getgrav/grav · error · SecurityNotAllowedMethodError

Calling "%s" method on a "%s" object is not allowed.

Error message

Calling "%s" method on a "%s" object is not allowed.

What it means

Error "Calling "%s" method on a "%s" object is not allowed." thrown in getgrav/grav.

Source

Thrown at system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php:92

        foreach ($functions as $function) {
            if (!in_array($function, $this->allowedFunctions, true)) {
                throw new SecurityNotAllowedFunctionError(sprintf('Function "%s" is not allowed.', $function), $function);
            }
        }
    }

    public function checkMethodAllowed($obj, $method): void
    {
        $method = strtolower($method);
        foreach ($this->allowedMethods as $class => $methods) {
            if ($obj instanceof $class && (in_array('*', $methods, true) || in_array($method, $methods, true))) {
                return;
            }
        }

        $class = $obj::class;
        throw new SecurityNotAllowedMethodError(
            sprintf('Calling "%s" method on a "%s" object is not allowed.', $method, $class),
            $class,
            $method
        );
    }

    /**
     * True when $obj is an instance of any class in the method allowlist — i.e.
     * a type sandboxed content is permitted to interact with at all. The
     * dump/serialize filter guards (print_r, json_encode, yaml_encode, string)
     * use this to refuse objects that bypass the member gate by serializing PHP
     * state directly. Note: when `security.twig_content.config_access` is off,
     * the raw `Config`/`Data` entries are stripped in
     * Security::buildTwigSandboxPolicy(), so this returns false for them — only
     * the redacting SandboxConfig facade stays allowed. (GHSA-mc5q-6hpj-rp7j)
     */
    public function isClassAllowed(object $obj): bool
    {

View on GitHub (pinned to 6040efed04)

When it happens

Trigger: Thrown at system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php:92 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getgrav/grav@6040efed04 (2026-08-17). Data as JSON: /api/errors/d85b1253aff657e2. Report an issue: GitHub.