Fixed Templates: "if" conditions in some cases not translated correctly into PHP

[nocte]

Affected version

XF 2.2.10 Patch 1

If you have this if condition in a template:

<xf:if is="(!(FALSE OR TRUE OR TRUE))">
FTT.
</xf:if>

then the compiled PHP code looks like this:

    if (!(false OR true) OR true) {
        $__finalCompiled .= '
FTT.
';

It would be expected that nothing was printed, but because of falsely set brackets (!(false OR true), the outcome is different.

Origin: https://xenforo.com/community/threads/conditional-statements-for-xenforo-2.136639/post-1585691

 

[TheSkullKid]

Any feedback on this report?

 

[TheSkullKid]

@Brogan any updates on that reported issue?

 

[Xon]

The simple fix is XF\Template\Compiler\Syntax\UnaryOperator should wrap the RHS in brackets before prepending the !. (ie return "$operator($code)";)

 

[PaulB]

Alternatively, this might be better:

diff --git a/xenforo/src/XF/Template/Compiler/Parser.y b/xenforo/src/XF/Template/Compiler/Parser.y
index 0a0784c..0e25bf3 100644
--- a/xenforo/src/XF/Template/Compiler/Parser.y
+++ b/xenforo/src/XF/Template/Compiler/Parser.y
@@ -156,7 +156,7 @@ expression_part(RES) ::= double_quoted(A). {
        }
 }
 expression_part(RES) ::= PAREN_START expression(A) PAREN_END. {
-       RES = A;
+       RES = new Syntax\Expression(A, $this->line);
 }
 expression_part(RES) ::= array(A). {
        RES = A;

Simple test case:

START

{{ !(false or true or true) ? 'a' : 'b' }}

{{ -(1 + 2) }}

END

Old rendering:

<?php
// FROM HASH: 659621440cde4d0db935d1ed0b6e9bb6
return array(
'code' => function($__templater, array $__vars, $__extensions = null)
{
    $__finalCompiled = '';
    $__finalCompiled .= 'START

' . ((!(false OR true) OR true) ? 'a' : 'b') . '

' . (-1 + 2) . '

END';
    return $__finalCompiled;
}
);

New rendering with aforementioned patch applied:

<?php
// FROM HASH: 8dcc01353b66858d51200ddeaf4aaf62
return array(
'code' => function($__templater, array $__vars, $__extensions = null)
{
    $__finalCompiled = '';
    $__finalCompiled .= 'START

' . ((!((false OR true) OR true)) ? 'a' : 'b') . '

' . (-(1 + 2)) . '

END';
    return $__finalCompiled;
}
);

 

[XF Bug Bot]

Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.2.12).

Change log:

Adjust template Parser to allow for more precise parentheses placement in some previously ambiguous usages.

There may be a delay before changes are rolled out to the XenForo Community.