Block direct access to ESDs

[samuelvogel]

The PHP setting is the default anyways, so restricting direct access should not be a problem.

[bcremer]

Looks fine to me, will check this later today.

[bcremer]

I would opt for using the default location for esd files:
location ^~ /files/552211cce724117c3178e3d22bec532ec/ {

This may not be the best choice shopware made for the default esd location but it's the default now. And this config should work out of the box for most users so setting the path to the default seems like a sane choice.

Maybe we should switch the default esd location and deprecate/remove the link download entirely but that's another issue.

[samuelvogel]

Ah ok, just found that. This snippet is from a config of a project which we started with Showare 4.1.3 where the default was sill /files/esds/ (and was never changed, since we blocked access from the beginning).

So yes, it should be merged with the new default path!

[bcremer]

May you please update the PR accordingly so I can merge it.

[samuelvogel]

Done!

[bcremer]

Thanks @samuelvogel 👍

[bcremer]

After merging I was thinking about creating a variable for the esd key to get rid of the hardcoded value in global/shopware.con.

# sites-available/example.com.conf
set $shopware_esd_key '552211cce724117c3178e3d22bec532ec';`

# global/shopware.con
location ^~ /files/$shopware_esd_key/ {
    internal;
}

Unfortunately that seems not possible with plain Nginx config.

Edit:
Created an issue for that: #9