Reedy has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/391380 )
Change subject: SECURITY: Create a .htaccess in /vendor after composer runs
......................................................................
SECURITY: Create a .htaccess in /vendor after composer runs
The /vendor directory does not need to be web accessible, and to reduce
attack surface, it should not be web accessible. We can use the
post-install-cmd and post-update-cmd hooks to create a .htaccess after
the user has run "composer install" or "composer update". On the first
run of composer, this hook will be invoked twice due to the composer
merge plugin.
If the htaccess file already exists, this hook won't do anything.
Bug: T180237
Change-Id: I2cf6541750c90b5708d7cf5f81b914ae2d9d46d1
---
M RELEASE-NOTES-1.27
M composer.json
A includes/composer/ComposerVendorHtaccessCreator.php
3 files changed, 49 insertions(+), 1 deletion(-)
diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27
index 1fb2380..9c40e39 100644
--- a/RELEASE-NOTES-1.27
+++ b/RELEASE-NOTES-1.27
@@ -25,6 +25,7 @@
* (T134100) SECURITY: Do not reveal if user exists during login failure.
* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
* (T125163) SECURITY: Make anchor for headlines escape > and <.
+* (T180237) SECURITY: Protect vendor folder with .htaccess.
== MediaWiki 1.27.3 ==
Due to a packaging error, the wrong version of the SyntaxHighlight extension
was
diff --git a/composer.json b/composer.json
index 52883d5..1bca405 100644
--- a/composer.json
+++ b/composer.json
@@ -68,7 +68,8 @@
},
"autoload": {
"psr-0": {
- "ComposerHookHandler": "includes/composer"
+ "ComposerHookHandler": "includes/composer",
+ "ComposerVendorHtaccessCreator": "includes/composer"
}
},
"scripts": {
@@ -77,6 +78,8 @@
"fix": "phpcbf",
"pre-install-cmd": "ComposerHookHandler::onPreInstall",
"pre-update-cmd": "ComposerHookHandler::onPreUpdate",
+ "post-install-cmd": "ComposerVendorHtaccessCreator::onEvent",
+ "post-update-cmd": "ComposerVendorHtaccessCreator::onEvent",
"test": [
"composer lint",
"composer phpcs"
diff --git a/includes/composer/ComposerVendorHtaccessCreator.php
b/includes/composer/ComposerVendorHtaccessCreator.php
new file mode 100644
index 0000000..cc2941a
--- /dev/null
+++ b/includes/composer/ComposerVendorHtaccessCreator.php
@@ -0,0 +1,44 @@
+<?php
+/**
+ * Copyright (C) 2017 Kunal Mehta <lego...@member.fsf.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/**
+ * Creates a .htaccess in the vendor/ directory
+ * to prevent web access.
+ *
+ * This class runs *outside* of the normal MediaWiki
+ * environment and cannot depend upon any MediaWiki
+ * code.
+ */
+class ComposerVendorHtaccessCreator {
+
+ /**
+ * Handle post-install-cmd and post-update-cmd hooks
+ */
+ public static function onEvent() {
+ $fname = dirname( dirname( __DIR__ ) ) . "/vendor/.htaccess";
+ if ( file_exists( $fname ) ) {
+ // Already exists
+ return;
+ }
+
+ file_put_contents( $fname, "Deny from all\n" );
+ }
+}
+
--
To view, visit https://gerrit.wikimedia.org/r/391380
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I2cf6541750c90b5708d7cf5f81b914ae2d9d46d1
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: REL1_27
Gerrit-Owner: Reedy <re...@wikimedia.org>
Gerrit-Reviewer: Legoktm <lego...@member.fsf.org>
Gerrit-Reviewer: Reedy <re...@wikimedia.org>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
