Per the suggestion in the parent task, T180231
Can we make composer add a .htaccess file with Deny from all as a security measure?
Description
Description
Details
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Reedy | T180272 Release MediaWiki 1.27.4/1.28.3/1.29.2 | |||
| Resolved | demon | T169127 Release MediaWiki 1.30 | |||
| Resolved | Reedy | T168823 Tracking bug for 1.27.4/1.28.3/1.29.2 security releases | |||
| Resolved | Reedy | T180231 MW 1.27 and 1.28 require-dev versions of phpunit with known security issues | |||
| Resolved | Legoktm | T180237 Have composer create a .htaccess file in vendor director |
Event Timeline
Comment Actions
Yes, we can technically do this. Composer has post-install hooks like the one that composer-merge-plugin uses. We'd just need to write a simple PHP class that writes out the .htaccess file.
Comment Actions
Shouldn't need to really do much to backport the vendor patch...
1.27 and 1.28 were definitely borked
Comment Actions
This is a nice idea from a belt and suspenders point of view.
A much better long term fix would be to refactor MediaWiki core so that there is a distinct webroot directory that does not contain all of the PHP code and instead only exposes the entry point scripts. This was discussed at least tangentially in T167038: Separate "application" and "project" concerns.
Comment Actions
And for anyone following along in future... T180394: MediaWiki entry points should not be in the base repo directory
Comment Actions
Change 391427 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/vendor@REL1_30] Add .htaccess to disallow web access
Comment Actions
Change 391427 merged by Reedy:
[mediawiki/vendor@REL1_30] Add .htaccess to disallow web access
Comment Actions
Change 391428 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/vendor@master] Add .htaccess to disallow web access
Comment Actions
Change 391373 merged by jenkins-bot:
[mediawiki/extensions/FundraisingEmailUnsubscribe@master] Disallow web access to /vendor
Comment Actions
Change 391415 merged by Ejegg:
[mediawiki/core@fundraising/REL1_27] Create a .htaccess in /vendor after composer runs
Comment Actions
Change 391452 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@master] SECURITY: Create a .htaccess in /vendor after composer runs
Comment Actions
Change 391428 merged by jenkins-bot:
[mediawiki/vendor@master] Add .htaccess to disallow web access
Comment Actions
Change 391452 merged by Reedy:
[mediawiki/core@master] SECURITY: Create a .htaccess in /vendor after composer runs