Smarty Security Policy - Revision history

SarahK at 21:49, 26 January 2023

2023-01-26T21:49:38Z

Show changes

SarahK at 17:51, 4 May 2022

2022-05-04T17:51:28Z

Joshua at 16:51, 25 August 2021

2021-08-25T16:51:21Z

AlexN: /* Supported Policy Settings and Values */

2021-06-15T08:33:31Z

‎Supported Policy Settings and Values

David at 21:10, 19 May 2021

2021-05-19T21:10:40Z

SarahK at 23:09, 20 November 2020

2020-11-20T23:09:43Z

John: /* Supported Policy Settings and Values */

2020-09-08T14:29:45Z

‎Supported Policy Settings and Values

SarahK at 12:32, 4 August 2020

2020-08-04T12:32:17Z

Show changes

John at 13:55, 31 October 2016

2016-10-31T13:55:47Z

Lawrence: /* Using {include_php} Syntax */

2016-10-14T13:44:45Z

‎Using {include_php} Syntax

@@ Line 1: / Line 1: @@
-<div class="docs-alert-info"><i class="fa fa-question-circle"></i>This page describes a feature available in version 7.0 and above.</div>
+<div class="docs-alert-info"> We added this feature in WHMCS 7.0.</div>
-WHMCS 7.0 and later use Smarty Security Policies, a security-hardening measure. WHMCS uses a system policy for system wide use and a mail policy specifically for stored and dynamic email-based templates.
+In WHMCS 7.0 and later, WHMCS uses Smarty Security Policies, which are security hardening measures that protect the system.
-By default, WHMCS does not define any PHP functionality restrictions for the system policy (except to honor the preexisting <tt>php</tt> tag setting '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings > Security''', or '''Setup > General Settings > Security''' prior to WHMCS 8.0). All template files that use this policy are file-based (for example, system themes and order form templates) and require file-level access. Because of this, they are automatically implicitly trusted. Because custom system themes are much more likely to have additional PHP-oriented logic, any restrictions defined by WHMCS could result in website rendering issues. It is completely within your discretion to determine whether implicit trust at the file level is invalid. You may make any appropriate restrictions for this system policy.
+By default, WHMCS does not define any PHP functionality restrictions for the system policy other than honoring the preexisting <tt>php</tt> tag setting in the '''[[Security Tab|Security]]''' tab at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings''', or, prior to WHMCS 8.0, '''Setup > General Settings'''.
-The mail policy restricts what PHP functionality can be used in email-based templates. The default mail policy will limit the use of [http://www.smarty.net/docs/en/language.modifiers.tpl variable modifiers] to:
+The mail policy restricts the PHP functionality that email-based templates can use. The default mail policy will limit the use of [http://www.smarty.net/docs/en/language.modifiers.tpl variable modifiers] to:
 *<tt>escape</tt>
@@ Line 31: / Line 42: @@
 The default mail policy will not allow any calls to static classes, fetching any data from PHP streams, or accessing any super global variables.
-If you want to redefine either the system or mail policy, you can do this by adding a <tt>$smarty_security_policy</tt> setting to <tt>configuration.php</tt>. This example limits email templates (by modifying the mail policy) to <tt>ucwords</tt> as the only native PHP function allowed, while not changing the default restrictions on variable modifiers:
+If you want to redefine either the system or mail policies, add a <tt>$smarty_security_policy</tt> setting to the <tt>configuration.php</tt> file.
 <div class="source-cli">
@@ Line 45: / Line 60: @@
 </div>
-The example below would restrict the use of variable modifiers so that <tt>strpos</tt> was the only variable modifier permitted in an email template without changing the default restrictions on PHP functions:
+The example below would restrict the use of variable modifiers to only permit the <tt>strpos</tt> variable modifier in an email template without changing the default restrictions on PHP functions:
 <div class="source-cli">
@@ Line 58: / Line 73: @@
 </div>
-===Using {include_php} Syntax===
+== Using {include_php} Syntax ==
-Smarty has deprecated the <tt>{include_php}</tt> syntax, but WHMCS currently supports this behavior via Policies. If your template file invokes and includes a PHP script by using the Smarty <tt>{include_php}</tt> syntax, the full path to the directory containing that script will need to be whitelisted in the <tt>trusted_dir</tt> setting of your Policy.
+Smarty has deprecated the <tt>{include_php}</tt> syntax, but WHMCS currently supports this behavior in policies. If your template file invokes and includes a PHP script by using the Smarty <tt>{include_php}</tt> syntax, you must whitelist the full path to the script's directory in the <tt>trusted_dir</tt> setting for your policy.
 <div class="source-cli">
@@ Line 73: / Line 88: @@
 </div>
-See the [http://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security/ Smarty documentation] for all possible settings and what behavior to expect when assigning array and Boolean values.
+For a list of possible settings and their behavior with arrays and Boolean values, see [http://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security/ Smarty documentation].
 === Supported Policy Settings and Values ===
-The settings that a WHMCS Smarty Security Policy enforces are the same as those defined by the Smarty library itself. You can learn more about about these settings from [http://www.smarty.net/docs/en/advanced.features.tpl the Smarty documentation].
+The settings that a WHMCS Smarty Security Policy enforces are the same as the settings that the Smarty library itself defines. For more information, see [http://www.smarty.net/docs/en/advanced.features.tpl the Smarty documentation].
-In WHMCS version 8.0 and later, WHMCS doesn't honour Smarty's <tt>disabled_special_smarty_vars</tt> parameter. Instead, policies should use <tt>enabled_special_smarty_vars</tt>. This change in behaviour is an "only allow" paradigm to the most sensitive parts of the Smarty engine implementation. It establishes a stronger security posture at present and for any future engine implementations.
+In WHMCS version 8.0 and later, WHMCS doesn't honour Smarty's <tt>disabled_special_smarty_vars</tt> parameter. Instead, policies should use the <tt>enabled_special_smarty_vars</tt> parameter. This change in behaviour is an "only allow" paradigm to the most sensitive parts of the Smarty engine implementation. It establishes a stronger security posture at present and for any future engine implementations.
 <div class="source-cli">
@@ Line 91: / Line 106: @@
 <br/>];
 </div>
-<tt>enabled_special_smarty_vars</tt>'s value should be an array using [https://www.smarty.net/docs/en/language.variables.smarty.tpl these options].
-The follow are enabled in the WHMCS system policy for compatibility with older templates and may not be required for your current or future WHMCS templates.
+The <tt>enabled_special_smarty_vars</tt> value must be an array using [https://www.smarty.net/docs/en/language.variables.smarty.tpl Smarty's options].
 <div class="source-cli">
@@ Line 108: / Line 124: @@
 </div>
-<div class="docs-alert-info">Defining your own Smarty Security Policy requires you to include all variables used by client and admin templates, including the ones that WHMCS otherwise enables by default (as above).</div>
+<div class="docs-alert-info">

@@ Line 3: / Line 3: @@
 WHMCS 7.0 and later use Smarty Security Policies, a security-hardening measure. WHMCS uses a system policy for system wide use and a mail policy specifically for stored and dynamic email-based templates.
-By default, WHMCS does not define any PHP functionality restrictions for the system policy (except to honor the preexisting <tt>php</tt> tag setting '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > Security''', or '''Setup > Security''' prior to WHMCS 8.0). All template files that use this policy are file-based (for example, system themes and order form templates) and require file-level access. Because of this, they are automatically implicitly trusted. Because custom system themes are much more likely to have additional PHP-oriented logic, any restrictions defined by WHMCS could result in website rendering issues. It is completely within your discretion to determine whether implicit trust at the file level is invalid. You may make any appropriate restrictions for this system policy.
+By default, WHMCS does not define any PHP functionality restrictions for the system policy (except to honor the preexisting <tt>php</tt> tag setting '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings > Security''', or '''Setup > General Settings > Security''' prior to WHMCS 8.0). All template files that use this policy are file-based (for example, system themes and order form templates) and require file-level access. Because of this, they are automatically implicitly trusted. Because custom system themes are much more likely to have additional PHP-oriented logic, any restrictions defined by WHMCS could result in website rendering issues. It is completely within your discretion to determine whether implicit trust at the file level is invalid. You may make any appropriate restrictions for this system policy.
 The mail policy restricts what PHP functionality can be used in email-based templates. The default mail policy will limit the use of [http://www.smarty.net/docs/en/language.modifiers.tpl variable modifiers] to:

← Older revision		Revision as of 08:33, 15 June 2021
Line 107:		Line 107:
	<br/>'const',		<br/>'const',
	</div>		</div>
		+
		+	<div class="docs-alert-info">Defining your own Smarty Security Policy requires you to include all variables used by client and admin templates, including the ones that WHMCS otherwise enables by default (as above).</div>

@@ Line 36: / Line 36: @@
 <div class="source-cli">
 // Smarty custom email based template policy:
-<br/>$smarty_security_policy = array(
+<br/>$smarty_security_policy = [
-<br/>    'mail' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;'mail' => [
-<br/>        'php_functions' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'php_functions' => [
-<br/>            'ucwords',
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'ucwords',
-<br/>        ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>    ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>);
+<br/>];
 </div>
@@ Line 49: / Line 49: @@
 <div class="source-cli">
 // Smarty custom email based template policy:
-<br/>$smarty_security_policy = array(
+<br/>$smarty_security_policy = [
-<br/>    'mail' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;'mail' => [
-<br/>        'php_modifiers' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'php_modifiers' => [
-<br/>            'strpos',
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'strpos',
-<br/>        ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>    ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>);
+<br/>];
 </div>
@@ Line 64: / Line 64: @@
 <div class="source-cli">
 // Smarty custom email based template policy:
-<br/>$smarty_security_policy = array(
+<br/>$smarty_security_policy = [
-<br/>    'system' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;'system' => [
-<br/>        'trusted_dir' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'trusted_dir' => [
-<br/>            '/path/to/folder',
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'/path/to/folder',
-<br/>        ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>    ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>);
+<br/>];
 </div>
@@ Line 83: / Line 83: @@
 <div class="source-cli">
 // Smarty enable special variables policy:
-<br/>$smarty_security_policy = array(
+<br/>$smarty_security_policy = [
-<br/>        'system' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'system' => [
-<br/>            'enabled_special_smarty_vars' => array(
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'enabled_special_smarty_vars' => [
-<br/>                'cookies',
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'cookies',
-<br/>            ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>        ),
+<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
-<br/>);
+<br/>];
 </div>
 <tt>enabled_special_smarty_vars</tt>'s value should be an array using [https://www.smarty.net/docs/en/language.variables.smarty.tpl these options].

@@ Line 1: / Line 1: @@
-<div class="docs-alert-info"><i class="fa fa-question-circle"></i> This page describes a feature available in version 7.0 and above.</div>
+<div class="docs-alert-info"><i class="fa fa-question-circle"></i>This page describes a feature available in version 7.0 and above.</div>
-−
 WHMCS 7.0 and later use Smarty Security Policies, a security-hardening measure. WHMCS uses a system policy for system wide use and a mail policy specifically for stored and dynamic email-based templates.
-−
-By default, WHMCS does not define any PHP functionality restrictions for the system policy (except to honor the pre-existing <tt>php</tt> tag setting as configured at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > Security''', or '''Setup > Security''' prior to WHMCS 8.0).  All templates that use this policy are file-based (for example, themes and order forms) and require file-level access. Because of this, they are automatically implicitly trusted. Because custom themes are much more likely to have additional PHP-oriented logic, any restrictions defined by WHMCS could result in website rendering issues. It is completely within your discretion to determine whether implicit trust at the file level is invalid. You may make any appropriate restrictions for this system policy.
+By default, WHMCS does not define any PHP functionality restrictions for the system policy (except to honor the preexisting <tt>php</tt> tag setting '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > Security''', or '''Setup > Security''' prior to WHMCS 8.0). All template files that use this policy are file-based (for example, system themes and order form templates) and require file-level access. Because of this, they are automatically implicitly trusted. Because custom system themes are much more likely to have additional PHP-oriented logic, any restrictions defined by WHMCS could result in website rendering issues. It is completely within your discretion to determine whether implicit trust at the file level is invalid. You may make any appropriate restrictions for this system policy.
-−
 The mail policy restricts what PHP functionality can be used in email-based templates. The default mail policy will limit the use of [http://www.smarty.net/docs/en/language.modifiers.tpl variable modifiers] to:
-−
 *<tt>escape</tt>
 *<tt>count</tt>
@@ Line 12: / Line 12: @@
 *<tt>ucfirst</tt>
 *<tt>date_format</tt>
-−
 The default mail policy restricts the use of native PHP functions to:
-−
 *<tt>isset</tt>
 *<tt>empty</tt>
@@ Line 23: / Line 23: @@
 *<tt>time</tt>
 *<tt>nl2br</tt>
-−
 Finally, the default mail policy blocks these Smarty tags:
-−
 * <tt>block</tt>
 * <tt>function</tt>
 * <tt>include</tt>
-−
 The default mail policy will not allow any calls to static classes, fetching any data from PHP streams, or accessing any super global variables.
-−
 If you want to redefine either the system or mail policy, you can do this by adding a <tt>$smarty_security_policy</tt> setting to <tt>configuration.php</tt>. This example limits email templates (by modifying the mail policy) to <tt>ucwords</tt> as the only native PHP function allowed, while not changing the default restrictions on variable modifiers:
-−
 <div class="source-cli">
 // Smarty custom email based template policy:
@@ Line 44: / Line 44: @@
 <br/>);
 </div>
-−
 The example below would restrict the use of variable modifiers so that <tt>strpos</tt> was the only variable modifier permitted in an email template without changing the default restrictions on PHP functions:
-−
 <div class="source-cli">
 // Smarty custom email based template policy:
@@ Line 57: / Line 57: @@
 <br/>);
 </div>
-−
 ===Using {include_php} Syntax===
-−
-Smarty has deprecated the <tt>{include_php}</tt> syntax, but WHMCS currently supports this behavior via Policies. If your template invokes and includes a PHP script by using the Smarty <tt>{include_php}</tt> syntax, the full path to the directory containing that script will need to be whitelisted in the <tt>trusted_dir</tt> setting of your Policy.
+Smarty has deprecated the <tt>{include_php}</tt> syntax, but WHMCS currently supports this behavior via Policies. If your template file invokes and includes a PHP script by using the Smarty <tt>{include_php}</tt> syntax, the full path to the directory containing that script will need to be whitelisted in the <tt>trusted_dir</tt> setting of your Policy.
-−
 <div class="source-cli">
 // Smarty custom email based template policy:
@@ Line 72: / Line 72: @@
 <br/>);
 </div>
-−
 See the [http://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security/ Smarty documentation] for all possible settings and what behavior to expect when assigning array and Boolean values.
-−
 === Supported Policy Settings and Values ===
-−
 The settings that a WHMCS Smarty Security Policy enforces are the same as those defined by the Smarty library itself. You can learn more about about these settings from [http://www.smarty.net/docs/en/advanced.features.tpl the Smarty documentation].
 <div class="source-cli">
 // Smarty enable special variables policy:
@@ Line 89: / Line 89: @@
 <br/>            ),
 <br/>        ),
 <br/>);
 </div>
-−
 <tt>enabled_special_smarty_vars</tt>'s value should be an array using [https://www.smarty.net/docs/en/language.variables.smarty.tpl these options].

@@ Line 34: / Line 34: @@
 The default mail policy will not allow for the inclusion of any calls to static classes, fetching any data from php streams, or accessing any super global variables.
-If you want to redefine either the system or mail policy, you can do this by adding a $smarty_security_policy setting to your configuration.php. Here's an example that limits email templates (by modifying the mail policy) to 'ucwords' as the only native PHP function allowed, while not changing the default restrictions on variable modifiers:
+If you want to redefine either the system or mail policy, you can do this by adding a $smarty_security_policy setting to your configuration.php. Here's an example that limits email templates (by modifying the mail policy) to ''ucwords'' as the only native PHP function allowed, while not changing the default restrictions on variable modifiers:
 <source lang="php">
@@ Line 42: / Line 42: @@
          'php_functions' => array(
              'ucwords',
          ),
      ),