symfony
diff --git a/‎src/Symfony/Component/Templating/PhpEngine.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Templating/PhpEngine.php
+26-11Lines changed: 26 additions & 11 deletions b/‎src/Symfony/Component/Templating/PhpEngine.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Templating/PhpEngine.php
+26-11Lines changed: 26 additions & 11 deletions
diff --git a/‎src/Symfony/Component/Templating/Tests/PhpEngineTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Templating/Tests/PhpEngineTest.php
+26Lines changed: 26 additions & 0 deletions b/‎src/Symfony/Component/Templating/Tests/PhpEngineTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Templating/Tests/PhpEngineTest.php
+26Lines changed: 26 additions & 0 deletions
@@ -42,6 +42,9 @@ class PhpEngine implements EngineInterface, \ArrayAccess
     protected $globals;
     protected $parser;
 
+    private $evalTemplate;
+    private $evalParameters;
+
     /**
      * Constructor.
      *
@@ -156,24 +159,36 @@ public function supports($name)
      */
     protected function evaluate(Storage $template, array $parameters = array())
     {
-        $__template__ = $template;
+        $this->evalTemplate = $template;
+        $this->evalParameters = $parameters;
+        unset($template, $parameters);
 
-        if (isset($parameters['__template__'])) {
-            throw new \InvalidArgumentException('Invalid parameter (__template__)');
+        if (isset($this->evalParameters['this'])) {
+            throw new \InvalidArgumentException('Invalid parameter (this)');
+        }
+        if (isset($this->evalParameters['view'])) {
+            throw new \InvalidArgumentException('Invalid parameter (view)');
         }
 
-        if ($__template__ instanceof FileStorage) {
-            extract($parameters, EXTR_SKIP);
-            $view = $this;
+        $view = $this;
+        if ($this->evalTemplate instanceof FileStorage) {
+            extract($this->evalParameters, EXTR_SKIP);
+            $this->evalParameters = null;
+
             ob_start();
-            require $__template__;
+            require $this->evalTemplate;
+
+            $this->evalTemplate = null;
 
             return ob_get_clean();
-        } elseif ($__template__ instanceof StringStorage) {
-            extract($parameters, EXTR_SKIP);
-            $view = $this;
+        } elseif ($this->evalTemplate instanceof StringStorage) {
+            extract($this->evalParameters, EXTR_SKIP);
+            $this->evalParameters = null;
+
             ob_start();
-            eval('; ?>'.$__template__.'<?php ;');
+            eval('; ?>'.$this->evalTemplate.'<?php ;');
+
+            $this->evalTemplate = null;
 
             return ob_get_clean();
         }
 
@@ -116,6 +116,32 @@ public function testExtendRender()
         $this->assertEquals('bar-foo-', $engine->render('foo.php', array('foo' => 'foo', 'bar' => 'bar')), '->render() supports render() calls in templates');
     }
 
+    public function testRenderParameter()
+    {
+        $engine = new ProjectTemplateEngine(new TemplateNameParser(), $this->loader);
+        $this->loader->setTemplate('foo.php', '<?php echo $template . $parameters ?>');
+        $this->assertEquals('foobar', $engine->render('foo.php', array('template' => 'foo', 'parameters' => 'bar')), '->render() extract variables');
+    }
+
+    /**
+     * @expectedException \InvalidArgumentException
+     * @dataProvider forbiddenParameterNames
+     */
+    public function testRenderForbiddenParameter($name)
+    {
+        $engine = new ProjectTemplateEngine(new TemplateNameParser(), $this->loader);
+        $this->loader->setTemplate('foo.php', 'bar');
+        $engine->render('foo.php', array($name => 'foo'));
+    }
+
+    public function forbiddenParameterNames()
+    {
+        return array(
+            array('this'),
+            array('view'),
+        );
+    }
+
     public function testEscape()
     {
         $engine = new ProjectTemplateEngine(new TemplateNameParser(), $this->loader);