Add a variable for Composer's vendor directory path

[gmclelland]

Short description of the enhancement

Can you add a variable that allows the user to the move Composer's vendor directory?

Current vs. suggested behavior

Currently Processwire autoloads the vendor libraries from the site root /vendor directory. https://github.com/processwire/processwire/blob/50f2834a0ae2a9f9f2ac53439184ebdc04db2f54/index.php#L30

I'm suggesting adding a variable that can be set in config.php, so that the user can move Composer's vendor directory outside of the web root to a place that is not web accessible.

Why would the enhancement be useful to users?

Why would I want to do this? ...for security. I don't want script kiddies trying to scan for/exploit vulnerabilities in my installed php libraries.

[szabeszg]

At least ProcessWire's .htaccess should protect it.

[gmclelland]

Hmm... I'm not sure. I created a test.php inside the vendor directory and then navigated to it in my browser and it executed the php file and it echoed Hello World.

[szabeszg]

What I meant was that it should do it because currently it does not do it, just as you say. Sorry for not being clear.

[teppokoivula]

What I meant was that it should do it because currently it does not do it, just as you say. Sorry for not being clear.

While this does definitely make sense (although it won't make the original suggestion invalid), please note that this could be a major breaking change, in case anyone has files in the vendor directory that actually need to be web accessible.

I must admit that I'm not sure how widespread issue that would be. From what I can tell from some quick Googling, some composer packages definitely come with their own styles, scripts, etc. so those would be unusable, unless specifically made available by tweaking said htaccess rules. Unless, of course, we assume that only PHP / other predefined types of files require protection? :)

Note: some folks at a related discussion in the Drupal issue tracker considered having a public vendor directory a critical issue, so this is definitely something that we should deal with somehow.

[LostKobrakai]

We could at least go the way and have the rule commented out in the base .htaccess, similar to e.g. the https rules.

[elabx]

Hi! I have encountered this situation but for a different reason, I have several sites installed in a server and they all share the same composer packages. I'd love if we could configure the path to the vendor folder so I could install packages globally for the server's user.

[LostKobrakai]

The difficulty of having the include path configurable in pw would probably be order of execution. The composer packages are loaded in the index.php so even far before the config.php comes into play. Also as a user I'd expect composer packages to be usable in the config.php, so they need to be already loaded. There might be an argument to be made, that composer including can be postponed until the ProcessWire Core is initiated or ready (init/ready.php is called), but that would make developing plugins with composer packages more complex I'd imagine. Also I feel like that it's more a infrastructure decision to have only one vendor folder, so symlinks might be the more appropriate solution.

[horst-n]

+1 for symlinks. (or junctions on windows)

[gmclelland]

Maybe this should be a new/separate issue, but I think we should add a rule to the .htaccess file by default that makes the vendor folder non web accessible? I know it could be potentially breaking, but I would rather have the added security protections.

Here's an a Drupal example of php libraries in a module being exploited. https://www.drupal.org/node/2765575 Same thing could happen with Processwire sites with php libraries installed and web accessible from the vendor directory. Fortunately, php files that are in Processwire modules are not web accessible and are blocked by Processwire's .htaccess file.

Here is the issue in Drupal https://www.drupal.org/project/drupal/issues/2508591 - vendor/ is web accessible. It explains what Drupal 8 did to solve the issue.

LostKobrakai, thanks for the explanation above.

[ryancramerdesign]

@gmclelland This should already be a configurable path as it is defined in PW's /index.php file, which is a file that is outside of the core /wire/ directory and so is a file that can be edited per site. I think not many people need to modify it, but just wanted to mention that it a file that is meant to be customized as needed.

[gmclelland]

Thanks Ryan! Closing this issue.

[jlahijani]

Here's a quick snippet to block the vendor directory in using Apache .htaccess. Place right above 15B:

# Block all http access to the default composer vendor directory
RewriteCond %{REQUEST_URI} ^/vendor/ [NC]
RewriteRule ^.*$ - [F,L]

---

Alternatively, you could make this part of 15A by replacing this (perhaps this is slightly more performant, but requires 2 changes):

  # Block all http access to the default/uninstalled site-default directory
  RewriteCond %{REQUEST_URI} (^|/)site-default/

with this:

  # Block all http access to the default/uninstalled site-default directory
  RewriteCond %{REQUEST_URI} (^|/)site-default/ [OR]

  # Block all http access to the default composer vendor directory
  RewriteCond %{REQUEST_URI} ^/vendor/ [NC]