[SmartySettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [SmartySettings] of settings/smarty.ini.
File
settings/smarty.ini; override it in settings/override/smarty.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| LibraryPath | (empty) | Where Smarty 5 is, when it is not installed with Composer (smarty/smarty ^5) in the installation's vendor/: the directory that holds src/Smarty.php, relative to the installation root or absolute. Empty: Composer's autoload only. |
| CompileCheck | enabled | enabled: Smarty recompiles a .stpl when it changed. disabled: never checks (production; clear the template cache after a template change). |
| Debugging | disabled | enabled: Smarty's debug console. |
| FunctionList[] | attribute_view_gui; attribute_edit_gui; attribute_result_gui; attribute_pdf_gui; node_view_gui; content_view_gui; content_version_view_gui; class_attribute_view_gui; class_attribute_edit_gui; related_view_gui; shop_account_view_gui | Exponential template functions callable as Smarty tags with named parameters, e.g. {attribute_view_gui attribute=$node.data_map.body} |
| ParameterOperatorList[] | (empty array) | Template operators that always take their arguments as parameters and never read the value they are applied to, for operators without template hints (the bridge cannot see that from the operator). With it, {myop('a', 'b')} calls the operator with the parameters 'a' and 'b', as myop( 'a', 'b' ) does in a .tpl; without it, 'a' would be its input. The kernel's own (ezhttp, ezhttp_hasvariable, has_role, topmenu ...) are built in. Read once per process: a change needs a deploy (a restart of the PHP workers). |
| Security | enabled | Smarty security policy for .stpl templates: enabled or disabled. Enabled, a template is compiled with the lists below and refused at compile time when it uses something they do not allow. A template compiled with the policy is kept apart from one compiled without it (<cache dir>/smarty/compile-secure). See doc/eng-us/guides/smarty-templates-security.md. |
| SecurityAllowedTagList[] | if; elseif; else; foreach; foreachelse; for; forelse; while; section; sectionelse; break; continue; capture; ldelim; rdelim; nocache; block; extends; include; function; append; setfilter; counter; cycle; textformat; mailto; html_checkboxes; html_options; html_radios; html_select_date; html_select_time; html_table | Smarty's own tags a template may use; empty: all of them except SecurityDisabledTagList. The tags of Exponential's template functions ({attribute_view_gui}, {expinclude}, {expcacheblock} ...) and the functions a template defines with {function} are always allowed unless they are disabled below. A closing tag ({/if}) follows its opening tag. |
| SecurityDisabledTagList[] | eval; fetch; math; debug; config_load; html_image | Tags never allowed, Smarty's or Exponential's: {eval} (runs a string as a template), {fetch} (reads a file or a URL), {math} (evaluates an expression), {debug} (shows every variable), {config_load} (reads configuration files), {html_image} (reads image files). |
| SecurityAllowedModifierList[] | (empty array) | Smarty's own modifiers a template may use; empty: all of them except SecurityDisabledModifierList. Exponential's operators ({$text|wash}, {concat($a, $b)}, {fetch('content', 'node', ...)}) are always allowed unless they are disabled below. |
| SecurityDisabledModifierList[] | debug_print_var | Modifiers never allowed, Smarty's or Exponential's operators. |
| SecurityDisabledSpecialVariableList[] | get; post; cookies; session; server; env; request; const; template_object | $smarty.<name> special variables a template may not read: the request and the environment ($smarty.get, .post, .cookies, .session, .server, .env, .request), PHP constants ($smarty.const) and the template object ($smarty.template_object, which reaches the Smarty instance and its settings). |
| SecurityConstants | disabled | PHP constants in templates ({if $x == E_ALL}, {$smarty.const.X}): enabled or disabled. |
| SecurityStaticClassList[] | (empty array) | Classes whose static methods and properties a template may use ({Foo::bar()}); empty: none. |
| SecurityStreamList[] | (empty array) | Stream wrappers a template may be loaded from ({include file='php://...'}); empty: none. Template files themselves are no stream. |
| SecurityObjectAccess | disabled | Methods and properties of objects ({$node->expSmartyObject()->remove()}): enabled or disabled. Disabled, a template that uses -> in a tag is refused; templates read attributes as $node.name, which stays allowed. |
| SecurityTrustedDirList[] | (empty array) | Directories, besides the template directories of the design bases, that templates may be loaded from ({include file=...}, {exp_smarty_render( '<file>' )}), relative to the installation root or absolute. |
See also
Generated example: smarty.ini [SmartySettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/smarty.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment