I would like to patch a Magento shop with SUPEE-9767. The documentation for SUPEE-9767 tells me to disable Symlinks setting before applying the patch:
Before applying the patch or upgrading to the latest release, make sure to disable Symlinks setting ... The setting, if enabled, will override configuration file setting and changing it will require direct database modification.
But I use modman to manage modules and since some of the modules are using template files, the Symlinks setting is enabled according to the suggestion in modman's README. Is it safe to leave Symlinks setting enabled as one of the posts in Security Patch SUPEE-9767 - Possible issues? suggests (I cannot comment on posts yet since I'm a new user)?
Users using modman to manage Magento 1.x modules should ensure that they do not disable symlinks as this will disable the modman modules.
If I leave Symlinks setting enabled, wouldn't the shop be exposed to APPSEC-1281: Remote code execution through symlinks, a security threat this patch is meant to fix?
Are there other ways of using modman with template files after this patch? (I know of the "patched version of Mage/Core/Block/Template.php" option that modman's README mentions, but patching a core file seems dangerous.)