<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
<title>SithTemplate: 08_security.php</title>
<link href="tabs.css" rel="stylesheet" type="text/css"/>
<link href="doxygen.css" rel="stylesheet" type="text/css"/>
</head>
<body>
<!-- Generated by Doxygen 1.7.2 -->
<div class="navigation" id="top">
<div class="tabs">
<ul class="tablist">
<li><a href="index.html"><span>Main Page</span></a></li>
<li><a href="pages.html"><span>Related Pages</span></a></li>
<li><a href="annotated.html"><span>Classes</span></a></li>
<li><a href="files.html"><span>Files</span></a></li>
<li><a href="examples.html"><span>Examples</span></a></li>
</ul>
</div>
</div>
<div class="header">
<div class="headertitle">
<h1>08_security.php</h1> </div>
</div>
<div class="contents">
<p>An example showing various security-related settings in SithTemplate.</p>
<div class="fragment"><pre class="fragment"><?php
require_once <span class="stringliteral">'SithTemplate.php'</span>;
$environ = <span class="keyword">new</span> <a name="_a0"></a><a class="code" href="class_template_environ.html" title="Template environment - library&#39;s end-user API.">TemplateEnviron</a>;
<span class="comment">// All security settings are set using environment's setting array.</span>
<span class="comment">// Some of them may be enforced at runtime, and some at compile time,</span>
<span class="comment">// see TemplateEnviron::$settings documentation for reference.</span>
<span class="comment">// The most common is variable autoescaping, which applies "escape" filter</span>
<span class="comment">// to all stand-alone variables (i.e. {{ vars }}), unless they are marked</span>
<span class="comment">// with "safe" pseudofilter.</span>
<span class="comment">// Autoescaping is turned on with "autoEscape" boolean setting.</span>
$environ->settings[<span class="stringliteral">'autoEscape'</span>] = <span class="keyword">true</span>;
$environ-><a name="a1"></a><a class="code" href="class_template_environ.html#a564c04dff7b3d6d026ae07adf64dc8b2" title="Render the template directly.">render</a>(<span class="stringliteral">'string://{{ var }}'</span>, array(<span class="stringliteral">'var'</span> => <span class="stringliteral">'<b>'</span>)); <span class="comment">// will return "&lt;b&gt;"</span>
$environ->render(<span class="stringliteral">'string://{{ var|safe }}'</span>, array(<span class="stringliteral">'var'</span> => <span class="stringliteral">'<b>'</span>)); <span class="comment">// will return "<b>"</span>
<span class="comment">// Next, there are I/O restriction settings. They allow you to enforce specific I/O driver,</span>
<span class="comment">// e.g. when you load template using your own db:// driver, and you don't want loaded template</span>
<span class="comment">// to use any other I/O driver, like file:// or string://.</span>
<span class="comment">// Note that this is a bit primitive, and may be replaced sometime in the future.</span>
<span class="comment">// I/O restrictions are turned on by "restrictIncludeIO" and "restrictExtendIO" boolean settings.</span>
$environ->settings[<span class="stringliteral">'restrictIncludeIO'</span>] = <span class="keyword">true</span>;
$environ->render(<span class="stringliteral">'string://{% include "string://test" %}'</span>, array()); <span class="comment">// will return "test"</span>
$environ->render(<span class="stringliteral">'string://{% include "file://test.html" %}'</span>, array()); <span class="comment">// will raise TemplateError</span>
<span class="comment">// Next, there are {{ internal }} access restrictions (again, a bit primitive and boolean only).</span>
<span class="comment">// Since {{ internal }} allows template to access global constants and superglobal arrays</span>
<span class="comment">// (like $_SERVER or $_ENV), it may introduce security risk in sandboxed environment</span>
<span class="comment">// (e.g. when templates are loaded from DB, and users can edit them).</span>
<span class="comment">// {{ internal }} restrictions can be set by turning off "allowInternalRequest"</span>
<span class="comment">// and/or "allowInternalConstants" boolean settings.</span>
<span class="comment">// Since this is boolean-only and a bit inconsistent, it may get replaced.</span>
$environ->render(<span class="stringliteral">'string://{{ internal.request.ENV.PATH.0 }}'</span>, array()); <span class="comment">// will return $_ENV['PATH'][0]</span>
$environ->settings[<span class="stringliteral">'allowInternalRequest'</span>] = <span class="keyword">false</span>;
$environ->render(<span class="stringliteral">'string://{{ internal.request.ENV.PATH.0 }}'</span>, array()); <span class="comment">// will raise TemplateError</span>
<span class="comment">// Finally, there are security lists, that allows you to handpick plugins, tags, filters and</span>
<span class="comment">// plain PHP functions that templates are allowed to use. Lists are the most complex of security</span>
<span class="comment">// settings, as they support multiple modes of evaluation (allow all, deny; allow, deny; deny, allow; deny all, allow),</span>
<span class="comment">// and wildcards (TemplateEnviron::SECURITY_MATCH_EVERYTHING).</span>
<span class="comment">// Evaluation mode is controlled by "securityEvalMode" enumerative setting, and lists themselves</span>
<span class="comment">// are stored in several array settings: "allowedPlugins", "allowedTags", "allowedFilters", "allowedFunctions"</span>
<span class="comment">// and their "disallowed*" counterparts.</span>
$environ->settings[<span class="stringliteral">'securityEvalMode'</span>] = <a name="a2"></a><a class="code" href="class_template_environ.html#ae3f379fc7bd67ba77f1ad1ad998db3eb" title="One of security modes - first disallow all, then check &#39;allowed&#39; list.">TemplateEnviron::SECURITY_DENY_ALL</a>; <span class="comment">// most restrictive setting</span>
$environ->settings[<span class="stringliteral">'allowedTags'</span>] = array(<span class="stringliteral">'block'</span>); <span class="comment">// you don't have to specify ending tags</span>
$environ->render(<span class="stringliteral">'string://{% block foo %}foo{% endblock %}'</span>, array()); <span class="comment">// will return "foo"</span>
$environ->render(<span class="stringliteral">'string://{% comment %}foo{% endcomment %}'</span>, array()); <span class="comment">// will raise TemplateError</span>
</pre></div> </div>
</div>
<hr class="footer"/><address class="footer"><small>Generated on Fri Jan 14 2011 20:08:36 for SithTemplate by 
<a href="http://www.doxygen.org/index.html">
<img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.7.2 </small></address>
</body>
</html>