在生产部署中，您的 /app 文件夹不会位于公共 webroot 中；只需要一个粗心的失误，就能将 PHP 文件等私人企业资产变成网络上的明文。 高级 和 生产安装说明描述了如何拓扑隔离webroot目录，以便您可以使包含PHP文件的文件夹只有您自己可读。这种技术对我来说已经很有效一段时间了 - 但现在我想使用和开发插件。
CakePHP 书省略了生产部署中插件的讨论。 对于那些在生产中使用 CakePHP 插件的人来说，如何使给定插件的 webroot 目录中的资源可公开访问？
您是否在 webroot 中创建一个插件文件夹，然后将 plugins/my_plugin_name 符号链接到插件网络根目录？您是否手动将插件 webroot 文件夹复制到 webroot 中？您是否硬着头皮将插件文件夹重新定位到 webroot ？你使用某种奇特的内容供给插件吗？
最好的解决方案是什么？
In a production deployment, you wouldn't have your /app folder in the public webroot; it only takes one sloppy fingered mistake to turn private business assets such as PHP files into plaintext on the web. The advanced and production installation instructions in the book describe how to topologically isolate the webroot directory, so you can make folders containing PHP files readable only by you. This technique has worked great for me for a while - but now I want to use and develop plugins.
The CakePHP book omits the discussion of plugins in production deployments. For those of you that use CakePHP in production with plugins, how do you make the assets in a given plugin's webroot directory publicly accessible?
Do you create a plugins folder in webroot and then symlink plugins/my_plugin_name to the plugin webroot? Do you manually copy the plugin webroot folder into webroot? Do you bite the bullet and just relocate the plugins folder to webroot? Do you use some kind of fancy content feeding plugin?
What's the best solution?
发布评论
评论（1）
在我看来，您应该手动将文件从插件 webroot 复制到您自己的 webroot。如果它在生产中，我认为您不会频繁地打开/关闭插件（就像在开发中可能会做的那样），所以这将是一个一次性过程。
此外，这样做可以使您的私人资产远离可公开访问的文件夹，从而维护您所关心的安全性。
另一方面，
如果插件是开源的，那就采取简单的方法，将整个插件放在 webroot 中。如果它受到损害，您不必真正关心，因为无论如何文件都是自由分发的。
Sounds to me like you should manually copy files from the plugin webroot to your own webroot. If it's in production, I presume you aren't going to be turning the plugin on/off frequently (as one might do in development), so this would be a one-time process.
Also, doing it this way keeps your private assets out of publicly-accessible folders, maintaining the security you are concerned about.
On the other hand
If the plugin is open source, take the easy way out and drop that whole sucker in the webroot. If it get's compromised, you shouldn't really care, since the files are freely distributed anyway.