T180237-REL1_28.patch
Reedy (Sam Reed)
Actions

Authored By

	Reedy
	Nov 11 2017, 12:26 AM

Size

1 KB

Referenced Files

None

Subscribers

None

T180237-REL1_28.patch
View Options

	From 32fbfcee23dd61578118367d0c7befe43f715b6f Mon Sep 17 00:00:00 2001
	From: Kunal Mehta <legoktm@member.fsf.org>
	Date: Fri, 10 Nov 2017 16:05:13 -0800
	Subject: [PATCH] Create a .htaccess in /vendor after composer runs

	The /vendor directory does not need to be web accessible, and to reduce
	attack surface, it should not be web accessible. We can use the
	post-install-cmd and post-update-cmd hooks to create a .htaccess after
	the user has run "composer install" or "composer update". On the first
	run of composer, this hook will be invoked twice due to the composer
	merge plugin.

	If the htaccess file already exists, this hook won't do anything.

	Bug: T180237
	Change-Id: I2cf6541750c90b5708d7cf5f81b914ae2d9d46d1
	---
	composer.json \| 5 ++++-
	1 file changed, 4 insertions(+), 1 deletion(-)

	diff --git a/composer.json b/composer.json
	index f3d3fb6754..e67e59dfdd 100644
	--- a/composer.json
	+++ b/composer.json
	@@ -71,7 +71,8 @@
	},
	"autoload": {
	"psr-0": {
	- "ComposerHookHandler": "includes/composer"
	+ "ComposerHookHandler": "includes/composer",
	+ "ComposerVendorHtaccessCreator": "includes/composer"
	}
	},
	"scripts": {
	@@ -80,6 +81,8 @@
	"fix": "phpcbf",
	"pre-install-cmd": "ComposerHookHandler::onPreInstall",
	"pre-update-cmd": "ComposerHookHandler::onPreUpdate",
	+ "post-install-cmd": "ComposerVendorHtaccessCreator::onEvent",
	+ "post-update-cmd": "ComposerVendorHtaccessCreator::onEvent",
	"test": [
	"composer lint",
	"composer phpcs"
	--
	2.14.1

Attached To	Mode
T168823: Tracking bug for 1.27.4/1.28.3/1.29.2 security releases	Attached	Detach File
T180237: Have composer create a .htaccess file in vendor director	Attached	Detach File