Hi, we introduced these restrictions because installation and update scripts run with high privileges. A compromised or malicious module could otherwise modify files outside its own directory, execute dangerous functions, or install a backdoor. CodeGuard therefore uses conservative rules to reduce the attack surface and protect existing WebsiteBaker installations.
For modules and templates, mkdir() is blocked in install.php and update.php because CodeGuard cannot reliably prove that dynamically built paths remain inside the module or template directory. Path traversal, manipulated input, or symlinks could otherwise allow writes elsewhere.
The recommended alternatives are:
- Include required fixed directories directly in the module/template ZIP.
- Use fixed, pre-created subdirectories.
- Create dynamic subdirectories later during normal module operation, using a strictly controlled base path.
$auditDenied() is a variable function call. Because the variable can contain any function name, it could potentially execute dangerous functions.
Use a direct call instead: auditDenied()
For several permitted actions, use explicit if/switch branches rather than dynamic callbacks.
You can donate by clicking on the button below.