zomex Posted July 7, 2015 Share Posted July 7, 2015 Hello all, I'm not really one to complain but in V6 there was a big change made with no warning, in the last beta version the use {php} was enabled by default but in V6 it's disabled by default. I can understand why it's disabled by default but to make that change last minute with absolutely no warning was not good to see from you guys. Of course it can be enabled in the general settings > security but a lot of templates/modules/addons make use of this and seeing as it was enabled in the last beta version it's quite annoying to see this happen. Jack 0 Quote Link to comment Share on other sites More sharing options...
merlinpa1969 Posted July 7, 2015 Share Posted July 7, 2015 Jack, are the Zomex Templates being modified to not use the {php} tag, I seem to recall there being security concerns around it 0 Quote Link to comment Share on other sites More sharing options...
zomex Posted July 7, 2015 Author Share Posted July 7, 2015 Jack, are the Zomex Templates being modified to not use the {php} tag, I seem to recall there being security concerns around it They use the {php} code for a couple of features, such as the gravatar integration, if there is enough support to remove this then I can easily remove the tags but I feel it's a good feature of the template. All WHMCS installations have had it enabled since before this latest version so if it is a big security concern then every WHMCS installation would have been at risk. It's certainly more secure to have it disabled but I wouldn't call it a security concern unless it's miss-used or someone finds a way to exploit it such as has been done in the past using it in support tickets. 0 Quote Link to comment Share on other sites More sharing options...
WHMCS Support Manager WHMCS John Posted July 9, 2015 WHMCS Support Manager Share Posted July 9, 2015 Hi, On my installation and that of other user's I've reviewed thus far, the 'Allow Smarty PHP Tags' setting is On by default. This is the intended behaviour. I'd be interested to hear if any other users have found it was set to Off by default for them. 0 Quote Link to comment Share on other sites More sharing options...
webio Posted July 9, 2015 Share Posted July 9, 2015 I just started testing my production copy of WHMCS on my local development (I've copied WHMCS files and DB) machine with Dev license set in configuration file and after installation upgrade process I had allow smarty php tag set to off. I've updated WHMCS directly from 5.3.14 to 6.0. 0 Quote Link to comment Share on other sites More sharing options...
brian! Posted July 9, 2015 Share Posted July 9, 2015 Hi,On my installation and that of other user's I've reviewed thus far, the 'Allow Smarty PHP Tags' setting is On by default. This is the intended behaviour. I'd be interested to hear if any other users have found it was set to Off by default for them. on my v6 dev site, it is still set as "On"... it was set as that in the first beta, and none of the other betas, RCs or the full version has changed that setting. now what happens to that setting in a clean full v6 installation, or an upgrade from v5.3, I don't know. 0 Quote Link to comment Share on other sites More sharing options...
zomex Posted July 9, 2015 Author Share Posted July 9, 2015 Hi,On my installation and that of other user's I've reviewed thus far, the 'Allow Smarty PHP Tags' setting is On by default. This is the intended behaviour. I'd be interested to hear if any other users have found it was set to Off by default for them. From what I've seen a lot of my customers have opened tickets missing this step from my upgrade guide so it looks like it's set to disabled for most people. I believe the documentation also refers to it being disabled by default. 0 Quote Link to comment Share on other sites More sharing options...
xnet Posted July 10, 2015 Share Posted July 10, 2015 Could this of been because of bug?: v6 Public changelog: VSIX-740 - Allow Smarty PHP Tags show as enabled in interface when disabled Have not tested, but seems possible that it was always disabled? 0 Quote Link to comment Share on other sites More sharing options...
SeanP Posted July 10, 2015 Share Posted July 10, 2015 On my installation and that of other user's I've reviewed thus far, the 'Allow Smarty PHP Tags' setting is On by default. This is the intended behaviour. I'd be interested to hear if any other users have found it was set to Off by default for them. I just tried a new install (not an upgrade), and it was set to Off by default. However, it appears it being Off by default is the intended behavior according, to the release notes: http://docs.whmcs.com/Version_6.0_Release_Notes_in_Brief "One of the biggest changes to Smarty relates to the use of {php} tags within template files. This functionality is now disabled by default and must be explicitly enabled in Setup > General Settings > Security should you require it. We recommend using hooks for Templates and Custom PHP Logic." 0 Quote Link to comment Share on other sites More sharing options...
WHMCS Support Manager WHMCS John Posted July 10, 2015 WHMCS Support Manager Share Posted July 10, 2015 Hi, Interesting. I did upgrade my installation from the Release Candidate. Was your first install a new installation too or an upgrade? 0 Quote Link to comment Share on other sites More sharing options...
zomex Posted July 10, 2015 Author Share Posted July 10, 2015 I found a example in the docs where it says it's disabled by default, i've also seen this noted in other docs: http://docs.whmcs.com/Version_6.0_Release_Notes_in_Brief It's not really a problem, just would have been nice if there was more of a warning. 0 Quote Link to comment Share on other sites More sharing options...
ttremain Posted July 11, 2015 Share Posted July 11, 2015 Hi,On my installation and that of other user's I've reviewed thus far, the 'Allow Smarty PHP Tags' setting is On by default. This is the intended behaviour. I'd be interested to hear if any other users have found it was set to Off by default for them. This was off, when I upgraded from 5.x to 6.0.0 0 Quote Link to comment Share on other sites More sharing options...
djojozeph Posted September 1, 2015 Share Posted September 1, 2015 Hello, I have this issue too, but even when i enable the 'Allow Smarty PHP Tags', it still not working.. the display of the error {php}" unknown tag "php" is that normal ? Thank you 0 Quote Link to comment Share on other sites More sharing options...
brian! Posted September 1, 2015 Share Posted September 1, 2015 I have this issue too, but even when i enable the 'Allow Smarty PHP Tags', it still not working.. the display of the error {php}" unknown tag "php" is that normal ? it may be worth opening a ticket with Support so that they can take a closer look at your system. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.