[TikiWiki-commits] [Git][tikiwiki/tiki][29.x] [ENH] smarty security pref to whitelist some built-in PHP functions

Victor Emanouilov pushed to branch 29.x at Tiki Wiki CMS Groupware / Tiki


Commits:
b03ab044 by Victor Emanouilov at 2025-12-08T11:14:46+02:00
[ENH] smarty security pref to whitelist some built-in PHP functions
---
* [FIX] pipeline

* [ENH] smarty security pref to whitelist some built-in PHP functions to be used as modifiers/functions in templates

See merge request tikiwiki/tiki!9189

- - - - -


5 changed files:

- lib/core/Tiki/Smarty/SecurityPolicy.php
- lib/prefs/smarty.php
- lib/prefslib.php
- lib/smarty_tiki/Extension/SmartyTikiExtension.php
- templates/admin/include_security.tpl


Changes:

=====================================
lib/core/Tiki/Smarty/SecurityPolicy.php
=====================================
@@ -113,6 +113,16 @@ class SecurityPolicy extends \Smarty\Security
         $this->secure_dir = array_merge($this->secure_dir, $dirs);
     }
 
+    public function isTrustedModifier($modifier_name, $compiler)
+    {
+        $allowed_builtin_php_functions = array_filter(TikiLib::lib('tiki')->get_preference('smarty_security_allowed_builtin_php_functions', [], true));
+        if (in_array($modifier_name, $allowed_builtin_php_functions)) {
+            return true;
+        }
+
+        return parent::isTrustedModifier($modifier_name, $compiler);
+    }
+
     /**
      * Work around a bug in smarty where _updateResourceDir doesn't clear the values correctly when
      * smarty templateDir has been updated


=====================================
lib/prefs/smarty.php
=====================================
@@ -78,6 +78,19 @@ function prefs_smarty_list()
                 'smarty_security',
             ],
         ],
+        'smarty_security_allowed_builtin_php_functions' => [
+            'name' => tr('Allowed Smarty built-in PHP functions'),
+            'description' => tr("This is the list of allowed built-in PHP functions to be used as smarty modifiers. Smarty 5+ disabled the use of PHP functions as smarty modifiers. Use this preference to allow specific built-in functions not available in the currently exposed modifiers list that you need to use in your templates."),
+            'warning' => tr('There may be security implications. Make sure you know what you are doing. Try to keep this list as short as possible.'),
+            'hint' => tr('Use "," to separate values'),
+            'type' => 'text',
+            'separator' => ',',
+            'perspective' => false,
+            'default' => '',
+            'dependencies' => [
+                'smarty_security',
+            ],
+        ],
         'smarty_security_dirs' => [
             'name' => tr('Extra Smarty directories'),
             'description' => tr('Make additional directories available as Smarty directories. This may be needed for custom icons (clear temp/cache after changing).'),


=====================================
lib/prefslib.php
=====================================
@@ -11,6 +11,11 @@ class PreferencesLib
     private const DEFAULT_HIDDEN_PREFERENCES = [
         'feature_purifier',
         'smarty_security_dirs',
+        'smarty_security_allowed_tags',
+        'smarty_security_disabled_tags',
+        'smarty_security_allowed_modifiers',
+        'smarty_security_disabled_modifiers',
+        'smarty_security_allowed_builtin_php_functions',
         'tiki_allow_trust_input',
         'feature_create_webhelp',
         'scheduler_shell_command',


=====================================
lib/smarty_tiki/Extension/SmartyTikiExtension.php
=====================================
@@ -47,6 +47,13 @@ class SmartyTikiExtension extends \Smarty\Extension\Base
 
     public function getModifierCallback(string $modifierName)
     {
+        $allowed_builtin_php_functions = array_filter(TikiLib::lib('tiki')->get_preference('smarty_security_allowed_builtin_php_functions', [], true));
+        if (in_array($modifierName, $allowed_builtin_php_functions) && is_callable($modifierName)) {
+            return function (...$args) use ($modifierName) {
+                return call_user_func_array($modifierName, $args);
+            };
+        }
+
         switch ($modifierName) {
             case 'a_or_an':
                 return [new \SmartyTiki\Modifier\AorAn(), 'handle'];


=====================================
templates/admin/include_security.tpl
=====================================
@@ -59,6 +59,7 @@
                     {preference name=smarty_security_disabled_tags}
                     {preference name=smarty_security_allowed_modifiers}
                     {preference name=smarty_security_disabled_modifiers}
+                    {preference name=smarty_security_allowed_builtin_php_functions}
                     {preference name=smarty_security_dirs}
                 </div>
                 {preference name=feature_purifier}



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/b03ab0442f309df0fffdf02f93ac306b8ccb9650

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/b03ab0442f309df0fffdf02f93ac306b8ccb9650
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs