22
33namespace Tests \Antlers \Runtime ;
44
5+ use Illuminate \Support \Facades \Log ;
56use PHPUnit \Framework \Attributes \Test ;
7+ use Statamic \Fields \Field ;
68use Statamic \Fields \Fieldtype ;
79use Statamic \Fields \Value ;
10+ use Statamic \Fieldtypes \Text ;
11+ use Statamic \View \Antlers \Language \Runtime \GlobalRuntimeState ;
812use Statamic \View \Antlers \Language \Runtime \RuntimeConfiguration ;
913use Statamic \View \Antlers \Language \Utilities \StringUtilities ;
1014use Tests \Antlers \ParserTestCase ;
@@ -513,8 +517,8 @@ public function test_php_node_assignments_within_loops()
513517 public function test_assignments_from_php_nodes ()
514518 {
515519 $ template = <<<'EOT'
516- {{?
517- $value_one = 100;
520+ {{?
521+ $value_one = 100;
518522 $value_two = 0;
519523?}}
520524
@@ -533,4 +537,76 @@ public function test_assignments_from_php_nodes()
533537 $ this ->assertStringContainsString ('<value_one: 1125> ' , $ result );
534538 $ this ->assertStringContainsString ('<value_two: 1025> ' , $ result );
535539 }
540+
541+ public function test_disabled_php_echo_node_inside_user_values ()
542+ {
543+ $ textFieldtype = new Text ();
544+ $ field = new Field ('text_field ' , [
545+ 'type ' => 'text ' ,
546+ 'antlers ' => true ,
547+ ]);
548+
549+ $ textContent = <<<'TEXT'
550+ Text: {{$ Str::upper('hello, world.') $}}
551+ TEXT;
552+
553+ $ textFieldtype ->setField ($ field );
554+ $ value = new Value ($ textContent , 'text_field ' , $ textFieldtype );
555+
556+ Log::shouldReceive ('warning ' )
557+ ->once ()
558+ ->with ("PHP Node evaluated in user content: {{ \$ Str::upper('hello, world.') \$}} " , [
559+ 'file ' => null ,
560+ 'trace ' => [],
561+ 'content ' => " Str::upper('hello, world.') " ,
562+ ]);
563+
564+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
565+
566+ $ this ->assertSame ('Text: ' , $ result );
567+
568+ GlobalRuntimeState::$ allowPhpInContent = true ;
569+
570+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
571+
572+ $ this ->assertSame ('Text: HELLO, WORLD. ' , $ result );
573+
574+ GlobalRuntimeState::$ allowPhpInContent = false ;
575+ }
576+
577+ public function test_disabled_php_node_inside_user_values ()
578+ {
579+ $ textFieldtype = new Text ();
580+ $ field = new Field ('text_field ' , [
581+ 'type ' => 'text ' ,
582+ 'antlers ' => true ,
583+ ]);
584+
585+ $ textContent = <<<'TEXT'
586+ Text: {{? echo Str::upper('hello, world.') ?}}
587+ TEXT;
588+
589+ $ textFieldtype ->setField ($ field );
590+ $ value = new Value ($ textContent , 'text_field ' , $ textFieldtype );
591+
592+ Log::shouldReceive ('warning ' )
593+ ->once ()
594+ ->with ("PHP Node evaluated in user content: {{? echo Str::upper('hello, world.') ?}} " , [
595+ 'file ' => null ,
596+ 'trace ' => [],
597+ 'content ' => " echo Str::upper('hello, world.') " ,
598+ ]);
599+
600+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
601+
602+ $ this ->assertSame ('Text: ' , $ result );
603+
604+ GlobalRuntimeState::$ allowPhpInContent = true ;
605+
606+ $ result = $ this ->renderString ('{{ text_field }} ' , ['text_field ' => $ value ]);
607+
608+ $ this ->assertSame ('Text: HELLO, WORLD. ' , $ result );
609+
610+ GlobalRuntimeState::$ allowPhpInContent = false ;
611+ }
536612}
0 commit comments