Security issues during auto-upgrade

[brankoajzele]

During auto-upgrade from admin when upgrade starts and shows the

[2016-01-29 08:46:06 UTC] Job "maintenance_mode {"enable":true}" has been started
[2016-01-29 08:46:06 UTC] Magento maintenance mode is enabled.
[2016-01-29 08:46:06 UTC] Job "maintenance_mode {"enable":true}" has successfully completed
[2016-01-29 08:46:06 UTC] Job "update {"components":[{"name":"magento/product-community-edition","version":"2.0.2"}]}" has been started
[2016-01-29 08:46:06 UTC] Starting composer update...
[2016-01-29 08:46:06 UTC] ./composer.json has been updated

if at this point you go to storefront, you get to see things like https://db.tt/JkHlhi3P and this https://db.tt/pWDHbEgS.
In this case I was doing Magento 2.0.1 to 2.0.2 upgrade, but the same thing happened to me when I was doing 2.0.0 to 2.0.1 upgrade.
This lasts for around 30-40 seconds, during which you can see folder listing and errors. At no point have I actually seen maintenance page.

I am using Apache server with basically default setting, and PHP 5.6.

Happy to provide more info if needed, but I think you should be able to replicate it on your own.

[mazhalai]

This is by nature how composer upgrade works. The contents are removed from vendor folder and then replaced. During this time the code used to check for maintenance mode is being replaced as well. We have created ticket MAGETWO-48562 to figure out a workaround.

[ktomk]

The first screen-shot you've got shows that you have set-up Magento for development, not production.
Your web-server points to the project root and not the web root (pub folder). I highlighted this a little:

Can you please configure your web-server to point to the pub folder instead and reproduce the issue?

[mazhalai]

@ajzele this issue is considered fixed, since we have specific instructions for enabling maintenance when upgrade takes place. Please read http://devdocs.magento.com/guides/v2.0/comp-mgr/trouble/cman/maint-mode.html for more information.

Please create a new issue, if problems persist.