getgrav/grav · error · SecurityNotAllowedFilterError

Filter "%s" is not allowed.

Error message

Filter "%s" is not allowed.

What it means

Error "Filter "%s" is not allowed." thrown in getgrav/grav.

Source

Thrown at system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php:71

    public function checkSecurity($tags, $filters, $functions, array $tests = []): void
    {
        if (null !== $this->allowedTests) {
            foreach ($tests as $test) {
                if (!in_array($test, $this->allowedTests, true)) {
                    throw new SecurityNotAllowedTestError(sprintf('Test "%s" is not allowed.', $test), $test);
                }
            }
        }

        foreach ($tags as $tag) {
            if (!in_array($tag, $this->allowedTags, true)) {
                throw new SecurityNotAllowedTagError(sprintf('Tag "%s" is not allowed.', $tag), $tag);
            }
        }

        foreach ($filters as $filter) {
            if (!in_array($filter, $this->allowedFilters, true)) {
                throw new SecurityNotAllowedFilterError(sprintf('Filter "%s" is not allowed.', $filter), $filter);
            }
        }

        foreach ($functions as $function) {
            if (!in_array($function, $this->allowedFunctions, true)) {
                throw new SecurityNotAllowedFunctionError(sprintf('Function "%s" is not allowed.', $function), $function);
            }
        }
    }

    public function checkMethodAllowed($obj, $method): void
    {
        $method = strtolower($method);
        foreach ($this->allowedMethods as $class => $methods) {
            if ($obj instanceof $class && (in_array('*', $methods, true) || in_array($method, $methods, true))) {
                return;
            }
        }

View on GitHub (pinned to 6040efed04)

When it happens

Trigger: Thrown at system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php:71 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getgrav/grav@6040efed04 (2026-08-17). Data as JSON: /api/errors/526304a423a9e313. Report an issue: GitHub.