4 ms·
More to that point, see https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt
by ughitsaaron 4y ago
More to that point, see https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt
- stefan_ 4y agoIs this a normal Drupal practice? You just deploy the Git repo?
- extheat 4y agoDo you deploy confidential information into the repo ? That would be the root problem.
- mynameisvlad 4y agoThings don't have to be confidential to be an issue. Leaking the actual maintainer's names (as opposed to the Drupal list), for instance, would not necessarily be considered confidential, but still an issue if it showed up.
- verbify 4y agoUsually passwords or keys are stored in a config file, and that is stored in a place outside the repo.
- chrismeller 4y agoI think, generally speaking, it’s a PHP standard practice and more broadly a scripting language practice, though it doesn’t really apply to Node. No pre-compiling is required, so you just ship the files. Especially true for anything that offers an Apache module (like mod_php).
- remram 4y agoShip the files sure, ship the top-level folder not really. Most sites will have a "public" subfolder or equivalent, so the READMEs, scripts, sources etc don't get served. Either way, a professional would remove those files or block them at the HTTP server level.
- chrismeller 4y agoEhhh, I don’t know if I agree that most will have anything.
- rbanffy 4y ago> more broadly a scripting language practice, I can tell you it's not the case with Python.
- chrismeller 4y agoInteresting, because that and mod_python were what I was thinking of aside from PHP. What’s the workflow there like?
- rsynnott 4y agoWell, I mean, that might have been somewhat standard practice with mod_python the last time anyone used mod_python, which I would assume was about 15 years ago. Looks like it's been dead since 2010: https://en.wikipedia.org/wiki/Mod_python https://en.wikipedia.org/wiki/Mod_python In practice, I think modern Python webapps usually use WSGI or similar, where you wouldn't be just dumping a bunch of files somewhere.
- chrismeller 4y agoModern PHP apps also would be using Nginx and phpfpm, but it ends up being the same - copying files over.
- rsynnott 4y agoSo the unusual thing about PHP (and, historically, mod_python, and CGI for that matter) is that it's normal to have the code actually under the web server's content directory tree. That is, if your content root is /var/www, then you put your code at /var/www/thing.php, so a deployment involves copying stuff into /var/www, and if the server is misconfigured, going to "https://example.com/thing.php https://example.com/thing.php" will actually show you the code. For, say, Java or Ruby web apps, your code is more likely to live elsewhere (people love to fight over exactly _where_...), and run its own web server; nginx or apache or whatever will then proxy requests to that webserver. No matter how it's configured, you're never going to show the end-user the code, or extraneous files like .gitignore. Python's a bit of a corner-case (or at least it used to be last time I worked with Python webapps about a decade ago); it's customary to use WSGI or similar rather than a proper web server, but the effect is much the same.
- Aeolun 4y agoI don’t know, my servers are generally configured to serve nothing more than the index.php file and anything in the /public directory. I don’t serve up the entire content repository.
- ughitsaaron 4y agoYou can compare it to the current version of the same file in the most recent Drupal release https://github.com/drupal/drupal/blob/9.5.x/core/MAINTAINERS.txt https://github.com/drupal/drupal/blob/9.5.x/core/MAINTAINERS...
- chx 4y agoD10 will be out soon :)