Security is good for situations when you have untrusted parties editing the templates eg via ftp, and you want to reduce the risk of system security compromises through the template language.
The settings of the security policy are defined by properties of an instance of the Smarty_Security class. These are the possible settings:
-
$php_handlingdetermines how Smarty to handle PHP code embedded in templates. Possible values are:Smarty::PHP_PASSTHRU -> echo PHP tags as they are
Smarty::PHP_QUOTE -> escape tags as entities
Smarty::PHP_REMOVE -> remove php tags
Smarty::PHP_ALLOW -> execute php tags
The default value is Smarty::PHP_PASSTHRU.
If security is enabled the
$php_handlingsetting of the Smarty object is not checked for security. $secure_diris an array of template directories that are considered secure.$template_dirconcidered secure implicitly. The default is an empty array.$trusted_diris an array of all directories that are considered trusted. Trusted directories are where you keep php scripts that are executed directly from the templates with{include_php}. The default is an empty array.$static_classesis an array of classes that are considered trusted. The default is an empty array which allows access to all static classes. To disable access to all static classes set $static_classes = null.$php_functionsis an array of PHP functions that are considered trusted and can be used from within template. To disable access to all PHP functions set $php_functions = null. An empty array ( $php_functions = array() ) will allow all PHP functions. The default is array('isset', 'empty', 'count', 'sizeof', 'in_array', 'is_array','time','nl2br').$php_modifiersis an array of PHP functions that are considered trusted and can be used from within template as modifier. To disable access to all PHP modifier set $php_modifier = null. An empty array ( $php_modifier = array() ) will allow all PHP functions. The default is array('escape','count').$streamsis an array of streams that are considered trusted and can be used from within template. To disable access to all streams set $streams = null. An empty array ( $streams = array() ) will allow all streams. The default is array('file').$allow_constantsis a boolean flag which controls if constants can be accessed by the template. The default is "true".$allow_super_globalsis a boolean flag which controls if the PHP super globals can be accessed by the template. The default is "true".$allow_php_tagis a boolean flag which controls if {php} and {include_php} tags can be used by the template. The default is "false".
If security is enabled, no private methods, functions or properties of static classes or assigned objects can be accessed (beginningwith '_') by the template.
To customize the security policy settings you can extend the Smarty_Security class or create an instance of it.
Example 206. Setting security policy by extending the Smarty_Security class
<?php
require 'Smarty.class.php';
class My_Security_Policy extends Smarty_Security {
// disable all PHP functions
public $php_functions = null;
// remove PHP tags
public $php_handling = Smarty::PHP_REMOVE;
// allow everthing as modifier
public $modifiers = array();
}
$smarty = new Smarty();
// enable security
$smarty->enableSecurity('My_Security_Policy');
?>
Example 207. Setting security policy by instance of the Smarty_Security class
<?php
require 'Smarty.class.php';
$smarty = new Smarty();
$my_security_policy = new Smarty_Security($smarty);
// disable all PHP functions
$my_security_policy->php_functions = null;
// remove PHP tags
$my_security_policy->php_handling = Smarty::PHP_REMOVE;
// allow everthing as modifier
$my_security_policy->$modifiers = array();
// enable security
$smarty->enableSecurity($my_security_policy);
?>
Example 208. Enable security with the default settings
<?php
require 'Smarty.class.php';
$smarty = new Smarty();
// enable default security
$smarty->enableSecurity();
?>
Note
Must security policy settings are only checked when the template gets compiled. For that reasion you should delete all cached and compiled template files when you change your security settings.