- 🇳🇬Nigeria chike Nigeria
As said on #6 admin-level permissions is required for a user to be adding views headers and footers so I am not sure site owners would be giving untrusted users admin roles. For the possible security risks with Twig templates, a warning message could be left on the field.
There is a legitimate and very powerful use case for allowing Twig syntax on views headers and footers just as they add so much power to views when one uses 'Custom text' field to play around with fields using Twig. It indeed gives so much power to Views, and so also will there be such power added to headers and footers if full Twig syntax is allowed.
Yesterday I wanted to use Twig
ifelseifcondition to conditionally display a message on the views footer depending on the value of a field, that's when I noticed this wasn't possible. Now I did make a Custom text field and write the Twig conditions on it and then added the field on the footer which ended up achieving the same goal. So if I could still add the condition there somehow why not then allow us do it directly on the footer?Weighing the security risks against the use case of the feature, it sure will win to have it enabled and a warning message left on the field to tell people to write Twig with care.