2
2
3
3
namespace Tests \Antlers \Runtime ;
4
4
5
+ use Illuminate \Support \Facades \Log ;
5
6
use PHPUnit \Framework \Attributes \Test ;
7
+ use Statamic \Fields \Field ;
6
8
use Statamic \Fields \Fieldtype ;
7
9
use Statamic \Fields \Value ;
10
+ use Statamic \Fieldtypes \Text ;
11
+ use Statamic \View \Antlers \Language \Runtime \GlobalRuntimeState ;
8
12
use Statamic \View \Antlers \Language \Runtime \RuntimeConfiguration ;
9
13
use Statamic \View \Antlers \Language \Utilities \StringUtilities ;
10
14
use Tests \Antlers \ParserTestCase ;
@@ -513,8 +517,8 @@ public function test_php_node_assignments_within_loops()
513
517
public function test_assignments_from_php_nodes ()
514
518
{
515
519
$ template = <<<'EOT'
516
- {{?
517
- $value_one = 100;
520
+ {{?
521
+ $value_one = 100;
518
522
$value_two = 0;
519
523
?}}
520
524
@@ -533,4 +537,76 @@ public function test_assignments_from_php_nodes()
533
537
$ this ->assertStringContainsString ('<value_one: 1125> ' , $ result );
534
538
$ this ->assertStringContainsString ('<value_two: 1025> ' , $ result );
535
539
}
540
+
541
+ public function test_disabled_php_echo_node_inside_user_values ()
542
+ {
543
+ $ textFieldtype = new Text ();
544
+ $ field = new Field ('text_field ' , [
545
+ 'type ' => 'text ' ,
546
+ 'antlers ' => true ,
547
+ ]);
548
+
549
+ $ textContent = <<<'TEXT'
550
+ Text: {{$ Str::upper('hello, world.') $}}
551
+ TEXT;
552
+
553
+ $ textFieldtype ->setField ($ field );
554
+ $ value = new Value ($ textContent , 'text_field ' , $ textFieldtype );
555
+
556
+ Log::shouldReceive ('warning ' )
557
+ ->once ()
558
+ ->with ("PHP Node evaluated in user content: {{ \$ Str::upper('hello, world.') \$}} " , [
559
+ 'file ' => null ,
560
+ 'trace ' => [],
561
+ 'content ' => " Str::upper('hello, world.') " ,
562
+ ]);
563
+
564
+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
565
+
566
+ $ this ->assertSame ('Text: ' , $ result );
567
+
568
+ GlobalRuntimeState::$ allowPhpInContent = true ;
569
+
570
+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
571
+
572
+ $ this ->assertSame ('Text: HELLO, WORLD. ' , $ result );
573
+
574
+ GlobalRuntimeState::$ allowPhpInContent = false ;
575
+ }
576
+
577
+ public function test_disabled_php_node_inside_user_values ()
578
+ {
579
+ $ textFieldtype = new Text ();
580
+ $ field = new Field ('text_field ' , [
581
+ 'type ' => 'text ' ,
582
+ 'antlers ' => true ,
583
+ ]);
584
+
585
+ $ textContent = <<<'TEXT'
586
+ Text: {{? echo Str::upper('hello, world.') ?}}
587
+ TEXT;
588
+
589
+ $ textFieldtype ->setField ($ field );
590
+ $ value = new Value ($ textContent , 'text_field ' , $ textFieldtype );
591
+
592
+ Log::shouldReceive ('warning ' )
593
+ ->once ()
594
+ ->with ("PHP Node evaluated in user content: {{? echo Str::upper('hello, world.') ?}} " , [
595
+ 'file ' => null ,
596
+ 'trace ' => [],
597
+ 'content ' => " echo Str::upper('hello, world.') " ,
598
+ ]);
599
+
600
+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
601
+
602
+ $ this ->assertSame ('Text: ' , $ result );
603
+
604
+ GlobalRuntimeState::$ allowPhpInContent = true ;
605
+
606
+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
607
+
608
+ $ this ->assertSame ('Text: HELLO, WORLD. ' , $ result );
609
+
610
+ GlobalRuntimeState::$ allowPhpInContent = false ;
611
+ }
536
612
}
0 commit comments