0

Can code put in a template file write, copy, rename files, or read files that aren't template files?

Improve this question

1 Answer 1

Reset to default
2

Twig is extendable, so it can do whatever it's given the ability to do.

But no, core Twig and core Drupal do not include extensions for manipulating files.

Templates are for displaying things, it wouldn't make conceptual sense for them to be able to manipulate the file system (even if you could technically provide an extension to give them that ability).

Improve this answer
5
  • All Core extensions are declared in TwigExtension: api.drupal.org/api/drupal/…
    – cilefen
    Sep 14, 2022 at 15:03
  • Ok, thanks! One more question: at SO I've received a comment that Twig creates compiled templates if the cache is enabled. That's some kind of "creating" files. But I can't find the answer to the question, does Drupal-specific Twig also compile such files or it stores compiled templates in the database? Could you tell me more about
    – user104765
    Sep 14, 2022 at 15:05
  • 1
    Yes, the engine can create cached files (and should almost always be configured to do so), but it does that from outside the template, not inside. No, Drupal doesn't store compiled templates in the database, again a plugin could probably be written to do so, but for now they're stored in the file system. I wonder is there a hidden question you're getting towards but haven't asked yet? In the abstract these feel like un-useful things to know, but not sure if you have an underlying goal or are just hunting for any knowledge you can find on the subject
    – Clive ♦
    Sep 14, 2022 at 15:13
  • @Clive It's a question of security. I mean if a developer working on Twig templates uploads them to a server via specific file uploader which allows only .twig files, can he add some line to a template that in turn can create for example PHP file with executable code? Or if he uploads a file as .twig, can he then somehow rename it to .php using a line inside of Twig template? And so on
    – user104765
    Sep 14, 2022 at 16:15
  • No they can't do that, not out of the box anyway, you'd need to give them that power (which obviously you wouldn't do). Twig compiles down to PHP, so your risk shifts to how secure the Twig project itself or Drupal/Symfony's potential use of it is, IMO (and your own codebase, custom/contrib modules, etc)
    – Clive ♦
    Sep 14, 2022 at 16:34