Bug #68918
closed
Move vendor/ directory out of typo3/
100%
Description
The typo3/ directory must currently be exposed in the web root for TYPO3 to work properly.
Having the vendor dir with all composer dependencies in typo3/vendor however means, that
these will also be exposed. This can be a security risk, which can be avoided by simply
moving the vendor directory one level up.
By doing so, a web directory which contains only two symlinks (typo3 and index.php) and no
sources or link to the sources, will be protected from this risk.
Updated by Gerrit Code Review over 8 years ago
- Status changed from New to Under Review
Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/42495
Updated by Gerrit Code Review over 8 years ago
Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/42495
Updated by Helmut Hummel over 8 years ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset 554653e5055630f3c742f8242f43b717ab6f368e.
Updated by