Files with the extensions .vm and .vmi that contain Velocity scripting code are Velocity files. Velocity files can only be executed if they are stored within certain subdirectories of the portal's directory. These subdirectories are:
Verify read permissions for a data group: $AccessController.hasDatagroupPermissionFromPage($ProcessingContext, $appGuid, $dataGroupGuid, "read")
Verify access permissions for a page: $AccessController.hasPagePermission($appGuid, $pageGuid, "access")
The file extension .vmi stands for Velocity-Include files. As opposed to Velocity files with the extension .vm, VMI files cannot be called up directly from the web. For this reason, security checks, which have already been performed in the calling Velocity files, do not have to be performed again in VMI files.