With CSS-JS-Booster calls it is possible to access webroot and non webroot files like /etc/passwd or any php file that contains passwords and such.
In my fork i double check the file extension and file mime type (though javascript and css files doesn't have specific mime types...)
But i think the best would be to have configuration files (in json format) that stores the file groups, passing the files group to uri is very dangerous as said by zoompf http://zoompf.com/blog/2009/12/the-challenge-of-dynamically-generating-static-content.
And he's right because in default version of css js booster we can access the whole filesystem !
With CSS-JS-Booster calls it is possible to access webroot and non webroot files like /etc/passwd or any php file that contains passwords and such.
In my fork i double check the file extension and file mime type (though javascript and css files doesn't have specific mime types...)
But i think the best would be to have configuration files (in json format) that stores the file groups, passing the files group to uri is very dangerous as said by zoompf http://zoompf.com/blog/2009/12/the-challenge-of-dynamically-generating-static-content.
And he's right because in default version of css js booster we can access the whole filesystem !