Risky preferences
Some of Tiki's preferences are quite powerful (and thus dangerous) and should be used only by experts. These risky preferences are disabled and hidden by default, since Tiki 22 and only the system administrator can make them visible through Tiki's system configuration file.
This addresses CVE-2020-29254
These are the preferences marked as risky and Tiki version supporting them:
| Risky Preference | Tiki version(s) |
| feature_editcss | 22x - 28x |
| feature_edit_templates | 22x - 28x |
| feature_purifier | 22x+ |
| smarty_security_functions | 22x - 26x |
| smarty_security_modifiers | 22x - 26x |
| smarty_security_dirs | 22x+ |
| smarty_security_allowed_tags | 27x+ |
| smarty_security_disabled_tags | 27x+ |
| smarty_security_allowed_modifiers | 27x+ |
| smarty_security_disabled_modifiers | 27x+ |
| smarty_security_allowed_builtin_php_functions | 27x+ |
| tiki_allow_trust_input | 22x+ |
| feature_create_webhelp | 23x+ |
| scheduler_shell_command | 24x+ |
| smarty_enable_string_eval | 24x |
Enable/Show risky preferences
First, in order to enable these features first is needed to activate the system configuration.
If you don’t have one, you will need to declare the path of the tiki.ini file where rules can be stored.
$system_configuration_file = 'db/tiki.ini';
In your configuration file, add new rules to Tiki's configuration file that allows showing these features.
See the following example:
rules.0 = show smarty_security_dirs
Set Specific Risky Prefs in tiki.ini
Alternatively you can set these "disabled by default" prefs to specific values in your tiki.ini file, like this:
preference.smarty_security_dirs[] = "/home/tiki/mycustomtheme_repo/themes/themename/templates/" preference.smarty_security_dirs[] = "/home/tiki/myothertheme_repo/themes/othertheme/templates/""
Read more about System configuration here.