The variables in every template

The platform variables every template receives, under the same names in Smarty ($_url) and Twig (_url): what each is for, which exist only on the public site, and which only when someone is signed in. Then the variables a controller adds, such as page and record.

Who this is for. Theme developers, as a reference to come back to. After this page you will know what a template can reach without anyone passing it in, and where to find the methods of each.

In every template

Variable	What it is	Notes
`_currentSite`	The site and environment being served, with its id, hostnames and deployed commit (`getLastVcsHash()`)
`_currentUser`	Who is looking: `isLoggedIn()`, `isFrontendUser()`, `isBackendUser()`, `getFullName()`, `getPerson()`	Present signed out too, when `isLoggedIn()` is false
`_request`	The request: its path, parameters, cookies and language	Everything in it came from the visitor: escape it before printing
`_response`	The response being built: redirects, cookies, caching
`_url`	Builds URLs from module and route names, such as `getPath('login')`
`_config`	Reads site settings: `get('Module.setting')`
`_siteData`	The site's own stored values, which editors change in the admin: `get('key')`
`_messages`	Messages for the visitor, by type: `hasMessages()`, `getMessages()`
`_notifications`	Notifications stored for the signed-in user
`_string`	String helpers
`__`	Translations
`_csrfToken`	The session's security token for forms and requests that change data	Only when someone is signed in

On the public site only

Variable	What it is
`_menu`	Menus from the admin, by name: `get('Header Menu')`
`_query`	Reads records the controller did not provide
`_forms`	Forms
`_globalComponents`	Global components, by identifier: `get('identifier')`
`_image`	Image helpers
`_widgets`	Deprecated: read records with `_query` instead
`_search`	Search
`_cart`	The visitor's cart
`_templateContext`	Values kept between the templates of one render, for example while a component or linked record is rendered: `set()` and `get()`
`_inlineScriptNonce`	The nonce every inline `<script>` must carry for the site's Content Security Policy

Templates that jobs render are the exception: they receive the job's own variables instead, hook, batch, event, site, runData, customData, siteData and query (and loopRecord and loopElement inside a loop), with no _url, _currentUser or any other variable above. Jobs and events lists them.

The same names in both engines

In Smarty the variables have a dollar sign, $_url; in Twig they do not, _url. In Twig they are globals, so they also reach inside a macro, which the controller's own variables do not unless you pass them in. The same few lines in each engine:

Template code

{if $_currentUser->isLoggedIn()}
  <a href="{$_url->getPath('logout')}">Sign out</a>
{else}
  <a href="{$_url->getPath('login')}">Sign in</a>
{/if}

{% if _currentUser.isLoggedIn() %}
  <a href="{{ _url.getPath('logout') }}">Sign out</a>
{% else %}
  <a href="{{ _url.getPath('login') }}">Sign in</a>
{% endif %}

And the controller's own

Besides the platform's variables, each controller adds its own. A show controller adds the record under its own name and as record: a page arrives as page and record. A component's template receives component. These names do not start with an underscore.

Global template variables covers the methods of each variable with examples, and the generated Templates reference lists what each default template receives.

Objects ReferenceGenerated from the platform, so it is always current

API ReferenceEvery REST endpoint, in cURL, PHP, Python and JavaScript

In every template

On the public site only

The same names in both engines

And the controller's own