diff --git a/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php b/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php index 3ca65f2..cd60648 100644 --- a/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php +++ b/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php @@ -33,23 +33,16 @@ public function checkMethodAllowed($obj, $method) { $whitelist = [ 'id', 'label', + 'bundle', + 'get', ]; - foreach ($whitelist as $exact_match) { - if ($method == $exact_match) { - return; - } + if (in_array($method, $whitelist)) { + return TRUE; } - $whitelist_patterns = [ - '/^get[A-Z\(]/', - '/^has[A-Z]/', - '/^is[A-Z]/', - ]; - foreach ($whitelist_patterns as $pattern) { - // If the method name starts with a whitelisted prefix, allow it. - if (preg_match($pattern, $method)) { - return; - } + // If the method name starts with a whitelisted prefix, allow it. + if (preg_match('/^(get|has|is)[A-Z]/', $method)) { + return TRUE; } throw new \Twig_Sandbox_SecurityError(sprintf('Calling "%s" method on a "%s" object is not allowed.', $method, get_class($obj))); diff --git a/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php b/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php index 46ed159..4a4259d 100644 --- a/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php +++ b/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php @@ -63,6 +63,7 @@ public function testEntitySafeMethods() { $sandbox = new \Twig_Extension_Sandbox($policy, TRUE); $twig->addExtension($sandbox); + // Test availability of get*, has*, and is* methods. $entity = $this->getMock('Drupal\Core\Entity\EntityInterface'); $entity->expects($this->atLeastOnce()) ->method('hasLinkTemplate') @@ -84,6 +85,38 @@ public function testEntitySafeMethods() { ->willReturn('test'); $result = $twig->render('{{ entity.getEntityType }}', ['entity' => $entity]); $this->assertEquals($result, 'test', 'Sandbox policy allows get* functions to be called.'); + + // Test availability of whitelisted functions: id, label, bundle, and get. + $entity = $this->getMockBuilder('Drupal\Core\Entity\ContentEntityBase') + ->disableOriginalConstructor() + ->getMock(); + $entity->expects($this->atLeastOnce()) + ->method('get') + ->with('title') + ->willReturn('test'); + $result = $twig->render('{{ entity.get("title") }}', ['entity' => $entity]); + $this->assertEquals($result, 'test', 'Sandbox policy allows get() to be called.'); + + $entity = $this->getMock('Drupal\Core\Entity\EntityInterface'); + $entity->expects($this->atLeastOnce()) + ->method('id') + ->willReturn('1234'); + $result = $twig->render('{{ entity.id }}', ['entity' => $entity]); + $this->assertEquals($result, '1234', 'Sandbox policy allows get() to be called.'); + + $entity = $this->getMock('Drupal\Core\Entity\EntityInterface'); + $entity->expects($this->atLeastOnce()) + ->method('label') + ->willReturn('testing'); + $result = $twig->render('{{ entity.label }}', ['entity' => $entity]); + $this->assertEquals($result, 'testing', 'Sandbox policy allows get() to be called.'); + + $entity = $this->getMock('Drupal\Core\Entity\EntityInterface'); + $entity->expects($this->atLeastOnce()) + ->method('bundle') + ->willReturn('testing'); + $result = $twig->render('{{ entity.bundle }}', ['entity' => $entity]); + $this->assertEquals($result, 'testing', 'Sandbox policy allows get() to be called.'); } } diff --git a/core/themes/classy/templates/content/node.html.twig b/core/themes/classy/templates/content/node.html.twig index cbc1899..5145064 100644 --- a/core/themes/classy/templates/content/node.html.twig +++ b/core/themes/classy/templates/content/node.html.twig @@ -66,7 +66,7 @@ {% set classes = [ 'node', - 'node--type-' ~ node.getType()|clean_class, + 'node--type-' ~ node.bundle|clean_class, node.isPromoted() ? 'node--promoted', node.isSticky() ? 'node--sticky', not node.isPublished() ? 'node--unpublished', diff --git a/core/themes/classy/templates/content/taxonomy-term.html.twig b/core/themes/classy/templates/content/taxonomy-term.html.twig index 4284950..7e0446e 100644 --- a/core/themes/classy/templates/content/taxonomy-term.html.twig +++ b/core/themes/classy/templates/content/taxonomy-term.html.twig @@ -26,7 +26,7 @@ {% set classes = [ 'taxonomy-term', - 'vocabulary-' ~ term.getType()|clean_class, + 'vocabulary-' ~ term.bundle|clean_class, ] %}