Search moodle.org's
Developer Documentation

See Release Notes
Long Term Support Release

  • Bug fixes for general core bugs in 3.9.x will end* 10 May 2021 (12 months).
  • Bug fixes for security issues in 3.9.x will end* 8 May 2023 (36 months).
  • PHP version: minimum PHP 7.2.0 Note: minimum PHP version has increased since Moodle 3.8. PHP 7.3.x and 7.4.x are supported too.
/lib/classes/output/ -> mustache_helper_collection.php (source)

[Source view]

Differences Between: [Versions 39 and 310] [Versions 39 and 311] [Versions 39 and 400] [Versions 39 and 401] [Versions 39 and 402] [Versions 39 and 403]

Custom Moodle helper collection for mustache.

Copyright: 2019 Ryan Wyllie <ryan@moodle.com>
License: http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
File Size: 176 lines (7 kb)
Included or required:0 times
Referenced: 0 times
Includes or requires: 0 files

Defines 1 class

mustache_helper_collection:: (5 methods):
  __construct()
  add()
  disable_helpers()
  restore_helpers()
  strip_blacklisted_helpers()


Class: mustache_helper_collection  - X-Ref

Custom Moodle helper collection for mustache.

__construct($helpers = null, array $blacklistednestedhelpers = [])   X-Ref
Helper Collection constructor.

Optionally accepts an array (or Traversable) of `$name => $helper` pairs.

param: array|\Traversable $helpers (default: null)
param: string[] $blacklistednestedhelpers Names of helpers that aren't allowed to be called within other helpers.

add($name, $helper)   X-Ref
Add a helper to this collection.

This function has overridden the parent implementation to provide blacklist
functionality for certain helpers to prevent them being called from within
other helpers. This is because the JavaScript helper can be used in a
security exploit if it can be nested.

The function will wrap callable helpers in an anonymous function that strips
out the blacklisted helpers from the source string before giving it to the
helper function. This prevents the blacklisted helper functions from being
called by nested render functions from within other helpers.

param: string $name
param: mixed  $helper

disable_helpers($names)   X-Ref
Disable a list of helpers (by name) by changing their implementation to
simply return an empty string.

param: string[] $names List of helper names to disable
return: \Closure[] The original helper functions indexed by name

restore_helpers($helpers)   X-Ref
Restore the original helper implementations. Typically used after disabling
a helper.

param: \Closure[] $helpers The helper functions indexed by name

strip_blacklisted_helpers($blacklist, $string)   X-Ref
Parse the given string and remove any reference to blacklisted helpers.

E.g.
$blacklist = ['js'];
$string = "core, move, {{#js}} some nasty JS hack {{/js}}"
result: "core, move, {{}}"

param: string[] $blacklist List of helper names to strip
param: string $string String to parse
return: string Parsed string