Smarty Security

[brent5392]

I am soon about to begin developing an application where users can upload their own template files, which will be parsed by the smarty engine. They will have access to set variables. Before the template is actually used, it will be scanned to check that it contains no javascript and no links to include javascript.

What other security issues are there that I should worry about? Is this not a good idea? Could this produce a large security hole?

[earl-grey]

Security is one of its main points, so designers should be able to do only what they are supposed to.

There has been a bug, which allowed execution of arbitrary PHP code, a while ago so always check for updates.

[brent5392]

Yes, most definitely. If im going to use someone elses code, ill definitely make sure ill use the most upto date available.

Edit:

Especially if everyone has access to it...