Bitcoin
$security can be TRUE or FALSE,
defaults to FALSE. Security is good for
situations when you have untrusted parties editing the templates
eg via ftp, and you want to reduce the risk of system
security compromises through the template language. Turning on
security enforces the following rules to the template language,
unless specifially overridden with
$security_settings:
If
$php_handlingis set toSMARTY_PHP_ALLOW, this is implicitly changed toSMARTY_PHP_PASSTHRUPHP functions are not allowed in
{if}statements, except those specified in the$security_settingsTemplates can only be included from directories listed in the
$secure_dirarrayLocal files can only be fetched from directories listed in the
$secure_dirarray using{fetch}{php}{/php}tags are not allowedPHP functions are not allowed as modifiers, except those specified in the
$security_settings