AssetPathPolicy
in package
FinalYes
Policy for the legacy image path of a category or region (`asset_path`): it is a local file, not a URL.
Public lists put it into <img src>. Latte checkUrl() blocks javascript: and data:
there but lets https://other-server/pixel.png through, so the visitor would load a third-party
resource that can change at any time. Hence a separate policy rather than the navigation
allowlist (NavigationUrlPolicy), where https:// is expected.
Only a relative path is allowed (with or without a leading /): no scheme (https:, ftp:,
data: ...), no //host, no backslash, no control characters and no . or .. segment.
Table of Contents
Methods
- isAllowed() : bool
Methods
isAllowed()
public
static isAllowed(string|null $path) : bool
Parameters
- $path : string|null