Fixed #36465, Refs #35816 -- Disallowed '+' and '-' characters in template variable names.

Regression in 5183f7c287a9a5d61ca1103b55166cda52d9c647.

Thank you to Jon Banafato and Baptiste Mispelon for the report.

1 files changed, 7 insertions, 0 deletions

diff --git a/django/template/base.py b/django/template/base.py
index 140f713add..121a47d638 100644
--- a/django/template/base.py
+++ b/django/template/base.py
@@ -852,6 +852,13 @@ class Variable:
                         "Variables and attributes may "
                         "not begin with underscores: '%s'" % var
                     )
+                # Disallow characters that are allowed in numbers but not in a
+                # variable name.
+                for c in ["+", "-"]:
+                    if c in var:
+                        raise TemplateSyntaxError(
+                            "Invalid character ('%s') in variable name: '%s'" % (c, var)
+                        )
                 self.lookups = tuple(var.split(VARIABLE_ATTRIBUTE_SEPARATOR))
 
     def resolve(self, context):