Fixes #5191: Sandbox was ignored for models and AR relations

extensions/twig/CHANGELOG.md

@@ -8,6 +8,7 @@ Yii Framework 2 twig extension Change Log
 - Bug #3767: Fixed repeated adding of extensions when using config. One may now pass extension instances as well (grachov)
 - Bug #3877: Fixed `lexerOptions` throwing exception (dapatrese)
 - Bug #4290: Fixed throwing exception when trying to access AR relation that is null (samdark, tenitski)
+- Bug #5191: Sandbox was ignored for models and AR relations (genichyar)
 - Enh #1799: Added `form_begin`, `form_end` to twig extension (samdark)
 - Enh #3674: Various enhancements (samdark)
     - Removed `FileLoader` and used `\Twig_Loader_Filesystem` instead.

extensions/twig/Template.php

@@ -20,10 +20,16 @@ abstract class Template extends \Twig_Template
     protected function getAttribute($object, $item, array $arguments = [], $type = \Twig_Template::ANY_CALL, $isDefinedTest = false, $ignoreStrictCheck = false)
     {
         // Twig uses isset() to check if attribute exists which does not work when attribute exists but is null
-        if ($object instanceof \yii\db\BaseActiveRecord) {
+        if ($object instanceof \yii\base\Model) {
             if ($type === \Twig_Template::METHOD_CALL) {
+                if ($this->env->hasExtension('sandbox')) {
+                    $this->env->getExtension('sandbox')->checkMethodAllowed($object, $item);
+                }
                 return $object->$item($arguments);
             } else {
+                if ($this->env->hasExtension('sandbox')) {
+                    $this->env->getExtension('sandbox')->checkPropertyAllowed($object, $item);
+                }
                 return $object->$item;
             }
         }