Added an "twig" lines mode, where the label lines are processed via a sandboxed twig.

src/Services/LabelSystem/LabelHTMLGenerator.php

@@ -22,24 +22,34 @@ namespace App\Services\LabelSystem;
 
 use App\Entity\Contracts\NamedElementInterface;
 use App\Entity\LabelSystem\LabelOptions;
+use App\Exceptions\TwigModeException;
 use App\Services\ElementTypeNameGenerator;
 use App\Services\LabelSystem\Barcodes\BarcodeContentGenerator;
+use Symfony\Component\Security\Core\Security;
 use Twig\Environment;
+use Twig\Error\Error;
+use Twig\Error\SyntaxError;
 
-class LabelHTMLGenerator
+final class LabelHTMLGenerator
 {
     protected $twig;
     protected $elementTypeNameGenerator;
     protected $replacer;
     protected $barcodeGenerator;
+    protected $sandboxedTwigProvider;
+    protected $partdb_title;
+    protected $security;
 
     public function __construct(ElementTypeNameGenerator $elementTypeNameGenerator, LabelTextReplacer $replacer, Environment $twig,
-        BarcodeGenerator $barcodeGenerator)
+        BarcodeGenerator $barcodeGenerator, SandboxedTwigProvider $sandboxedTwigProvider, Security $security, string $partdb_title)
     {
         $this->twig = $twig;
         $this->elementTypeNameGenerator = $elementTypeNameGenerator;
         $this->replacer = $replacer;
         $this->barcodeGenerator = $barcodeGenerator;
+        $this->sandboxedTwigProvider = $sandboxedTwigProvider;
+        $this->security = $security;
+        $this->partdb_title = $partdb_title;
     }
 
     public function getLabelHTML(LabelOptions $options, array $elements): string
@@ -49,15 +59,43 @@ class LabelHTMLGenerator
         }
 
         $twig_elements = [];
+
+        if ($options->getLinesMode() === 'twig') {
+            $sandboxed_twig = $this->sandboxedTwigProvider->getTwig($options);
+            $current_user = $this->security->getUser();
+        }
+
+        $page = 1;
         foreach ($elements as $element) {
+            if ($options->getLinesMode() === 'twig' && $sandboxed_twig !== null) {
+                try {
+                    $lines = $sandboxed_twig->render(
+                        'lines',
+                        [
+                            'element' => $element,
+                            'page' => $page,
+                            'user' => $current_user,
+                            'install_title' => $this->partdb_title,
+                        ]
+                    );
+                } catch (Error $exception) {
+                    throw new TwigModeException($exception);
+                }
+            } else {
+                $lines = $this->replacer->replace($options->getLines(), $element);
+            }
+
             $twig_elements[] = [
                 'element' => $element,
-                'lines' => $this->replacer->replace($options->getLines(), $element),
+                'lines' => $lines,
                 'barcode' => $this->barcodeGenerator->generateSVG($options, $element),
                 'barcode_content' => $this->barcodeGenerator->getContent($options, $element),
             ];
+
+            $page++;
         }
 
+
         return $this->twig->render('LabelSystem/labels/base_label.html.twig', [
             'meta_title' => $this->getPDFTitle($options, $elements[0]),
             'elements' => $twig_elements,
@@ -65,6 +103,7 @@ class LabelHTMLGenerator
         ]);
     }
 
+
     protected function getPDFTitle(LabelOptions $options, object $element)
     {
         if ($element instanceof NamedElementInterface) {

src/Services/LabelSystem/SandboxedTwigProvider.php

@@ -0,0 +1,140 @@
+<?php
+/**
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ * Copyright (C) 2019 - 2020 Jan Böhmer (https://github.com/jbtronics)
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+namespace App\Services\LabelSystem;
+
+
+use App\Entity\Attachments\Attachment;
+use App\Entity\Attachments\AttachmentContainingDBElement;
+use App\Entity\Base\AbstractCompany;
+use App\Entity\Base\AbstractDBElement;
+use App\Entity\Base\AbstractNamedDBElement;
+use App\Entity\Base\AbstractStructuralDBElement;
+use App\Entity\Contracts\NamedElementInterface;
+use App\Entity\Contracts\TimeStampableInterface;
+use App\Entity\LabelSystem\LabelOptions;
+use App\Entity\Parameters\AbstractParameter;
+use App\Entity\Parts\MeasurementUnit;
+use App\Entity\Parts\Part;
+use App\Entity\Parts\PartLot;
+use App\Entity\Parts\Storelocation;
+use App\Entity\Parts\Supplier;
+use App\Entity\PriceInformations\Currency;
+use App\Entity\PriceInformations\Orderdetail;
+use App\Entity\PriceInformations\Pricedetail;
+use App\Entity\UserSystem\User;
+use App\Twig\AppExtension;
+use App\Twig\Sandbox\InheritanceSecurityPolicy;
+use Twig\Environment;
+use Twig\Extension\SandboxExtension;
+use Twig\Extra\Intl\IntlExtension;
+use Twig\Sandbox\SecurityPolicy;
+use Twig\Sandbox\SecurityPolicyInterface;
+
+class SandboxedTwigProvider
+{
+    protected const ALLOWED_TAGS = ['apply', 'autoescape', 'do', 'for', 'if', 'set', 'verbatim', 'with'];
+    protected const ALLOWED_FILTERS = ['abs', 'batch', 'capitalize', 'column', 'country_name',
+        'currency_name', 'currency_symbol', 'date', 'date_modify', 'default', 'escape', 'filter', 'first', 'format',
+        'format_currency', 'format_date', 'format_datetime', 'format_number', 'format_time', 'join', 'keys',
+        'language_name', 'last', 'length', 'locale_name', 'lower', 'map', 'merge', 'nl2br', 'raw', 'number_format',
+        'reduce', 'replace', 'reverse', 'slice', 'sort', 'spaceless', 'split', 'striptags', 'timezone_name', 'title',
+        'trim', 'upper', 'url_encode',
+        //Part-DB specific filters:
+        'moneyFormat', 'siFormat', 'amountFormat'];
+
+    protected const ALLOWED_FUNCTIONS = ['date', 'html_classes', 'max', 'min', 'random', 'range'];
+
+    protected const ALLOWED_METHODS = [
+        NamedElementInterface::class => ['getName'],
+        AbstractDBElement::class => ['getID', '__toString'],
+        TimeStampableInterface::class => ['getLastModified', 'getAddedDate'],
+        AbstractStructuralDBElement::class => ['isChildOf', 'isRoot', 'getParent', 'getComment', 'getLevel',
+            'getFullPath', 'getPathArray', 'getChildren', 'isNotSelectable'],
+        AbstractCompany::class => ['getAddress', 'getPhoneNumber', 'getFaxNumber', 'getEmailAddress', 'getWebsite'],
+        AttachmentContainingDBElement::class => ['getAttachments', 'getMasterPictureAttachment'],
+        Attachment::class => ['isPicture', 'is3DModel', 'isExternal', 'isSecure', 'isBuiltIn', 'getExtension',
+            'getElement', 'getURL', 'getFilename', 'getAttachmentType', 'getShowInTable'],
+        AbstractParameter::class => ['getFormattedValue', 'getGroup', 'getSymbol', 'getValueMin', 'getValueMax',
+            'getValueTypical', 'getUnit', 'getValueText'],
+        MeasurementUnit::class => ['getUnit', 'isInteger', 'useSIPrefix'],
+        PartLot::class => ['isExpired', 'getDescription', 'getComment', 'getExpirationDate', 'getStorageLocation',
+            'getPart', 'isInstockUnknown', 'getAmount', 'getNeedsRefill'],
+        Storelocation::class => ['isFull', 'isOnlySinglePart', 'isLimitToExistingParts', 'getStorageType'],
+        Supplier::class => ['getShippingCosts', 'getDefaultCurrency'],
+        Part::class => ['isNeedsReview', 'getTags', 'getMass', 'getDescription', 'isFavorite', 'getCategory',
+            'getFootprint', 'getPartLots', 'getPartUnit', 'useFloatAmount', 'getMinAmount', 'getAmountSum',
+            'getManufacturerProductUrl', 'getCustomProductURL', 'getManufacturingStatus', 'getManufacturer',
+            'getManufacturerProductNumber', 'getOrderdetails', 'isObsolete'],
+        Currency::class => ['getIsoCode', 'getInverseExchangeRate', 'getExchangeRate'],
+        Orderdetail::class => ['getPart', 'getSupplier', 'getSupplierPartNr', 'getObsolete',
+            'getPricedetails', 'findPriceForQty', ],
+        Pricedetail::class => ['getOrderdetail', 'getPrice', 'getPricePerUnit', 'getPriceRelatedQuantity',
+            'getMinDiscountQuantity', 'getCurrency'],
+        //Only allow very little information about users...
+        User::class => ['isAnonymousUser', 'getUsername', 'getFullName', 'getFirstName', 'getLastName',
+            'getDepartment', 'getEmail']
+
+    ];
+    protected const ALLOWED_PROPERTIES = [];
+
+    private $appExtension;
+
+    public function __construct(AppExtension $appExtension)
+    {
+        $this->appExtension = $appExtension;
+    }
+
+    public function getTwig(LabelOptions $options): Environment
+    {
+        if ($options->getLinesMode() !== 'twig') {
+            throw new \InvalidArgumentException('The LabelOptions must explicitly allow twig via lines_mode = "twig"!');
+        }
+
+
+        $loader = new \Twig\Loader\ArrayLoader([
+                                                   'lines' => $options->getLines(),
+                                               ]);
+        $twig = new Environment($loader);
+
+        //Second argument activate sandbox globally.
+        $sandbox = new SandboxExtension($this->getSecurityPolicy(), true);
+        $twig->addExtension($sandbox);
+
+        //Add IntlExtension
+        $twig->addExtension(new IntlExtension());
+
+        //Add Part-DB specific extension
+        $twig->addExtension($this->appExtension);
+
+        return $twig;
+    }
+
+    protected function getSecurityPolicy(): SecurityPolicyInterface
+    {
+        return new InheritanceSecurityPolicy(
+            self::ALLOWED_TAGS,
+            self::ALLOWED_FILTERS,
+            self::ALLOWED_METHODS,
+            self::ALLOWED_PROPERTIES,
+            self::ALLOWED_FUNCTIONS
+        );
+    }
+}