* htmlentities on matches/gettext

 * recursively resolve all includes

Data/template.class.php

@@ -38,17 +38,19 @@
 						}, $output);
 					},
 					'include'=>function(&$output, &$ignored = null){
-						$output = preg_replace_callback(static::$regex['include'], function($matches) use(&$ignored){
+						while(preg_match(static::$regex['include'], $output)){
-							$path = static::$basedir.'/'.$matches[1];
+							$output = preg_replace_callback(static::$regex['include'], function($matches) use(&$ignored){
-							if(file_exists($path)){
+								$path = static::$basedir.'/'.$matches[1];
-								$output = file_get_contents($path);
+								if(file_exists($path)){
-								if(!is_null($ignored)){
+									$output = file_get_contents($path);
-									static::$parsers['ignore']($output, $ignored);
+									if(!is_null($ignored)){
+										static::$parsers['ignore']($output, $ignored);
+									}
+									return $output;
 								}
-								return $output;
+								return '';
-							}
+							}, $output);
-							return '';
+						}
-						}, $output);
 					},
 					'each'=>[
 						function(&$output, $data){
@@ -123,13 +125,13 @@
 										return $data[$item] ?? '';
 									}
 								}, array_slice($matches, 1));
-								return _(sprintf(...$args));
+								return htmlentities(_(sprintf(...$args)));
 							}, $output);
 						},
 						function(&$output){
 							$output = preg_replace_callback(static::$regex['gettext'], function($matches){
 								if(count($matches) > 2){
-									$output = "<?= sprintf(_({$matches[1]})";
+									$output = "<?=htmlentities(sprintf(_({$matches[1]})";
 									foreach(array_slice($matches, 2) as $item){
 										if(preg_match(static::$regex['gettext_string'], $item)){
 											$output .= ", $item";
@@ -138,9 +140,9 @@
 										}
 									}
 								}else{
-									$output = "<?= _({$matches[1]}";
+									$output = "<?=htmlentities(_({$matches[1]}";
 								}
-								return "{$output}); ?>";
+								return "{$output})); ?>";
 							}, $output);
 						}
 					],
@@ -175,12 +177,12 @@
 					'match'=>[
 						function(&$output, $data){
 							$output = preg_replace_callback(static::$regex['match'], function($matches) use($data){
-								return $data[$matches[1]] ?? '';
+								return htmlentities($data[$matches[1]] ?? '');
 							}, $output);
 						},
 						function(&$output){
 							$output = preg_replace_callback(static::$regex['match'], function($matches){
-								return "<?=(\$data[".var_export($matches[1], true)."] ?? ''); ?>";
+								return "<?=htmlentities(\$data[".var_export($matches[1], true)."] ?? ''); ?>";
 							}, $output);
 						}
 					],
@@ -190,7 +192,7 @@
 						},
 						function(&$output){
 							$output = preg_replace_callback(static::$regex['parentmatch'], function($matches){
-								return "<?=(\$parent[count(\$parent)-1][".var_export($matches[1], true)."] ?? ''); ?>";
+								return "<?=htmlentities(\$parent[count(\$parent)-1][".var_export($matches[1], true)."] ?? ''); ?>";
 							}, $output);
 						}
 					],