From 32fbfcee23dd61578118367d0c7befe43f715b6f Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Fri, 10 Nov 2017 16:05:13 -0800 Subject: [PATCH] Create a .htaccess in /vendor after composer runs The /vendor directory does not need to be web accessible, and to reduce attack surface, it should not be web accessible. We can use the post-install-cmd and post-update-cmd hooks to create a .htaccess after the user has run "composer install" or "composer update". On the first run of composer, this hook will be invoked twice due to the composer merge plugin. If the htaccess file already exists, this hook won't do anything. Bug: T180237 Change-Id: I2cf6541750c90b5708d7cf5f81b914ae2d9d46d1 --- composer.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/composer.json b/composer.json index f3d3fb6754..e67e59dfdd 100644 --- a/composer.json +++ b/composer.json @@ -71,7 +71,8 @@ }, "autoload": { "psr-0": { - "ComposerHookHandler": "includes/composer" + "ComposerHookHandler": "includes/composer", + "ComposerVendorHtaccessCreator": "includes/composer" } }, "scripts": { @@ -80,6 +81,8 @@ "fix": "phpcbf", "pre-install-cmd": "ComposerHookHandler::onPreInstall", "pre-update-cmd": "ComposerHookHandler::onPreUpdate", + "post-install-cmd": "ComposerVendorHtaccessCreator::onEvent", + "post-update-cmd": "ComposerVendorHtaccessCreator::onEvent", "test": [ "composer lint", "composer phpcs" -- 2.14.1