TryGhost / express-hbs

Express handlebars template engine with inheritance, partials, i18n and async helpers.
MIT License
458 stars 76 forks source link

Added support for a restrictLayoutsTo option #258

Closed allouis closed 9 months ago

allouis commented 9 months ago

Passing this option will cause express-hbs to error when attempting to read a layout from outside of the path. This is used to help alleviate the security concerns when using user submitted data for choosing layouts

Long term, in a major release we can use the layoutsDir option for this, but we did not want to make a breaking change at this stage.