Merge pull request #1 from yiisoft/master

docs/guide/structure-assets.md

@@ -2,7 +2,7 @@ Assets
 ======
 
 An asset in Yii is a file that may be referenced in a Web page. It can be a CSS file, a JavaScript file, an image
-or video file, etc. Assets are located in Web-accessible folders and are directly served by Web servers.
+or video file, etc. Assets are located in Web-accessible directories and are directly served by Web servers.
 
 It is often preferable to manage assets programmatically. For example, when you use the [[yii\jui\DatePicker]] widget
 in a page, it will automatically include the required CSS and JavaScript files, instead of asking you to manually
@@ -86,7 +86,7 @@ explanation about the properties of [[yii\web\AssetBundle]] can be found in the
 * [[yii\web\AssetBundle::cssOptions|cssOptions]]: specifies the options that will be passed to the
   [[yii\web\View::registerCssFile()]] method when it is called to register *every* CSS file in this bundle.
 * [[yii\web\AssetBundle::publishOptions|publishOptions]]: specifies the options that will be passed to the
-  [[yii\web\AssetManager::publish()]] method when it is called to publish source asset files to a Web folder.
+  [[yii\web\AssetManager::publish()]] method when it is called to publish source asset files to a Web directory.
   This is only used if you specify the [[yii\web\AssetBundle::sourcePath|sourcePath]] property.
 
 
@@ -95,9 +95,9 @@ explanation about the properties of [[yii\web\AssetBundle]] can be found in the
 Assets, based on their location, can be classified as:
 
 * source assets: the asset files are located together with PHP source code which cannot be directly accessed via Web.
-  In order to use source assets in a page, they should be copied to a Web folder and turned into the so-called
+  In order to use source assets in a page, they should be copied to a Web directory and turned into the so-called
   published assets. This process is called *asset publishing* which will be described in detail shortly.
-* published assets: the asset files are located in a Web folder and can thus be directly accessed via Web.
+* published assets: the asset files are located in a Web directory and can thus be directly accessed via Web.
 * external assets: the asset files are located on a Web server that is different from the one hosting your Web
   application.
 
@@ -106,17 +106,17 @@ it means any assets listed using relative paths will be considered as source ass
 it means those assets are published assets (you should therefore specify [[yii\web\AssetBundle::basePath|basePath]] and
 [[yii\web\AssetBundle::baseUrl|baseUrl]] to let Yii know where they are located.)
 
-It is recommended that you place assets belonging to an application in a Web folder to avoid the unnecessary asset
+It is recommended that you place assets belonging to an application in a Web directory to avoid the unnecessary asset
 publishing process. This is why `AppAsset` in the prior example specifies [[yii\web\AssetBundle::basePath|basePath]]
 instead of [[yii\web\AssetBundle::sourcePath|sourcePath]].
 
 For [extensions](structure-extensions.md), because their assets are located together with their source code
-in folders that are not Web accessible, you have to specify the [[yii\web\AssetBundle::sourcePath|sourcePath]]
+in directories that are not Web accessible, you have to specify the [[yii\web\AssetBundle::sourcePath|sourcePath]]
 property when defining asset bundle classes for them.
 
 > Note: Do not use `@webroot/assets` as the [[yii\web\AssetBundle::sourcePath|source path]].
-  This folder is used by default by the [[yii\web\AssetManager|asset manager]] to save the asset files
-  published from their source location. Any content in this folder are considered temporarily and may be subject
+  This directory is used by default by the [[yii\web\AssetManager|asset manager]] to save the asset files
+  published from their source location. Any content in this directory are considered temporarily and may be subject
   to removal.
 
 
@@ -179,7 +179,7 @@ the assets in the library:
    to refer to the library.
 2. Create an asset bundle class and list the JavaScript/CSS files that you plan to use in your application or extension.
    You should specify the [[yii\web\AssetBundle::sourcePath|sourcePath]] property as `@bower/PackageName` or `@npm/PackageName`.
-   This is because Composer will install the Bower or NPM package in the folder corresponding to this alias.
+   This is because Composer will install the Bower or NPM package in the directory corresponding to this alias.
 
 > Note: Some packages may put all their distributed files in a subdirectory. If this is the case, you should specify
   the subdirectory as the value of [[yii\web\AssetBundle::sourcePath|sourcePath]]. For example, [[yii\web\JqueryAsset]]
@@ -200,7 +200,7 @@ If you are registering an asset bundle in other places, you should provide the n
 to register an asset bundle in a [widget](structure-widgets.md) class, you can get the view object by `$this->view`.
 
 When an asset bundle is registered with a view, behind the scene Yii will register all its dependent asset bundles.
-And if an asset bundle is located in a folder inaccessible through the Web, it will be published to a Web folder.
+And if an asset bundle is located in a directory inaccessible through the Web, it will be published to a Web directory.
 Later when the view renders a page, it will generate `<link>` and `<script>` tags for the CSS and JavaScript files
 listed in the registered bundles. The order of these tags is determined by the dependencies among
 the registered bundles and the order of the assets listed in the [[yii\web\AssetBundle::css]] and [[yii\web\AssetBundle::js]]
@@ -304,11 +304,11 @@ For example, an asset file `my/path/to/jquery.js` matches a key `jquery.js`.
 
 ### Asset Publishing <a name="asset-publishing"></a>
 
-As aforementioned, if an asset bundle is located in a folder that is not Web accessible, its assets will be copied
-to a Web folder when the bundle is being registered with a view. This process is called *asset publishing*, and is done
+As aforementioned, if an asset bundle is located in a directory that is not Web accessible, its assets will be copied
+to a Web directory when the bundle is being registered with a view. This process is called *asset publishing*, and is done
 automatically by the [[yii\web\AssetManager|asset manager]].
 
-By default, assets are published to the folder `@webroot/assets` which corresponds to the URL `@web/assets`.
+By default, assets are published to the directory `@webroot/assets` which corresponds to the URL `@web/assets`.
 You may customize this location by configuring the [[yii\web\AssetManager::basePath|basePath]] and
 [[yii\web\AssetManager::baseUrl|baseUrl]] properties.
 
@@ -558,17 +558,16 @@ return [
     ],
     // Asset bundle for compression output:
     'targets' => [
-        'app\config\AllAsset' => [
-            'basePath' => 'path/to/web',
-            'baseUrl' => '',
+        'all' => [
+            'class' => 'yii\web\AssetBundle',
+            'basePath' => '@webroot/assets',
+            'baseUrl' => '@web/assets',
             'js' => 'js/all-{hash}.js',
             'css' => 'css/all-{hash}.css',
         ],
     ],
     // Asset manager configuration:
     'assetManager' => [
-        'basePath' => __DIR__,
-        'baseUrl' => '',
     ],
 ];
 ```

docs/guide/structure-models.md

@@ -301,7 +301,7 @@ is associated with one or multiple active rules declared in `rules()`.
 ## Massive Assignment <a name="massive-assignment"></a>
 
 Massive assignment is a convenient way of populating a model with user inputs using a single line of code.
-It populates the attributes of a model by assigning the input data directly to the [[yii\base\Model::attributes]]
+It populates the attributes of a model by assigning the input data directly to the [[yii\base\Model::$attributes]]
 property. The following two pieces of code are equivalent, both trying to assign the form data submitted by end users
 to the attributes of the `ContactForm` model. Clearly, the former, which uses massive assignment, is much cleaner
 and less error prone than the latter:
@@ -395,7 +395,7 @@ In the first step, models are converted into arrays; in the second step, the arr
 target formats. You may just focus on the first step, because the second step can be achieved by generic
 data formatters, such as [[yii\web\JsonResponseFormatter]].
 
-The simplest way of converting a model into an array is to use the [[yii\base\Model::attributes]] property.
+The simplest way of converting a model into an array is to use the [[yii\base\Model::$attributes]] property.
 For example,
 
 ```php
@@ -403,11 +403,11 @@ $post = \app\models\Post::findOne(100);
 $array = $post->attributes;
 ```
 
-By default, the [[yii\base\Model::attributes]] property will return the values of *all* attributes
+By default, the [[yii\base\Model::$attributes]] property will return the values of *all* attributes
 declared in [[yii\base\Model::attributes()]].
 
 A more flexible and powerful way of converting a model into an array is to use the [[yii\base\Model::toArray()]]
-method. Its default behavior is the same as that of [[yii\base\Model::attributes]]. However, it allows you
+method. Its default behavior is the same as that of [[yii\base\Model::$attributes]]. However, it allows you
 to choose which data items, called *fields*, to be put in the resulting array and how they should be formatted.
 In fact, it is the default way of exporting models in RESTful Web service development, as described in
 the [Response Formatting](rest-response-formatting.md).

docs/guide/tutorial-core-validators.md

@@ -105,9 +105,11 @@ This validator checks if the input value is a date, time or datetime in a proper
 Optionally, it can convert the input value into a UNIX timestamp and store it in an attribute
 specified via [[yii\validators\DateValidator::timestampAttribute|timestampAttribute]].
 
-- `format`: the date/time format that the value being validated should be in. Please refer to the
-  [PHP manual about date_create_from_format()](http://www.php.net/manual/en/datetime.createfromformat.php)
-  for details about specifying the format string. The default value is `'Y-m-d'`.
+- `format`: the date/time format that the value being validated should be in. 
+   This can be a date time pattern as described in the [ICU manual](http://userguide.icu-project.org/formatparse/datetime#TOC-Date-Time-Format-Syntax).
+   Alternatively this can be a string prefixed with `php:` representing a format that can be recognized by the PHP 
+   `Datetime` class. Please refer to <http://php.net/manual/en/datetime.createfromformat.php> on supported formats.
+   If this is not set, it will take the value of `Yii::$app->formatter->dateFormat`.
 - `timestampAttribute`: the name of the attribute to which this validator may assign the UNIX timestamp
   converted from the input date/time.
 

extensions/smarty/Extension.php

@@ -148,9 +148,10 @@ class Extension
             // Inject code to re-register widget tag during run-time
             return <<<PHP
 <?php
-    \$_smarty_tpl->getGlobal('_viewRenderer')->widgets['blocks']['$alias'] = '$class';
+    \$viewRenderer=\$_smarty_tpl->default_template_handler_func[0];
+    \$viewRenderer->widgets['blocks']['$alias'] = '$class';
     try {
-        \$_smarty_tpl->registerPlugin('block', '$alias', [\$_smarty_tpl->getGlobal('_viewRenderer'), '_widget_block__$alias']);
+        \$_smarty_tpl->registerPlugin('block', '$alias', [\$viewRenderer, '_widget_block__$alias']);
     }
     catch (SmartyException \$e) {
         /* Ignore already registered exception during first execution after compilation */
@@ -165,9 +166,10 @@ PHP;
             // Inject code to re-register widget tag during run-time
             return <<<PHP
 <?php
-    \$_smarty_tpl->getGlobal('_viewRenderer')->widgets['functions']['$alias'] = '$class';
+    \$viewRenderer=\$_smarty_tpl->default_template_handler_func[0];
+    \$viewRenderer->widgets['functions']['$alias'] = '$class';
     try {
-        \$_smarty_tpl->registerPlugin('function', '$alias', [\$_smarty_tpl->getGlobal('_viewRenderer'), '_widget_function__$alias']);
+        \$_smarty_tpl->registerPlugin('function', '$alias', [\$viewRenderer, '_widget_function__$alias']);
     }
     catch (SmartyException \$e) {
         /* Ignore already registered exception during first execution after compilation */
@@ -319,10 +321,11 @@ PHP;
 
         $url = ArrayHelper::remove($params, 'url');
         $key = ArrayHelper::remove($params, 'key', null);
+        $depends = ArrayHelper::remove($params, 'depends', null);
         if (isset($params['position']))
             $params['position'] = $this->getViewConstVal($params['position'], View::POS_END);
 
-        Yii::$app->getView()->registerJsFile($url, $params, $key);
+        Yii::$app->getView()->registerJsFile($url, $depends, $params, $key);
     }
 
     /**
@@ -378,8 +381,9 @@ PHP;
 
         $url = ArrayHelper::remove($params, 'url');
         $key = ArrayHelper::remove($params, 'key', null);
+        $depends = ArrayHelper::remove($params, 'depends', null);
 
-        Yii::$app->getView()->registerCssFile($url, $params, $key);
+        Yii::$app->getView()->registerCssFile($url, $depends, $params, $key);
     }
 
     /**

extensions/twig/CHANGELOG.md

@@ -8,6 +8,7 @@ Yii Framework 2 twig extension Change Log
 - Bug #3767: Fixed repeated adding of extensions when using config. One may now pass extension instances as well (grachov)
 - Bug #3877: Fixed `lexerOptions` throwing exception (dapatrese)
 - Bug #4290: Fixed throwing exception when trying to access AR relation that is null (samdark, tenitski)
+- Bug #5191: Sandbox was ignored for models and AR relations (genichyar)
 - Enh #1799: Added `form_begin`, `form_end` to twig extension (samdark)
 - Enh #3674: Various enhancements (samdark)
     - Removed `FileLoader` and used `\Twig_Loader_Filesystem` instead.

extensions/twig/Template.php

@@ -20,10 +20,16 @@ abstract class Template extends \Twig_Template
     protected function getAttribute($object, $item, array $arguments = [], $type = \Twig_Template::ANY_CALL, $isDefinedTest = false, $ignoreStrictCheck = false)
     {
         // Twig uses isset() to check if attribute exists which does not work when attribute exists but is null
-        if ($object instanceof \yii\db\BaseActiveRecord) {
+        if ($object instanceof \yii\base\Model) {
             if ($type === \Twig_Template::METHOD_CALL) {
+                if ($this->env->hasExtension('sandbox')) {
+                    $this->env->getExtension('sandbox')->checkMethodAllowed($object, $item);
+                }
                 return $object->$item($arguments);
             } else {
+                if ($this->env->hasExtension('sandbox')) {
+                    $this->env->getExtension('sandbox')->checkPropertyAllowed($object, $item);
+                }
                 return $object->$item;
             }
         }

framework/console/controllers/AssetController.php

@@ -273,7 +273,9 @@ class AssetController extends Controller
                     return $bundleOrders[$a] > $bundleOrders[$b] ? 1 : -1;
                 }
             });
+            if (!isset($target['class'])) {
                 $target['class'] = $name;
+            }
             $targets[$name] = Yii::createObject($target);
         }
 
@@ -349,7 +351,7 @@ class AssetController extends Controller
 
         foreach ($map as $bundle => $target) {
             $targets[$bundle] = Yii::createObject([
-                'class' => 'yii\\web\\AssetBundle',
+                'class' => strpos($bundle, '\\') !== false ? $bundle : 'yii\\web\\AssetBundle',
                 'depends' => [$target],
             ]);
         }
@@ -389,12 +391,21 @@ class AssetController extends Controller
     {
         $array = [];
         foreach ($targets as $name => $target) {
-            foreach (['basePath', 'baseUrl', 'js', 'css', 'depends'] as $prop) {
-                if (!empty($target->$prop)) {
-                    $array[$name][$prop] = $target->$prop;
-                } elseif (in_array($prop, ['js', 'css'])) {
-                    $array[$name][$prop] = [];
-                }
+            if (isset($this->targets[$name])) {
+                $array[$name] = [
+                    'class' => get_class($target),
+                    'basePath' => $this->targets[$name]['basePath'],
+                    'baseUrl' => $this->targets[$name]['baseUrl'],
+                    'js' => $target->js,
+                    'css' => $target->css,
+                ];
+            } else {
+                $array[$name] = [
+                    'sourcePath' => null,
+                    'js' => [],
+                    'css' => [],
+                    'depends' => $target->depends,
+                ];
             }
         }
         $array = VarDumper::export($array);
@@ -588,8 +599,9 @@ EOD;
  */
 
 // In the console environment, some path aliases may not exist. Please define these:
-//Yii::setAlias('@webroot', realpath(__DIR__ . '/../web'));
-//Yii::setAlias('@web', '/');
+// Yii::setAlias('@webroot', __DIR__ . '/../web');
+// Yii::setAlias('@web', '/');
+
 return [
     // Adjust command/callback for JavaScript files compressing:
     'jsCompressor' => {$jsCompressor},
@@ -597,22 +609,22 @@ return [
     'cssCompressor' => {$cssCompressor},
     // The list of asset bundles to compress:
     'bundles' => [
+        // 'app\assets\AppAsset',
         // 'yii\web\YiiAsset',
         // 'yii\web\JqueryAsset',
     ],
     // Asset bundle for compression output:
     'targets' => [
-        'app\assets\AllAsset' => [
-            'basePath' => 'path/to/web',
-            'baseUrl' => '',
+        'all' => [
+            'class' => 'yii\web\AssetBundle',
+            'basePath' => '@webroot/assets',
+            'baseUrl' => '@web/assets',
             'js' => 'js/all-{hash}.js',
             'css' => 'css/all-{hash}.css',
         ],
     ],
     // Asset manager configuration:
     'assetManager' => [
-        'basePath' => __DIR__,
-        'baseUrl' => '',
     ],
 ];
 EOD;

framework/web/View.php

@@ -380,7 +380,7 @@ class View extends \yii\base\View
         } else {
             $this->getAssetManager()->bundles[$key] = new AssetBundle([
                 'baseUrl' => '',
-                'css' => [ltrim($url, '/')],
+                'css' => [strncmp($url, '//', 2) === 0 ? $url : ltrim($url, '/')],
                 'cssOptions' => $options,
                 'depends' => (array) $depends,
             ]);
@@ -445,7 +445,7 @@ class View extends \yii\base\View
         } else {
             $this->getAssetManager()->bundles[$key] = new AssetBundle([
                 'baseUrl' => '',
-                'js' => [ltrim($url, '/')],
+                'js' => [strncmp($url, '//', 2) === 0 ? $url : ltrim($url, '/')],
                 'jsOptions' => $options,
                 'depends' => (array) $depends,
             ]);