacheKey(\$asset_path);\n")
+					->write("\$local_file = \$this->getEnvironment()->findTemplate(\$asset_path);\n")
 					->write("\$asset->set_path(\$local_file, true);\n")
 				->outdent()
-				->write("\$asset->add_assets_version({$config['assets_version']});\n")
+				->write("\$asset->add_assets_version('{$config['assets_version']}');\n")
 				->write("\$asset_file = \$asset->get_url();\n")
 				->write("}\n")
 			->outdent()

phpBB/phpbb/template/twig/twig.php

@@ -91,7 +91,7 @@ class phpbb_template_twig extends phpbb_template_base
 		$this->cachepath = $phpbb_root_path . 'cache/twig/';
 
 		// Initiate the loader, __main__ namespace paths will be setup later in set_style_names()
-		$loader = new Twig_Loader_Filesystem('');
+		$loader = new phpbb_template_twig_loader('');
 
 		$this->twig = new phpbb_template_twig_environment(
 			$this->config,
@@ -181,11 +181,15 @@ class phpbb_template_twig extends phpbb_template_base
 		{
 			foreach ($names as $name)
 			{
-				$path = $this->phpbb_root_path . trim($directory, '/') . "/{$name}/template/";
+				$path = $this->phpbb_root_path . trim($directory, '/') . "/{$name}/";
+				$template_path = $path . 'template/';
 
-				if (is_dir($path))
+				if (is_dir($template_path))
 				{
-					$paths[] = $path;
+					// Add the base style directory as a safe directory
+					$this->twig->getLoader()->addSafeDirectory($path);
+
+					$paths[] = $template_path;
 				}
 			}
 		}
@@ -233,11 +237,15 @@ class phpbb_template_twig extends phpbb_template_base
 
 				foreach ($names as $style_name)
 				{
-					$ext_style_path = $ext_path . 'styles/' . $style_name . '/template';
+					$ext_style_path = $ext_path . 'styles/' . $style_name . '/';
+					$ext_style_template_path = $ext_style_path . 'template/';
 
-					if (is_dir($ext_style_path))
+					if (is_dir($ext_style_template_path))
 					{
-						$paths[] = $ext_style_path;
+						// Add the base style directory as a safe directory
+						$this->twig->getLoader()->addSafeDirectory($ext_style_path);
+
+						$paths[] = $ext_style_template_path;
 					}
 				}