From 01f34781df5474e4feebff6a1afccc2303316c9f Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Wed, 19 Mar 2025 00:42:01 +0900
Subject: [PATCH] Don't parse template v1 syntax (single braces) in CSS/JS
 context

---
 common/framework/parsers/template/TemplateParser_v2.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/common/framework/parsers/template/TemplateParser_v2.php b/common/framework/parsers/template/TemplateParser_v2.php
index 926c3e0f4..be9d4088c 100644
--- a/common/framework/parsers/template/TemplateParser_v2.php
+++ b/common/framework/parsers/template/TemplateParser_v2.php
@@ -822,6 +822,13 @@ class TemplateParser_v2
 			return $this->_arrangeOutputFilters($match);
 		}, $content);
 
+		// Exclude {single} curly braces in non-HTML contexts.
+		$content = preg_replace_callback('#(<\?php \$this->config->context = \'(?:CSS|JS)\'; \?>)(.*?)(<\?php \$this->config->context = \'HTML\'; \?>)#s', function($match) {
+			$warning = '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>';
+			$match[2] = preg_replace('#(?<!\{)\{(?!\s)([^{}]+?)\}#', '&#x1B;&#x7B;' . $warning . '$1&#x1B;&#x7D;', $match[2]);
+			return $match[1] . $match[2] . $match[3];
+		}, $content);
+
 		// Convert {single} curly braces.
 		$content = preg_replace_callback('#(?<!\{)\{(?!\s)([^{}]+?)\}#', [$this, '_arrangeOutputFilters'], $content);