Backport fixes from 2.0

octobercms · May 29, 2021 · 167b592 · 167b592
1 parent baa41ac
commit 167b592
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/modules/cms/controllers/Themes.php b/modules/cms/controllers/Themes.php
@@ -265,6 +265,10 @@ protected function makeExportFormWidget($theme)
 
     public function index_onLoadImportForm()
     {
+        if (\Cms\Helpers\Cms::safeModeEnabled()) {
+            throw new ApplicationException(trans('cms::lang.cms_object.safe_mode_enabled'));
+        }
+
         $theme = $this->findThemeObject();
         $this->vars['widget'] = $this->makeImportFormWidget($theme);
         $this->vars['themeDir'] = $theme->getDirName();
@@ -274,6 +278,10 @@ public function index_onLoadImportForm()
 
     public function index_onImport()
     {
+        if (\Cms\Helpers\Cms::safeModeEnabled()) {
+            throw new ApplicationException(trans('cms::lang.cms_object.safe_mode_enabled'));
+        }
+
         $theme = $this->findThemeObject();
         $widget = $this->makeImportFormWidget($theme);
 

diff --git a/modules/system/twig/SecurityPolicy.php b/modules/system/twig/SecurityPolicy.php
@@ -18,18 +18,22 @@ final class SecurityPolicy implements SecurityPolicyInterface
      * @var array List of forbidden methods.
      */
     protected $blockedMethods = [
-        // \October\Rain\Extension\ExtendableTrait
+        // Prevent manipulating Twig itself
+        'getTwig',
+
+        // Prevent dynamic methods and props
         'addDynamicMethod',
         'addDynamicProperty',
 
-        // \October\Rain\Support\Traits\Emitter
+        // Prevent binding event logic
         'bindEvent',
         'bindEventOnce',
 
         // Eloquent & Halcyon data modification
         'insert',
         'update',
         'delete',
+        'write',
     ];
 
     /**