winter/modules/system/twig/Engine.php
Samuel Georges 3dc105173a Only allow local files via view engine
The Laravel view engine wants to supply the Twig engine with an absolute path, even though this is outside the inclusion rules. This implements a temporary exception to wave it through. It seems like a suitable alternative instead of implementing a reverse lookup to ensure the path is a valid view file, since we can trust the source engine has passed the value through its resolver already

Fixes previous fix
2020-10-13 19:14:49 +11:00

41 lines
904 B
PHP

<?php namespace System\Twig;
use System\Twig\Loader as TwigLoader;
use Twig\Environment as TwigEnvironment;
use Illuminate\Contracts\View\Engine as EngineInterface;
/**
* View engine used by the system, used for converting .htm files to twig.
*
* @package october\system
* @author Alexey Bobkov, Samuel Georges
*/
class Engine implements EngineInterface
{
/**
* @var TwigEnvironment
*/
protected $environment;
/**
* Constructor
*/
public function __construct(TwigEnvironment $environment)
{
$this->environment = $environment;
}
public function get($path, array $vars = [])
{
$previousAllow = TwigLoader::$allowInclude;
TwigLoader::$allowInclude = true;
$template = $this->environment->loadTemplate($path);
TwigLoader::$allowInclude = $previousAllow;
return $template->render($vars);
}
}