By dww on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
9.1.x
Introduced in version: 
9.1.0
Issue links: 
https://www.drupal.org/node/3151094
Description: 

Since "whitelist" is both an historic bad labelling of people with racist connotations, and ambiguous and imprecise from a technical standpoint, various settings and protected member variables related to the Drupal\Core\Template\TwigSandboxPolicy class (see core/lib/Drupal/Core/Template/TwigSandboxPolicy.php) have been renamed.

Renamed settings

There were a site-wide settings you could place in settings.php that let you define classes, methods and prefixes that Twig would allow. Check your settings.php, settings.local.php, etc to make sure if you are defining any of these settings that you update them to the new names:

  • twig_sandbox_whitelisted_classes is replaced with twig_sandbox_allowed_classes
  • twig_sandbox_whitelisted_methods is replaced with twig_sandbox_allowed_methods
  • twig_sandbox_whitelisted_prefixes is replaced with twig_sandbox_allowed_prefixes

From 9.1.0 through the end of the Drupal 9 using the legacy names will continue to work, but will trigger a deprecation warning. Starting in Drupal 10.0.0, support for the old names will be completely removed.

Renamed protected member arrays

The Drupal\Core\Template\TwigSandboxPolicy class used to have protected array member variables called $whitelisted_methods, $whitelisted_prefixes and $whitelisted_classes. The member arrays have been renamed:

  • $whitelisted_methods is replaced with $allowed_methods
  • $whitelisted_prefixes is replaced with $allowed_prefixes
  • $whitelisted_classes is replaced with $allowed_classes

Any site that has extended this class in custom code should make sure not to use the old names for these member variables.

Impacts: 
Site builders, administrators, editors
Module developers
Themers