Further improvements to the Twig SecurityPolicy

octobercms · Dec 18, 2020 · f63519f · f63519f
1 parent 2108321
commit f63519f
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/modules/system/twig/SecurityPolicy.php b/modules/system/twig/SecurityPolicy.php
@@ -18,10 +18,18 @@ final class SecurityPolicy implements SecurityPolicyInterface
      * @var array List of forbidden methods.
      */
     protected $blockedMethods = [
+        // \October\Rain\Extension\ExtendableTrait
         'addDynamicMethod',
         'addDynamicProperty',
+
+        // \October\Rain\Support\Traits\Emitter
         'bindEvent',
         'bindEventOnce',
+
+        // Eloquent & Halcyon data modification
+        'insert',
+        'update',
+        'delete',
     ];
 
     /**