Twig, the flexible, fast, and secure template lang

Twig 1.13.0 released

Fri, 10 May 2013 17:24:59 +0200

Twig 1.13.0 has just been released. It contains nice speed optimizations for the escaping filter. Here is the full changlog:

fixed getting a numeric-like item on a variable (‘09’ for instance)
fixed getting a boolean or float key on an array, so it is consistent with PHP’s array access: {{ array[false] }} behaves the same as echo $array[false]; (equals $array[0])
made the escape filter 20% faster for happy path (escaping string for html with UTF-8)
changed ☃ to § in tests
enforced usage of named arguments after positional ones

Security Release: Twig 1.12.3 released

Mon, 08 Apr 2013 18:00:21 +0200

I’ve just released Twig 1.12.3 which contains a security vulnerability fix.

Description

Your application is affected if you are using Twig_Loader_Filesystem for loading Twig templates but only if you are using non-trusted template names (names provided by a end-user for instance).

When affected, it is possible to go up one directory for the paths configured in your loader.

For instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, you can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include "/../somefile_in_path_to" %}

Note that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and you will get a proper exception.

Affected Versions

All versions of Twig are affected.

How to Patch

If you cannot upgrade, you can apply the following patch:

https://github.com/fabpot/Twig/commit/3d19a2eed53570776af313593aaeb5ad62cf4980.diff

Credits

I want to thank Rick Prent who reported the issue and provided a fix for it.

Check your Project

As a quick remember, you can check your projects using Composer for vulnerability issues with the SensioLabs Security Checker.

Twig 1.12.2 released

Sat, 09 Feb 2013 19:39:27 +0100

I’ve just released Twig 1.12.2:

fixed the timezone used by the date filter and function when the given date contains a timezone (like 2010-01-28T15:00:00+02:00)
fixed globals when getGlobals is called early on
added the first and last filter

Twig 1.12.1 released

Tue, 15 Jan 2013 21:11:35 +0100

I’ve just released Twig 1.12.1. It removed a backward compatibility break that was introduced in Twig 1.12.0. It also adds two small features:

added support for object instances as the second argument of the constant function
added support for {{ some_string[:2] }}

Twig 1.12.0 released

Tue, 08 Jan 2013 15:11:10 +0100

Twig 1.12.0 is has just been released. You can read more about the new features in a previous blog post. Since RC1, we have fixed a couple of bugs and introduce the verbatim tag as an alias to the existing raw tag.

Twig 1.12.0-RC1 released

Sun, 30 Dec 2012 21:08:37 +0100

The first release candidate for Twig 1.12.0 has just been released. This version introduces a lot of nice enhancements that should simplify the way developers and web designers work with Twig.

Extending Twig the easy Way

You can extend Twig by creating an extension or by calling method directly on the Twig environment. Let’s see how you can create a new function.

Until now, it was a bit cumbersome and quite limited; you were able to map a Twig function to a PHP function or to a method from a Twig extension class (and depending on which you choose, you need to use a specific class):

$twig->addFunction('some_function', new Twig_Function_Function('some_function'));
$twig->addFunction('some_function', new Twig_Function_Method($extension, 'someMethod'));

As of 1.12, you can use any valid PHP callable, and everything is managed by one class:

$twig->addFunction(new Twig_SimpleFunction('some_function', 'some_function'));
$twig->addFunction(new Twig_SimpleFunction('some_function', array($extension, 'someMethod')));
$twig->addFunction(new Twig_SimpleFunction('some_function', function () { /* ... */ }));

Calling Things the flexible Way

When defining a macro, you can now set default values for all arguments instead of relying on the default filter:

{# before #}

{% macro input(name, value, type, size) %}
    <input type="{{ type|default('text') }}" name="{{ name }}" value="{{ value|default('')|e }}" size="{{ size|20 }}" />
{% endmacro %}

{# after #}

{% macro input(name, value = "", type = "text", size = 20) %}
    <input type="{{ type }}" name="{{ name }}" value="{{ value|e }}" size="{{ size }}" />
{% endmacro %}

Some functions and filters in Twig have a long list of arguments and remembering their order and their meaning is not easy. You can now use named arguments to make things easier and more explicit:

{# before #}

{{ data|convert_encoding('UTF-8', 'iso-2022-jp') }}

{# after #}

{{ data|convert_encoding(from='iso-2022-jp', to='UTF-8') }}

A new include function has been introduced to simplify the including of other files when passing multiple options:

{# before #}
{% sandbox %}
    {% include 'page.html' ignore missing %}
{% endsandbox %}

{# after #}
{{ include('page.html', sandboxed = true, ignore_missing = true) }}

The ternary operator syntax has been extended to simplify some common use cases:

{# standard syntax #}
{{ foo ? 'yes' : 'no' }}

{# extended syntaxes as of Twig 1.12 #}
{{ foo ?: 'no' }} is the same as {{ foo ? foo : 'no' }}
{{ foo ? 'yes' }} is the same as {{ foo ? 'yes' : '' }}

As always, everything should be backward compatible, meaning that all your existing templates will still work as before. Of course, if that’s not the case, report it as soon as possible so that we can fix the regressions before the 1.12.0 final is released later this week.

Twig 1.11.1 released

Sun, 11 Nov 2012 18:22:48 +0100

Twig 1.11.1 is a maintenance release where the following bugs have been fixed:

fixed debug info line numbering (was off by 2)
fixed escaping when calling a macro inside another one (regression introduced in 1.9.1)
optimized variable access on PHP 5.4
fixed a crash of the C extension when an exception was thrown from a macro called without being imported (using _self.XXX)

Twig 1.11.0 released

Wed, 07 Nov 2012 13:46:50 +0100

I’m very happy to announce the immediate availability of Twig 1.11.

As with any new release, the documentation has been improved for existing features, and two new recipes have been published: Using a Database to store Templates and Using different Template Sources. I have also added a new section to explain how blocks work in Twig.

In 1.11, you can now import a template from a string thanks to the template_from_string function (this was probably one the of most often asked feature on the mailing-list).

Of course, we have fixed some bugs too:

macro compilation when a variable name is a PHP reserved keyword
bitwise operator precedences
default timezone usage for the date function
the date filter behavior which now always apply the default timezone, except if false is passed as the timezone

And last, but not the least, the performance of the exception management has been greatly improved, especially when using the Twig loader chain.

Twig 1.10.3 released

Fri, 19 Oct 2012 12:52:12 +0200

Twig 1.10.3 has just been released. This version fixes a regression introduced in 1.10.2, and adds a new filter to split strings.

Twig 1.10.1 released

Mon, 15 Oct 2012 09:38:00 +0200

Twig 1.10.1 has just been released. It contains some fixes to the C extensions, and a speed optimization for macros.

Note: I’ve just released 1.10.2 due to a problem with macro calls and PHP 5.4.

Good usage of macros

Mon, 15 Oct 2012 09:24:00 +0200

The documentation for Twig macros has just been updated.

When macros are defined and used in the same template, the old docs recommended to use the _self variable to call macros. Even if it works, it is a very bad idea as it relies on the current implementation (coupling usage and implementation is never a good idea).

If you are currently using this “hack” in your templates, I recommend you to use the proper way (always importing the macros before using them) as the implementation for macros will change in Twig 2.x and the current shortcut won’t work anymore.

More information in the doc commit and in the updated documentation. You can also have a look at this change I’ve just made to Symfony.

Twig 1.10.0 released

Fri, 28 Sep 2012 22:29:03 +0200

Twig 1.10.0 has just been released.

This new version adds several nice features.

Functional Test Framework

Twig has a test suite composed of unit and functional tests. For functional tests, we have nice abstraction that allow us to write tests very easily. As of 1.10.0, this abstraction has been extracted so that you can now benefit from it and write your own tests for your customized filters/tags/functions/tests.

Namespaced templates support

Twig now support namespaced templates. It help organize your template in a better way.

You can learn more about these new features in the documentation or directly from the diff: https://github.com/fabpot/Twig/compare/v1.9.2…v1.10.0

Twig 1.9.2 released

Sat, 25 Aug 2012 19:37:58 +0200

Twig 1.9.2 has just been released. It mainly fixes some issues with the C extensions.

Twig 1.9.1 released

Sun, 22 Jul 2012 12:34:36 +0200

Twig 1.9.1 has just been released. The changelog reads as follows:

optimized macro calls when auto-escaping is on
fixed wrong parent class for Twig_Function_Node
made Twig_Loader_Chain more explicit about problems

Twig 1.9.0 released

Fri, 13 Jul 2012 18:35:43 +0200

I’ve just released Twig 1.9.0.

The major change in this release is the support for more built-in escaping strategies. Twig now supports HTML, CSS, JS, URL, and HTML attributes out of the box (thanks to Pádraic Brady who did a great job at implementing most of the new escaping strategies in the Zend Framework Escaper class from which our code is greatly inspired). The documentation on escaping has also been updated to give more accurate information on what the developer needs to be aware of.

Twig 1.8.3 released

Sun, 17 Jun 2012 20:53:21 +0200

Twig 1.8.3 has just been released. The changelog reads as follows:

fixed paths in the filesystem loader when passing a path that ends with a slash or a backslash
fixed escaping when a project defines a function named html or js
fixed chmod mode to apply the umask correctly

Twig 1.8.2 released

Wed, 30 May 2012 08:19:00 +0200

Twig 1.8.2 has just been released. The changelog reads as follows:

added the abs filter
fixed a regression when using a number in template attributes
fixed compiler when mbstring.func_overload is set to 2
fixed DateTimeZone support in date filter

Twig 1.8.1 released

Thu, 17 May 2012 18:06:12 +0200

I’ve just released Twig 1.8.1. It contains the following changes:

fixed a regression when dealing with SimpleXMLElement instances in templates
fixed “is_safe” value for the “dump” function when “html_errors” is not defined in php.ini
switched to use mbstring whenever possible instead of iconv

Twig 1.8.0 released

Tue, 08 May 2012 09:12:11 +0200

I’m proud to announce the immediate availability of Twig 1.8.0. This version has two main new features.

The new embed tag gives the web designer yet another possibility when organizing his templates.

I have also enhanced the way autoescaping works to allow dynamic strategies to be applied (read the new recipe to learn more about that possibility). The autoescape tag syntax has also be simplified (everything is backward compatible though).

Beside the code, I’ve also reorganized the documentation and the table of contents.

Offline Documentation

Thu, 03 May 2012 08:14:01 +0200

I’m always looking for ways to improve the documentation and its usability. If you are always connected, the website offers a lot of documentation, easily accessible via the built-in search engine: The website short URLs allows you to quickly lookup for any built-in tag, filter, function, or test: write a URL like http://twig.sensiolabs.org/XXX where XXX is what you are looking for, and you will be redirected to the most relevant page… even if you make a typo! These shortcuts also makes easy to type in a link in a mailing-list post, an IRC conversation, or a blog post.

But today, I’m really happy to announce that you can now also download the whole Twig documentation for easy offline reading. Get the gorgeous PDF document for your laptop and get the great EPUB file for your tablet or your phone.