octobercms/october · error · Twig\Sandbox\SecurityNotAllowedMethodError

Calling "%s" method on a "%s" object is blocked.

Error message

Calling "%s" method on a "%s" object is blocked.

What it means

Error "Calling "%s" method on a "%s" object is blocked." thrown in octobercms/october.

Source

Thrown at modules/system/twig/SecurityPolicy.php:263

        $className = get_class($obj);
        throw new SecurityNotAllowedMethodError(sprintf('Calling any method on a "%s" object is blocked.', $className), $className, $method);
    }

    //
    // Block-list
    //

    /**
     * checkMethodAllowedBlocklist
     */
    protected function checkMethodAllowedBlocklist($obj, $method)
    {
        $blockedMethod = strtr($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');

        // Check direct class blocklists
        foreach ($this->blockedClassMethods as $blockedClass => $blockedMethods) {
            if (is_a($obj, $blockedClass) && in_array($blockedMethod, $blockedMethods)) {
                throw new SecurityNotAllowedMethodError(sprintf('Calling "%s" method on a "%s" object is blocked.', $method, $blockedClass), $blockedClass, $method);
            }
        }

        // Check forwarder chains: if $obj's class forwards __call to another
        // class, enforce that class's blocklist as well (transitively).
        foreach ($this->blockedClassForwarders as $sourceClass => $targetClass) {
            if (!is_a($obj, $sourceClass)) {
                continue;
            }

            $cursor = $targetClass;
            while ($cursor !== null) {
                $targetMethods = $this->blockedClassMethods[$cursor] ?? [];
                if (in_array($blockedMethod, $targetMethods)) {
                    throw new SecurityNotAllowedMethodError(sprintf('Calling "%s" method on a "%s" object is blocked.', $method, $sourceClass), $sourceClass, $method);
                }
                $cursor = $this->blockedClassForwarders[$cursor] ?? null;
            }

View on GitHub (pinned to b608633a7e)

When it happens

Trigger: Thrown at modules/system/twig/SecurityPolicy.php:263 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/c2c25ff7e288dd82. Report an issue: GitHub.