search

helhum / typo3-secure-web

Secure your TYPO3 installation by only exposing public files
60 stars 12 forks source link

Allow to set additional core folders that should be linked to web directory #1

Closed oemmes closed 7 years ago

oemmes commented 7 years ago

The folders can be specified in root composer.json as array in extra/"typo3/cms"/public-core-folders

helhum commented 7 years ago

Thank you very much for you pull request @oemmes ! I considered doing so as well but decided against it and here is why:

  1. There is only one additional "core" folder and that is uploads. Files in this folder can be used (or have been historically used) for both private and public resources. Therefor linking the complete uploads folder will potentially expose private files to the public directory
  2. Not every installation needs the uploads folder. In general requiring it, points to having some legacy extension. Usage should fade out eventually.
  3. You can easily use kporras07/composer-symlinks to create additional symlinks of your choice

I know that some current projects will require such workarounds, but I suggest to see this as a motivation to get rid of such workarounds in future projects. :)

Same goes for legacy extensions that have public resources in some folder. Fine to temporarily use them and create the required symlinks, but better fix them or find alternatives soon.

Thanks a gain and keep the ideas, reports, pull requests coming.