You recommend dropping the constant DIRECTORY_SEPARATOR and always use a forward slash. The code will be easier to read and the library will work on any system, including Windows. It currently fails on Windows because it tried to remove compiled template files without escaping the backslash, thus not forming correct paths.

P.S. The quick start guide is outdated. It took me a while to find out "new Box\Brainy\Brainy()".

It would be really darn cool if the ternary operator was a thing.

Right now:

{if $condition} 
    {$var = $true_option}   
{else}  
    {$var = $false_option}  
{/if}

Super premium: {$var = $condition ? $true_option : $false_option}

The flags parameter of preg_match no longer accepts null and instead defaults to 0. Changing this eliminates the deprecation warnings raised by the use of preg_match in the lexer, which eliminates many hundreds of noisy messages when running the tests (and probably improves runtime performance in newer versions of PHP).

Edit: I've also updated this PR to eliminate deprecation warnings related to strftime() usage in html_select_date. strftime is deprecated in favor of date. The current use for strftime is to translate a configurable date format for both the value and the label of a select box (that is, the content and value="" attribute of the generated <option> tags). My change preserves all possible strftime month formatting values, though it does create a minor backwards-incompatible change where someone who may have been abusing the month_format or month_value_format arguments to render non-month dates (e.g., rendering the current year for the value) would start seeing exceptions. This is pretty unlikely, since the rendered output doesn't make a whole lot of sense.

When bumping versions after this PR, there should be a minor version bump, not just a patch version.

{for $i=0 to $foo.bar.baz-1} {for $i=0 to count($foo)-1} {for $i=0 to count($foo)-1 step 2} {for $i=1 to $foo} {for $i=count($foo)-1 to 0 step -1} {for $i=0 to 5 step 2}

r? @DavidSchnepper

This upgrades all of the dev dependencies, which are on old versions and I don't have confidence are doing the right thing in a modern PHP environment. A few notes:

1. Eliminating warnings and errors in a stock PHP environment requires adding class member annotations (specifically, $line on SmartyException). If a member is overridden in a child class, it must have the same signature as the ancestor. In new PHP versions, $line is typed int on Exception. This makes this version incompatible with PHP <7.4, which added support for typing for class members.
2. I'm noting that HHVM support is dropped, since I don't believe it is supported by Box anymore. I have not deleted the test harness for HHVM, just updated the README.
3. Upgrading PHPUnit requires adding some method signatures to tests, which requires PHP 7.3.
4. Modern PHPUnit dropped the PHPDoc annotations for expected exceptions, so I converted these to the imperative methods.
5. I've committed composer.lock, which was previously .gitignored. This should be committed for reproducible builds.
6. One test was removed, but I believe it was not actually testing anything. It did not make any assertions, and the description implied that it was testing an error case.

As of now, the full tests suite passes on my machine.

Regarding compatibility, the minimum PHP version for Brainy after this PR is 7.4. My previous PR necessitated a minor semver version bump, but this will require a major version bump (e.g., to Brainy 4.0.0).

It would be nice to have contributor permissions again. After all, I've got the most knowledge around how the code works and how it's used in practice.

This is for HHVM support. Currently it's in the root of the compiled file, which hh_client isn't happy about (because $_smarty_tpl is undefined when the template is inspected statically).

r? @DavidSchnepper

This PR fixes a codegen bug where the LHS of the sugared assignment syntax can contain function calls, which cannot be on the LHS of an assignment.

The fix involves making SafeLookupWrapper abstract and specializing it into four subclasses which have extra bookkeeping for the recursively unsafe versions of each base (that is, the unsafe version of the value being subscripted) in addition to the safe version of the value being subscripted and the member name in the subscript. This allows the LHS of an assignment to be unwrapped such that the entirely unsafe version is assigned to.

This is necessary, because even lookup($tpl_vars, 'foo')['bar'] is invalid (that is, preserving safe lookups to the variable), because PHP returns arrays as value rather than references to those arrays.

This PR also fixes the parser generator, which was generating invalid PHP due to output being changed from null to 0 in new PHP versions. This can be tested with make parsers test.

r? @DavidSchnepper

This PR updates the modifier construct compiler to support functions that take arguments by reference when safe mode is active. The PRs incrementally refactor before adding the new behavior, and may be easier to review in-order rather than together.

The mechanism of this change is wrapping modifiers in self-executing closures. That is:

{$var|foo|array_pop}

previously compiled to the equivalent of

array_pop(foo($_smarty_tpl->lookup('var')))

In safe mode, it now compiles to

(function($p1) use ($_smarty_tpl) {
  return array_pop($p1);
})(
  (function($p1) use ($_smarty_tpl) {
    return foo($p1);
  })(
    \Box\Brainy\Runtime\Lookups::safeArrayLookup($_smarty_tpl, 'var')
  )
);

Self-executing closures take the arguments, which may be the result of non-variable lookups, and assign them to the parameter variables, which are always variables. This allows methods like array_pop to execute correctly when safe mode is enabled.

One notable backwards-incompatible change: compiler modifiers (that is, plugins that run at compile time) will always take precedence over plugins which execute at runtime. This only affects folks who have registered two modifiers (one compiler and one runtime) with the exact same name. In this case, previously only the runtime modifier would have been invoked. After this change, only the compiler modifier would be invoked. I suspect nobody has this problem, since why would you register two plugins with identical names. This would require a minor version bump.

Currently, the safe lookup operation is compiled as a param to Lookups::safeLookup(). Removing the param and having one method per safe lookup type would cut down on branches and make it easier for HHVM to warm up.

• [x] {assign}
• [x] {block}
• [x] {break}
• [x] {call}
• [x] {capture}
• [x] {continue}
• [x] {extends}
• [x] {function}
• [x] {for}
• [x] {forelse}
• [x] {foreach}
• [x] {foreachelse}
• [x] {if}
• [x] {elseif}
• [x] {else}
• [x] {include}
• [x] {ldelim}
• [x] {rdelim}
• [x] {literal}
• [x] {strip}
• [x] {while}
• Smarty variable
  • [x] $smarty.foreach
  • [x] $smarty.capture
  • [x] $smarty.now
  • [x] $smarty.template
  • [x] $smarty.version
  • [x] $smarty.ldelim
  • [x] $smarty.rdelim

Please update this issue with more.

Must-haves:

• Delete the html_* plugins for good, because they're scary
• Delete the count_* plugins, because they're mostly unused
• Delete the strip_tags plugin, since it's most likely not safe
• Delete all plugins banned in strict mode
• Delete the following plugins, because they violate web best practices:
  • capitalize: Use text-transform in CSS instead.
  • truncate: Use overflow and text-overflow in CSS instead.
  • date_format: Does not support proper localization, out of scope of Brainy.
• Remove the make_timestamp and escape_special_chars shared plugins, as they're only depended on by the plugins being removed above.
• Remove $smarty->template, which is banned in strict mode.
• Remove syntax features banned by strict mode.
• Remove support for built-in functions with side effects that are banned in strict mode: reset(), current(), etc.
• Remove SmartyBC.
• Remove the inline param from {include}.
• {* set stricter *} that requires all included templates to be strict

Nice-to-haves:

• AST-based parser and compiler
• Make it impossible to {include} or fetch a file outside of one of the recognized template directories.
• Mode that reports which assigned variables were not accessed
  • API should be similar to fetchedTemplate() overridable method
  • Should be enabled with a static flag
  • May be possible to implement by making the scope array inside TemplateData be an object implementing PHP's ArrayAccess interface with zero overhead while mode is off (no new code branches)
• Make buildFilepath not be insane.

Stretch:

• 80% code coverage
• ~100% code coverage for bundled plugins
• Cut compilation times by 25%
• Reduce IO-related PHP calls (filemtime, getcwd, etc.) by 25%