symfony/symfony — pull request #3067 by inanimatt (2012-01-09 11:24:56+00:00)
Title: Protect template filename variable from overwriting

When used standalone, the PHP templating component could be passed a `__template__` parameter which may load and execute an arbitrary file.

The `extract()` calls have been modified to prevent overwriting the local scope of the `evaluate()` method, and an exception is thrown if a `__template__` key is found in the `$parameters` array.