From 50b7b362d5a6318176260f9183d3089a1636e09f Mon Sep 17 00:00:00 2001
From: Matthias Schmidt <gravatronics@live.com>
Date: Mon, 15 Jul 2019 18:53:56 +0200
Subject: [PATCH] Add enterprise mode (#2942)

---
 constants.php                                 |   1 +
 .../install/files/acp/templates/index.tpl     | 140 +++++++++---------
 .../acp/templates/packageStartInstall.tpl     |  62 ++++----
 .../form/PackageStartInstallForm.class.php    |   5 +
 .../files/lib/acp/page/PHPInfoPage.class.php  |   5 +
 .../lib/acp/page/SystemCheckPage.class.php    |   5 +
 .../lib/data/option/OptionEditor.class.php    |   6 +-
 .../system/TemplateScriptingCore.class.php    |  60 ++++++++
 .../install/files/lib/system/WCF.class.php    |  10 +-
 .../files/lib/system/WCFSetup.class.php       |   1 +
 .../lib/system/menu/acp/ACPMenu.class.php     |  28 ++++
 .../lib/system/option/OptionHandler.class.php |  47 +++++-
 .../system/request/RequestHandler.class.php   |  11 ++
 .../TemplateScriptingCompiler.class.php       | 107 ++++++++++++-
 wcfsetup/install/files/options.inc.php        |   1 +
 15 files changed, 381 insertions(+), 108 deletions(-)
 create mode 100644 wcfsetup/install/files/lib/system/TemplateScriptingCore.class.php

diff --git a/constants.php b/constants.php
index ee4f6be08e..25f1a9560d 100644
--- a/constants.php
+++ b/constants.php
@@ -262,3 +262,4 @@ define('BLACKLIST_SFS_USERNAME', '90percentile');
 define('BLACKLIST_SFS_EMAIL_ADDRESS', 'moreThanOnce');
 define('BLACKLIST_SFS_IP_ADDRESS', '90percentile');
 define('BLACKLIST_SFS_ACTION', 'disable');
+define('ENABLE_ENTERPRISE_MODE', 0);
diff --git a/wcfsetup/install/files/acp/templates/index.tpl b/wcfsetup/install/files/acp/templates/index.tpl
index ba8a8d1dcb..dc50a54afd 100644
--- a/wcfsetup/install/files/acp/templates/index.tpl
+++ b/wcfsetup/install/files/acp/templates/index.tpl
@@ -102,78 +102,80 @@
 			</dl>
 		</section>
 		
-		<section class="section">
-			<h2 class="sectionTitle">{lang}wcf.acp.index.system.server{/lang}</h2>
-			
-			<dl>
-				<dt>{lang}wcf.acp.index.system.os{/lang}</dt>
-				<dd>{$server[os]}</dd>
-			</dl>
-			
-			<dl>
-				<dt>{lang}wcf.acp.index.system.webserver{/lang}</dt>
-				<dd>{$server[webserver]}</dd>
-			</dl>
-			
-			<dl>
-				<dt>{lang}wcf.acp.index.system.mySQLVersion{/lang}</dt>
-				<dd>{$server[mySQLVersion]}</dd>
-			</dl>
-			
-			{if $server[load]}
+		{if !ENABLE_ENTERPRISE_MODE || $__wcf->getUser()->hasOwnerAccess()}
+			<section class="section">
+				<h2 class="sectionTitle">{lang}wcf.acp.index.system.server{/lang}</h2>
+				
 				<dl>
-					<dt>{lang}wcf.acp.index.system.load{/lang}</dt>
-					<dd>{$server[load]}</dd>
+					<dt>{lang}wcf.acp.index.system.os{/lang}</dt>
+					<dd>{$server[os]}</dd>
 				</dl>
-			{/if}
-			
-			{event name='serverFields'}
-		</section>
+				
+				<dl>
+					<dt>{lang}wcf.acp.index.system.webserver{/lang}</dt>
+					<dd>{$server[webserver]}</dd>
+				</dl>
+				
+				<dl>
+					<dt>{lang}wcf.acp.index.system.mySQLVersion{/lang}</dt>
+					<dd>{$server[mySQLVersion]}</dd>
+				</dl>
+				
+				{if $server[load]}
+					<dl>
+						<dt>{lang}wcf.acp.index.system.load{/lang}</dt>
+						<dd>{$server[load]}</dd>
+					</dl>
+				{/if}
+				
+				{event name='serverFields'}
+			</section>
 		
-		<section class="section">
-			<h2 class="sectionTitle">{lang}wcf.acp.index.system.php{/lang}</h2>
-			
-			<dl>
-				<dt>{lang}wcf.acp.index.system.php.version{/lang}</dt>
-				<dd>
-					{if $__wcf->session->getPermission('admin.configuration.package.canInstallPackage') && $__wcf->session->getPermission('admin.configuration.package.canUpdatePackage')}
-						<a href="{link controller='PHPInfo'}{/link}">{PHP_VERSION}</a>
-					{else}
-						{PHP_VERSION}
-					{/if}
-				</dd>
-			</dl>
-			
-			<dl>
-				<dt>memory_limit</dt>
-				<dd>
-					{$server[memoryLimit]}
-				</dd>
-			</dl>
-			
-			<dl>
-				<dt>post_max_size</dt>
-				<dd>
-					{$server[postMaxSize]}
-				</dd>
-			</dl>
-			
-			<dl>
-				<dt>upload_max_filesize</dt>
-				<dd>
-					{$server[upload_max_filesize]}
-				</dd>
-			</dl>
-			
-			<dl>
-				<dt>{lang}wcf.acp.index.system.php.sslSupport{/lang}</dt>
-				<dd>
-					{if $server[sslSupport]}{lang}wcf.acp.index.system.php.sslSupport.available{/lang}{else}{lang}wcf.acp.index.system.php.sslSupport.notAvailable{/lang}{/if}
-				</dd>
-			</dl>
-			
-			{event name='phpFields'}
-		</section>
+			<section class="section">
+				<h2 class="sectionTitle">{lang}wcf.acp.index.system.php{/lang}</h2>
+				
+				<dl>
+					<dt>{lang}wcf.acp.index.system.php.version{/lang}</dt>
+					<dd>
+						{if $__wcf->session->getPermission('admin.configuration.package.canInstallPackage') && $__wcf->session->getPermission('admin.configuration.package.canUpdatePackage')}
+							<a href="{link controller='PHPInfo'}{/link}">{PHP_VERSION}</a>
+						{else}
+							{PHP_VERSION}
+						{/if}
+					</dd>
+				</dl>
+				
+				<dl>
+					<dt>memory_limit</dt>
+					<dd>
+						{$server[memoryLimit]}
+					</dd>
+				</dl>
+				
+				<dl>
+					<dt>post_max_size</dt>
+					<dd>
+						{$server[postMaxSize]}
+					</dd>
+				</dl>
+				
+				<dl>
+					<dt>upload_max_filesize</dt>
+					<dd>
+						{$server[upload_max_filesize]}
+					</dd>
+				</dl>
+				
+				<dl>
+					<dt>{lang}wcf.acp.index.system.php.sslSupport{/lang}</dt>
+					<dd>
+						{if $server[sslSupport]}{lang}wcf.acp.index.system.php.sslSupport.available{/lang}{else}{lang}wcf.acp.index.system.php.sslSupport.notAvailable{/lang}{/if}
+					</dd>
+				</dl>
+				
+				{event name='phpFields'}
+			</section>
+		{/if}
 		
 		{event name='systemFieldsets'}
 	</div>
diff --git a/wcfsetup/install/files/acp/templates/packageStartInstall.tpl b/wcfsetup/install/files/acp/templates/packageStartInstall.tpl
index 5922c0af61..b98f34f2d3 100644
--- a/wcfsetup/install/files/acp/templates/packageStartInstall.tpl
+++ b/wcfsetup/install/files/acp/templates/packageStartInstall.tpl
@@ -27,7 +27,9 @@
 	
 	<nav class="contentHeaderNavigation">
 		<ul>
-			<li><a href="#" class="button jsButtonUploadPackage jsStaticDialog" data-dialog-id="packageUploadDialog"><span class="icon icon16 fa-upload"></span> <span>{lang}wcf.acp.package.upload{/lang}</span></a></li>
+			{if !ENABLE_ENTERPRISE_MODE || $__wcf->getUser()->hasOwnerAccess()}
+				<li><a href="#" class="button jsButtonUploadPackage jsStaticDialog" data-dialog-id="packageUploadDialog"><span class="icon icon16 fa-upload"></span> <span>{lang}wcf.acp.package.upload{/lang}</span></a></li>
+			{/if}
 			<li><a href="{link controller='PackageList'}{/link}" class="button"><span class="icon icon16 fa-list"></span> <span>{lang}wcf.acp.menu.link.package.list{/lang}</span></a></li>
 			
 			{event name='contentHeaderNavigation'}
@@ -79,33 +81,35 @@
 	</section>
 </div>
 
-<div id="packageUploadDialog" class="jsStaticDialogContent" data-title="{lang}wcf.acp.package.upload{/lang}">
-	<form method="post" action="{link controller='PackageStartInstall'}{/link}" enctype="multipart/form-data">
-		<div class="section">
-			<dl{if $errorField == 'uploadPackage'} class="formError"{/if}>
-				<dt><label for="uploadPackage">{lang}wcf.acp.package.source.upload{/lang}</label></dt>
-				<dd>
-					<input type="file" id="uploadPackage" name="uploadPackage" value="" accept="application/x-tar,application/gzip,application/tar+gzip">
-					{if $errorField == 'uploadPackage'}
-						<small class="innerError">
-							{if $errorType == 'empty'}
-								{lang}wcf.global.form.error.empty{/lang}
-							{else}
-								{lang}wcf.acp.package.error.{@$errorType}{/lang}
-							{/if}
-						</small>
-					{/if}
-					<small>{lang}wcf.acp.package.source.upload.description{/lang}</small>
-				</dd>
-			</dl>
-		</div>
-		
-		<div class="formSubmit">
-			<input type="submit" name="submitButton" value="{lang}wcf.global.button.submit{/lang}" accesskey="s">
-			<input type="hidden" name="action" value="{$action}">
-			{@SECURITY_TOKEN_INPUT_TAG}
-		</div>
-	</form>
-</div>
+{if !ENABLE_ENTERPRISE_MODE || $__wcf->getUser()->hasOwnerAccess()}
+	<div id="packageUploadDialog" class="jsStaticDialogContent" data-title="{lang}wcf.acp.package.upload{/lang}">
+		<form method="post" action="{link controller='PackageStartInstall'}{/link}" enctype="multipart/form-data">
+			<div class="section">
+				<dl{if $errorField == 'uploadPackage'} class="formError"{/if}>
+					<dt><label for="uploadPackage">{lang}wcf.acp.package.source.upload{/lang}</label></dt>
+					<dd>
+						<input type="file" id="uploadPackage" name="uploadPackage" value="" accept="application/x-tar,application/gzip,application/tar+gzip">
+						{if $errorField == 'uploadPackage'}
+							<small class="innerError">
+								{if $errorType == 'empty'}
+									{lang}wcf.global.form.error.empty{/lang}
+								{else}
+									{lang}wcf.acp.package.error.{@$errorType}{/lang}
+								{/if}
+							</small>
+						{/if}
+						<small>{lang}wcf.acp.package.source.upload.description{/lang}</small>
+					</dd>
+				</dl>
+			</div>
+			
+			<div class="formSubmit">
+				<input type="submit" name="submitButton" value="{lang}wcf.global.button.submit{/lang}" accesskey="s">
+				<input type="hidden" name="action" value="{$action}">
+				{@SECURITY_TOKEN_INPUT_TAG}
+			</div>
+		</form>
+	</div>
+{/if}
 
 {include file='footer'}
diff --git a/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php b/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php
index da0bf033ad..cfe69e7c3b 100755
--- a/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php
@@ -4,6 +4,7 @@ use wcf\data\package\installation\queue\PackageInstallationQueue;
 use wcf\data\package\installation\queue\PackageInstallationQueueEditor;
 use wcf\data\package\Package;
 use wcf\form\AbstractForm;
+use wcf\system\exception\IllegalLinkException;
 use wcf\system\exception\PermissionDeniedException;
 use wcf\system\exception\UserInputException;
 use wcf\system\package\validation\PackageValidationException;
@@ -98,6 +99,10 @@ class PackageStartInstallForm extends AbstractForm {
 			}
 		}
 		else if (!empty($this->uploadPackage['name'])) {
+			if (ENABLE_ENTERPRISE_MODE && !WCF::getUser()->hasOwnerAccess()) {
+				throw new IllegalLinkException();
+			}
+			
 			$this->validateUploadPackage();
 		}
 		else {
diff --git a/wcfsetup/install/files/lib/acp/page/PHPInfoPage.class.php b/wcfsetup/install/files/lib/acp/page/PHPInfoPage.class.php
index 49debd313f..a5159755d9 100644
--- a/wcfsetup/install/files/lib/acp/page/PHPInfoPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/PHPInfoPage.class.php
@@ -22,6 +22,11 @@ class PHPInfoPage extends AbstractPage {
 	 */
 	public $neededPermissions = ['admin.configuration.package.canInstallPackage', 'admin.configuration.package.canUpdatePackage'];
 	
+	/**
+	 * indicates that this page is only accessible to owners in enterprise mode
+	 */
+	const BLACKLISTED_IN_ENTERPRISE_MODE = true;
+	
 	/**
 	 * @inheritDoc
 	 */
diff --git a/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php b/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
index f26d67f198..a66275191c 100644
--- a/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
@@ -107,6 +107,11 @@ class SystemCheckPage extends AbstractPage {
 		],
 	];
 	
+	/**
+	 * indicates that this page is only accessible to owners in enterprise mode
+	 */
+	const BLACKLISTED_IN_ENTERPRISE_MODE = true;
+	
 	/**
 	 * @inheritDoc
 	 */
diff --git a/wcfsetup/install/files/lib/data/option/OptionEditor.class.php b/wcfsetup/install/files/lib/data/option/OptionEditor.class.php
index 25601d139c..9589b3e964 100644
--- a/wcfsetup/install/files/lib/data/option/OptionEditor.class.php
+++ b/wcfsetup/install/files/lib/data/option/OptionEditor.class.php
@@ -144,7 +144,11 @@ class OptionEditor extends DatabaseObjectEditor implements IEditableCachedObject
 		// Secret options cannot be enabled through the regular options, they need to be manually
 		// defined in the Core's `config.inc.php` to be activated.
 		$attachmentStorage = new Option(null, ['optionName' => 'attachment_storage', 'optionType' => 'text', 'optionValue' => null]);
-		$secretOptions = [$attachmentStorage->getConstantName() => $attachmentStorage];
+		$enableEnterpriseMode = new Option(null, ['optionName' => 'enable_enterprise_mode', 'optionType' => 'integer', 'optionValue' => 0]);
+		$secretOptions = [
+			$attachmentStorage->getConstantName() => $attachmentStorage,
+			$enableEnterpriseMode->getConstantName() => $enableEnterpriseMode
+		];
 		
 		// get all options
 		$options = $secretOptions + Option::getOptions();
diff --git a/wcfsetup/install/files/lib/system/TemplateScriptingCore.class.php b/wcfsetup/install/files/lib/system/TemplateScriptingCore.class.php
new file mode 100644
index 0000000000..5dcbc8a470
--- /dev/null
+++ b/wcfsetup/install/files/lib/system/TemplateScriptingCore.class.php
@@ -0,0 +1,60 @@
+<?php
+namespace wcf\system;
+
+/**
+ * Decorates `WCF` and is used in enterprise mode for non-owners in templates so that access to the
+ * database and the template is blocked.
+ * 
+ * @author	Matthias Schmidt
+ * @copyright	2001-2019 WoltLab GmbH
+ * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package	WoltLabSuite\Core\System
+ * @since	5.2
+ */
+class TemplateScriptingCore {
+	/**
+	 * decorated `WCF` object
+	 * @var	WCF 
+	 */
+	private $wcf;
+	
+	/**
+	 * Initializes a new `TemplateScriptingCore` object.
+	 * 
+	 * @param	WCF	$wcf
+	 */
+	public function __construct(WCF $wcf) {
+		$this->wcf = $wcf;
+	}
+	
+	/**
+	 * Forwards method calls to the decorated `WCF` object but blocks access to the database
+	 * and the template object.
+	 * 
+	 * @param	string	$name		called method
+	 * @param	array	$arguments	method parameters
+	 * @return	mixed
+	 */
+	public function __call($name, array $arguments) {
+		if (strcasecmp($name, 'getDB') === 0 || strcasecmp($name, 'getTPL') === 0) {
+			throw new \BadMethodCallException("'WCF::{$name}()' cannot be called from templates.");
+		}
+		
+		return $this->wcf->$name(...$arguments);
+	}
+
+	/**
+	 * Forwards property access to the decorated `WCF` object but blocks access to the database
+	 * and the template object.
+	 * 
+	 * @param	string	$name	accessed property
+	 * @return	mixed
+	 */
+	public function __get($name) {
+		if (strcasecmp($name, 'DB') === 0 || strcasecmp($name, 'TPL') === 0) {
+			throw new \BadMethodCallException("'WCF::{$name}' cannot be accessed from templates.");
+		}
+		
+		return $this->wcf->$name;
+	}
+}
diff --git a/wcfsetup/install/files/lib/system/WCF.class.php b/wcfsetup/install/files/lib/system/WCF.class.php
index bf3fb73ba1..985ca003b5 100644
--- a/wcfsetup/install/files/lib/system/WCF.class.php
+++ b/wcfsetup/install/files/lib/system/WCF.class.php
@@ -706,9 +706,15 @@ class WCF {
 	 * Assigns some default variables to the template engine.
 	 */
 	protected function assignDefaultTemplateVariables() {
+		$wcf = $this;
+		
+		if (ENABLE_ENTERPRISE_MODE) {
+			$wcf = new TemplateScriptingCore($wcf);
+		}
+		
 		self::getTPL()->registerPrefilter(['event', 'hascontent', 'lang']);
 		self::getTPL()->assign([
-			'__wcf' => $this,
+			'__wcf' => $wcf,
 			'__wcfVersion' => LAST_UPDATE_TIME // @deprecated 2.1, use LAST_UPDATE_TIME directly
 		]);
 		
@@ -726,7 +732,7 @@ class WCF {
 		
 		EmailTemplateEngine::getInstance()->registerPrefilter(['event', 'hascontent', 'lang']);
 		EmailTemplateEngine::getInstance()->assign([
-			'__wcf' => $this
+			'__wcf' => $wcf
 		]);
 	}
 	
diff --git a/wcfsetup/install/files/lib/system/WCFSetup.class.php b/wcfsetup/install/files/lib/system/WCFSetup.class.php
index 6ab514a389..1dabcf811d 100644
--- a/wcfsetup/install/files/lib/system/WCFSetup.class.php
+++ b/wcfsetup/install/files/lib/system/WCFSetup.class.php
@@ -39,6 +39,7 @@ define('CACHE_SOURCE_TYPE', 'disk');
 define('MODULE_MASTER_PASSWORD', 1);
 define('ENABLE_DEBUG_MODE', 1);
 define('ENABLE_BENCHMARK', 0);
+define('ENABLE_ENTERPRISE_MODE', 0);
 
 /**
  * Executes the installation of the basic WCF systems.
diff --git a/wcfsetup/install/files/lib/system/menu/acp/ACPMenu.class.php b/wcfsetup/install/files/lib/system/menu/acp/ACPMenu.class.php
index 65cdd9e710..a6da958b99 100644
--- a/wcfsetup/install/files/lib/system/menu/acp/ACPMenu.class.php
+++ b/wcfsetup/install/files/lib/system/menu/acp/ACPMenu.class.php
@@ -1,7 +1,10 @@
 <?php
 namespace wcf\system\menu\acp;
+use wcf\data\acp\menu\item\ACPMenuItem;
 use wcf\system\cache\builder\ACPMenuCacheBuilder;
+use wcf\system\menu\ITreeMenuItem;
 use wcf\system\menu\TreeMenu;
+use wcf\system\WCF;
 
 /**
  * Builds the acp menu.
@@ -12,6 +15,31 @@ use wcf\system\menu\TreeMenu;
  * @package	WoltLabSuite\Core\System\Menu\Acp
  */
 class ACPMenu extends TreeMenu {
+	/**
+	 * list of acp menu items that are only visible for owners in enterprise mode
+	 * @var	string[]
+	 * @since	5.2
+	 */
+	protected $enterpriseBlacklist = [
+		'wcf.acp.menu.link.systemCheck'
+	];
+	
+	/**
+	 * @inheritDoc
+	 * @param	ACPMenuItem	$item
+	 */
+	protected function checkMenuItem(ITreeMenuItem $item) {
+		if (!parent::checkMenuItem($item)) {
+			return false;
+		}
+		
+		if (ENABLE_ENTERPRISE_MODE && !WCF::getUser()->hasOwnerAccess() && in_array($item->menuItem, $this->enterpriseBlacklist)) {
+			return false;
+		}
+		
+		return true;
+	}
+	
 	/**
 	 * @inheritDoc
 	 */
diff --git a/wcfsetup/install/files/lib/system/option/OptionHandler.class.php b/wcfsetup/install/files/lib/system/option/OptionHandler.class.php
index 476e9a2505..c4aa9868bb 100644
--- a/wcfsetup/install/files/lib/system/option/OptionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/option/OptionHandler.class.php
@@ -9,6 +9,7 @@ use wcf\system\exception\ImplementationException;
 use wcf\system\exception\SystemException;
 use wcf\system\exception\UserInputException;
 use wcf\system\language\I18nHandler;
+use wcf\system\WCF;
 use wcf\util\StringUtil;
 
 /**
@@ -62,6 +63,32 @@ class OptionHandler implements IOptionHandler {
 	 */
 	public $categoryName = '';
 	
+	/**
+	 * list of options and option categories that are only accessible for owners in enterprise
+	 * mode
+	 * this blacklist only applies to options, not other types of options like user options
+	 *
+	 * @var	string[][]
+	 * @since	5.2
+	 */
+	protected $enterpriseBlacklist = [
+		'categories' => [
+			'general.cache',
+			'general.mail.send',
+			'general.page.seo',
+			'general.system.cookie',
+			'general.system.http',
+			'general.system.image',
+			'general.system.packageServer',
+			'module.development',
+			'security.general.secrets'
+		],
+		'options' => [
+			'register_activation_method',
+			'search_engine'
+		]
+	];
+	
 	/**
 	 * options of the active category
 	 * @var	Option[]
@@ -468,7 +495,15 @@ class OptionHandler implements IOptionHandler {
 	 * @return	boolean
 	 */
 	protected function checkCategory(OptionCategory $category) {
-		return $category->validateOptions() && $category->validatePermissions();
+		if (!$category->validateOptions() || !$category->validatePermissions()) {
+			return false;
+		}
+		
+		if (ENABLE_ENTERPRISE_MODE && !WCF::getUser()->hasOwnerAccess() && get_class($category) === OptionCategory::class) {
+			return !in_array($category->categoryName, $this->enterpriseBlacklist['categories']);
+		}
+		
+		return true;
 	}
 	
 	/**
@@ -488,6 +523,14 @@ class OptionHandler implements IOptionHandler {
 	 * @return	boolean
 	 */
 	protected function checkVisibility(Option $option) {
-		return $option->isVisible();
+		if (!$option->isVisible()) {
+			return false;
+		}
+		
+		if (ENABLE_ENTERPRISE_MODE && !WCF::getUser()->hasOwnerAccess() && get_class($option) === Option::class) {
+			return !in_array($option->optionName, $this->enterpriseBlacklist['options']);
+		}
+		
+		return true;
 	}
 }
diff --git a/wcfsetup/install/files/lib/system/request/RequestHandler.class.php b/wcfsetup/install/files/lib/system/request/RequestHandler.class.php
index 7255c37204..bace28189e 100644
--- a/wcfsetup/install/files/lib/system/request/RequestHandler.class.php
+++ b/wcfsetup/install/files/lib/system/request/RequestHandler.class.php
@@ -71,6 +71,17 @@ class RequestHandler extends SingletonFactory {
 			// build request
 			$this->buildRequest($application);
 			
+			// enforce that certain ACP pages are not available for non-owners in enterprise mode
+			if (
+				$isACPRequest
+				&& ENABLE_ENTERPRISE_MODE
+				&& !WCF::getUser()->hasOwnerAccess()
+				&& defined($this->activeRequest->getClassName() . '::BLACKLISTED_IN_ENTERPRISE_MODE')
+				&& constant($this->activeRequest->getClassName() . '::BLACKLISTED_IN_ENTERPRISE_MODE')
+			) {
+				throw new IllegalLinkException();
+			}
+			
 			// handle offline mode
 			if (!$isACPRequest && defined('OFFLINE') && OFFLINE) {
 				if (!WCF::getSession()->getPermission('admin.general.canViewPageDuringOfflineMode') && !$this->activeRequest->isAvailableDuringOfflineMode()) {
diff --git a/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php b/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php
index de430c50ec..af9b15e372 100644
--- a/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php
+++ b/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php
@@ -38,6 +38,84 @@ class TemplateScriptingCompiler {
 		'eval', 'virtual', 'call_user_func_array', 'call_user_func', 'assert' // code execution
 	];
 	
+	/**
+	 * PHP functions and modifiers that can be used in enterprise mode
+	 * @var	string[]
+	 */
+	protected $enterpriseFunctions = [
+		'addslashes',
+		'array_keys',
+		'array_pop',
+		'array_slice',
+		'array_values',
+		'base64_decode',
+		'base64_encode',
+		'ceil',
+		'concat',
+		'constant',
+		'count',
+		'currency',
+		'date',
+		'defined',
+		'empty',
+		'end',
+		'explode',
+		'file_exists',
+		'filesize',
+		'floor',
+		'function_exists',
+		'gmdate',
+		'hash',
+		'htmlspecialchars',
+		'implode',
+		'in_array',
+		'is_array',
+		'is_numeric',
+		'is_object',
+		'intval',
+		'is_subclass_of',
+		'isset',
+		'key',
+		'lcfirst',
+		'ltrim',
+		'max',
+		'mb_strpos',
+		'mb_strlen',
+		'mb_strpos',
+		'mb_strtolower',
+		'mb_strtoupper',
+		'mb_substr',
+		'md5',
+		'microtime',
+		'min',
+		'nl2br',
+		'number_format',
+		'preg_match',
+		'preg_replace',
+		'print_r',
+		'rawurlencode',
+		'reset',
+		'round',
+		'sha1',
+		'spl_object_hash',
+		'sprintf',
+		'strpos',
+		'strlen',
+		'strtolower',
+		'strtotime',
+		'strtoupper',
+		'str_pad',
+		'str_repeat',
+		'str_replace',
+		'str_ireplace',
+		'substr',
+		'trim',
+		'ucfirst',
+		'urlencode',
+		'wcfDebug',
+		'wordwrap'
+	];
+	
 	/**
 	 * pattern to match variable operators like -> or .
 	 * @var	string
@@ -1181,8 +1259,13 @@ class TemplateScriptingCompiler {
 						if (/*strpos($values[$i], '$') !== false || */strpos($values[$i], '@@') !== false) {
 							throw new SystemException(static::formatSyntaxError("unexpected '->".$values[$i]."' in tag '".$tag."'", $this->currentIdentifier, $this->currentLineNo));
 						}
-						if (strpos($values[$i], '$') !== false) $result .= '{'.$this->compileSimpleVariable($values[$i], $variableType).'}';
-						else $result .= $values[$i];
+						if (strpos($values[$i], '$') !== false) {
+							$result .= '{'.$this->compileSimpleVariable($values[$i], $variableType).'}';
+						}
+						else {
+							$result .= $values[$i];
+						}
+						
 						$statusStack[count($statusStack) - 1] = $status = 'object';
 					break;
 					
@@ -1205,7 +1288,7 @@ class TemplateScriptingCompiler {
 					break;
 					
 					case 'object method':
-					case 'left parenthesis':	
+					case 'left parenthesis':
 						$result .= $this->compileSimpleVariable($values[$i], $variableType);
 						$statusStack[] = $status = $variableType;
 					break;
@@ -1237,8 +1320,22 @@ class TemplateScriptingCompiler {
 							$modifierData['className'] = $className;
 							$this->autoloadPlugins[$modifierData['className']] = $modifierData['className'];
 						}
-						else if ((!function_exists($modifierData['name']) && !in_array($modifierData['name'], $this->unknownPHPFunctions)) || in_array($modifierData['name'], $this->disabledPHPFunctions)) {
-							throw new SystemException(static::formatSyntaxError("unknown modifier '".$values[$i]."'", $this->currentIdentifier, $this->currentLineNo));
+						else if (!function_exists($modifierData['name']) && !in_array($modifierData['name'], $this->unknownPHPFunctions)) {
+							throw new SystemException(static::formatSyntaxError(
+								"unknown modifier '".$values[$i]."'",
+								$this->currentIdentifier,
+								$this->currentLineNo
+							));
+						}
+						else if (
+							in_array($modifierData['name'], $this->disabledPHPFunctions)
+							|| (ENABLE_ENTERPRISE_MODE && !in_array($modifierData['name'], $this->enterpriseFunctions))
+						) {
+							throw new SystemException(static::formatSyntaxError(
+								"disabled function '".$values[$i]."'",
+								$this->currentIdentifier,
+								$this->currentLineNo
+							));
 						}
 						
 						$statusStack[count($statusStack) - 1] = $status = 'modifier end';
diff --git a/wcfsetup/install/files/options.inc.php b/wcfsetup/install/files/options.inc.php
index bea0a788d3..74feca9de0 100644
--- a/wcfsetup/install/files/options.inc.php
+++ b/wcfsetup/install/files/options.inc.php
@@ -38,6 +38,7 @@ define('TIMEZONE', 'Europe/Berlin');
 define('ENABLE_DEBUG_MODE', 1);
 define('ENABLE_PRODUCTION_DEBUG_MODE', 1);
 define('ENABLE_BENCHMARK', 0);
+define('ENABLE_ENTERPRISE_MODE', 0);
 define('EXTERNAL_LINK_TARGET_BLANK', 0);
 define('URL_LEGACY_MODE', 0);
 define('URL_TO_LOWERCASE', 1);
-- 
2.20.1