Merge branch '5.x' into 6.x

# Conflicts:
#	CHANGELOG.md

Author: jasonvarga

composer.json

@@ -115,7 +115,8 @@
     "autoload-dev": {
         "psr-4": {
             "Tests\\": "tests",
-            "Foo\\Bar\\": "tests/Fixtures/Addon"
+            "Foo\\Bar\\": "tests/Fixtures/Addon",
+            "App\\": "tests/Fixtures/App/"
         }
     }
 }

src/Providers/ViewServiceProvider.php

@@ -2,6 +2,7 @@
 
 namespace Statamic\Providers;
 
+use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\View as ViewFactory;
 use Illuminate\Support\ServiceProvider;
@@ -107,71 +108,135 @@ private function registerAntlers()
                 'trans:*',
                 'trans_choice:*',
                 'widont:*',
+                ...$this->getAppTagPatternsForContentAllowlist($app),
             ]);
+
             $runtimeConfig->allowedContentModifiers = config('statamic.antlers.allowedContentModifiers', [
                 'add_query_param',
                 'add_slashes',
+                'alias',
+                'ampersand_list',
                 'ascii',
                 'at',
+                'backspace',
                 'background_position',
                 'bool_string',
                 'camelize',
                 'cdata',
                 'ceil',
+                'chunk',
+                'classes',
+                'collapse',
                 'collapse_whitespace',
+                'contains_any',
+                'count',
                 'count_substring',
                 'dashify',
+                'days_ago',
                 'decode',
                 'deslugify',
+                'diff_for_humans',
                 'divide',
+                'dl',
+                'embed_url',
                 'ends_with',
                 'ensure_left',
                 'ensure_right',
                 'entities',
+                'excerpt',
                 'explode',
                 'extension',
+                'favicon',
+                'filter_empty',
+                'first',
+                'flatten',
+                'flip',
                 'floor',
                 'format',
                 'format_number',
                 'format_translated',
+                'full_urls',
                 'has_lower_case',
                 'has_upper_case',
                 'headline',
                 'hex_to_rgb',
+                'hours_ago',
                 'insert',
                 'is_alpha',
                 'is_alphanumeric',
+                'is_array',
                 'is_blank',
                 'is_email',
+                'is_embeddable',
+                'is_empty',
                 'is_external_url',
+                'is_future',
+                'is_iterable',
                 'is_json',
+                'is_leap_year',
                 'is_lowercase',
                 'is_numeric',
+                'is_past',
+                'is_today',
+                'is_tomorrow',
                 'is_uppercase',
                 'is_url',
+                'is_weekday',
+                'is_weekend',
+                'is_yesterday',
+                'iso_format',
                 'join',
+                'key_by',
+                'keys',
                 'kebab',
+                'last',
                 'lcfirst',
+                'length',
+                'limit',
                 'localize',
-                'upper',
                 'lower',
+                'markdown',
                 'md5',
+                'minutes_ago',
                 'mod',
+                'modify_date',
+                'months_ago',
                 'multiply',
+                'nl2br',
                 'obfuscate',
                 'obfuscate_email',
+                'offset',
+                'ol',
+                'option_list',
                 'parse_url',
                 'pathinfo',
+                'pluck',
+                'random',
                 'rawurlencode',
+                'read_time',
+                'relative',
                 'remove_left',
                 'remove_query_param',
                 'remove_right',
                 'replace',
+                'resolve',
+                'reverse',
                 'round',
                 'safe_truncate',
                 'sanitize',
+                'scope',
+                'seconds_ago',
+                'select',
+                'sentence_list',
+                'set_query_param',
+                'shuffle',
+                'singular',
                 'slugify',
+                'smartypants',
                 'snake',
+                'sort',
+                'spaceless',
+                'split',
                 'starts_with',
                 'str_pad',
                 'str_pad_both',
@@ -182,18 +247,38 @@ private function registerAntlers()
                 'subtract',
                 'substr',
                 'sum',
+                'surround',
                 'swap_case',
+                'table',
+                'tidy',
+                'timestamp',
+                'timezone',
                 'title',
                 'to_bool',
+                'to_qs',
+                'to_spaces',
+                'to_tabs',
                 'to_string',
                 'trans',
                 'trans_choice',
+                'trackable_embed_url',
                 'trim',
                 'truncate',
+                'type_of',
                 'ucfirst',
+                'underscored',
+                'unique',
+                'upper',
                 'urldecode',
                 'urlencode',
+                'values',
+                'weeks_ago',
+                'where',
+                'where_in',
                 'widont',
+                'word_count',
+                'years_ago',
+                ...$this->getAppModifierHandlesForContentAllowlist($app),
             ]);
             $runtimeConfig->allowPhpInUserContent = config('statamic.antlers.allowPhpInContent', false);
             $runtimeConfig->allowMethodsInUserContent = config('statamic.antlers.allowMethodsInContent', false);
@@ -250,6 +335,29 @@ private function registerAntlers()
         });
     }
 
+    private function getAppTagPatternsForContentAllowlist(Application $app): array
+    {
+        $namespace = $app->getNamespace().'Tags\\';
+
+        return collect($app->make('statamic.tags'))
+            ->filter(fn ($binding) => is_string($binding) && str_starts_with($binding, $namespace))
+            ->keys()
+            ->flatMap(fn ($handle) => [$handle, $handle.':*'])
+            ->values()
+            ->all();
+    }
+
+    private function getAppModifierHandlesForContentAllowlist(Application $app): array
+    {
+        $namespace = $app->getNamespace().'Modifiers\\';
+
+        return collect($app->make('statamic.modifiers'))
+            ->filter(fn ($binding) => is_string($binding) && str_starts_with($binding, $namespace))
+            ->keys()
+            ->values()
+            ->all();
+    }
+
     public function registerBladeDirectives()
     {
         Blade::directive('tags', function ($expression) {

tests/Antlers/Runtime/ContentAllowListTest.php

@@ -3,6 +3,7 @@
 namespace Tests\Antlers\Runtime;
 
 use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Antlers;
 use Statamic\Fields\Field;
 use Statamic\Fields\Value;
 use Statamic\Fieldtypes\Text;
@@ -179,6 +180,26 @@ public function allow_list_does_not_affect_tag_usage_in_trusted_templates()
         $this->assertSame('tag-ok', $result);
     }
 
+    #[Test]
+    public function app_tags_from_app_directory_are_included_in_default_allowed_content_tags()
+    {
+        \App\Tags\AppTestTag::register();
+
+        $result = (string) Antlers::parse('{{ app_test_tag }}', [], false);
+
+        $this->assertSame('app-tag-ok', $result, 'Tags in App\Tags should be auto-allowed in user content when using default config.');
+    }
+
+    #[Test]
+    public function app_modifiers_from_app_directory_are_included_in_default_allowed_content_modifiers()
+    {
+        \App\Modifiers\AppTestModifier::register();
+
+        $result = (string) Antlers::parse('{{ value | app_test_modifier }}', ['value' => 'hello'], false);
+
+        $this->assertSame('HELLO-app-modifier', $result, 'Modifiers in App\Modifiers should be auto-allowed in user content when using default config.');
+    }
+
     private function makeAntlersTextValue(string $template): Value
     {
         $textFieldtype = new Text();

tests/Fixtures/App/Modifiers/AppTestModifier.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Modifiers;
+
+use Statamic\Modifiers\Modifier;
+
+class AppTestModifier extends Modifier
+{
+    protected static $handle = 'app_test_modifier';
+
+    public function index($value, $params, $context)
+    {
+        return strtoupper((string) $value).'-app-modifier';
+    }
+}

tests/Fixtures/App/Tags/AppTestTag.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Tags;
+
+use Statamic\Tags\Tags;
+
+class AppTestTag extends Tags
+{
+    protected static $handle = 'app_test_tag';
+
+    public function index()
+    {
+        return 'app-tag-ok';
+    }
+}