Further improvements to the Twig SecurityPolicy

2020-12-18 12:14:18 -06:00 · 2020-12-18 12:14:18 -06:00 · f63519ff1e
parent 2108321d49
commit f63519ff1e
1 changed files with 8 additions and 0 deletions
--- a/modules/system/twig/SecurityPolicy.php
+++ b/modules/system/twig/SecurityPolicy.php
@ -18,10 +18,18 @@ final class SecurityPolicy implements SecurityPolicyInterface
     * @var array List of forbidden methods.
     */
    protected $blockedMethods = [
+        // \October\Rain\Extension\ExtendableTrait
        'addDynamicMethod',
        'addDynamicProperty',
+
+        // \October\Rain\Support\Traits\Emitter
        'bindEvent',
        'bindEventOnce',
+
+        // Eloquent & Halcyon data modification
+        'insert',
+        'update',
+        'delete',
    ];

    /**