4 ms·
That's why you do symlink-based deployments with PHP. It works just fine and is also not a problem unique to PHP. PHP itself doesn't follow filesystem-based ro
by janosdebugs 3y ago
That's why you do symlink-based deployments with PHP. It works just fine and is also not a problem unique to PHP.
PHP itself doesn't follow filesystem-based routing, your webserver config does. PHP just executes what th webserver tells it to. Most PHP applications written in the last 10 years use a single entry point and are no longer prone to the attacks you are describing.
- Nextgrid 3y agoYes it's true that proper config can make this problem go away, but the fact that some of the advantages of PHP such as ease of deployment (drop a .php file -> you have a webapp) is a double-edged sword as it encourages a lot of bad practices (that large legacy projects such as Wordpress continue promoting). It's indeed possible (and quite pleasant) to do proper PHP with a good framework, sane web server config & modern development practices. The problem is that a sizeable chunk of the PHP ecosystem (and very popular projects such as Wordpress) are not doing that.
- 0xblinq 3y agoThis. I love php, and especially Laravel. But the Wordpress community continues in the Stone Age of the development practices.