CRM_Utils_Check - Soften messages for read-only extensionsDir #11895
Conversation
When you have a non-writeable extensions directory, *two* status checks will copmlain about it (`checkDirsWritable`, `checkExtensions`). Between the two, `checkExtensions` is smarter.
There are competing schools of thought on whether extension folders should be web-writable: * Sometimes, the most active (or the only) admins are web-based. Making the folder writeable lets them keep extensions up-to-date through the web UI. This includes applying security-fixes for extensions. Thus, sites with writeable extdir are harder to attack (more secure). * Sometimes, the most active (or the only) admins don't use the web-based admin UI, and they don't trust any web-based users to do administration. They don't want the folder to be writeable. * If there's a flaw that allows writing to the filesystem, it could be escalated to writing+executing code. Thus, sites with read-only extdir are harder to attack (more secure). This commit tries to accept each scenario as valid -- but communicate better. Instead of flatly describing the read-only dir as erroreous, present a warning with some choice/trade-off.
|
👍 |
|
I like this: having the folder read-only will stand in the way of a feature (in-app extension installs and upgrades), but that feature isn't necessary for day-to-day operations and it might be intentionally blocked. I'm actually on the fence about whether it really should be a |
|
Agree with Andrew i think it should be a notice not a warning |
|
This change is contained within the extensions check subsystem & I think the above endorsements are enough to merit merging |
|
Looks like it got merged as a warning, not a notice. I would have preferred it be a notice too. Another reason to keep it unwritable is because we need to patch extensions and we can't fork and use our own private source if it was web-writable. |
|
@herbdool the fix softened it to a warning - I'm happy to accept a patch that softens further if people think that makes sense - I think I do agree with that |
Overview
The
extensionsDiris a configurable folder where extension source-code can be written.The folder may be managed with a few policies:
The web-writable policy is generally the default (because it's easier to get extensions and apply security updates), but it's no panacea. This PR improves messaging when someone has a different policy.
Before
There are redundant messages ("Directory not writeable"), and they strongly push the admin toward web-writable policy.
After
There is only one message ("Read-Only Extensions"). It still encourages web-writable policy, but it lowers the severity and presents it a choice ("if you want X, do Y").
Comments
A few folks have raised related conversations before. Please feel free to comment or thumbs-up/down. CC @xurizaemon @bgm @agh1 @MegaphoneJon