8

There has been an PR to remove the index.html files, but it was never applied. Why is that?

9

I feel like this is an "edge case" scenario. A large portion of Joomla users would be secure and safe without these files, but some people run Joomla on a mis-configured host (and some on a misconfigured host that won't let them reconfigure) which would display directory contents if the directory was requested. This file prevents that.

On a personal level, if you don't need the files, it is unnecessary bloat in the cms and you can remove them.

At the CMS level, I think that it solves a problem that can have major security issues with relatively minor bloat. (The files are usually empty or contain a tiny line of html.)

I can't speak to the exact reason that the PR was not accepted (since I don't even have that power, much less chat with the people that do); I think that the relative benefit to the community outweighs the bloat.


That being said there is an alternate method that I have heard mentioned at a few Joomla events about moving the majority of the files "up a level". The idea is to get all the files above the public_html directory so that the files could not be accessed directly. You would only want the index.php file, .htaccess file, and the images and media folders web accessible (to keep your CSS, JS, and images accessible.)

At this point, you rely less on a base server configuration and can more guarantee that the files won't be accessed inappropriately. This would have its own configuration issues (since now we need to access files above our "root").

All in all, I'm not sure that there is a more fool-proof plan to keep people secure without lots of issues than using index.html files. So if I was releasing a platform generally, I would stick to index.html files.

7

The reason for a index.html in each folder is to protect it for disclose information on mis-configured hosting environment.

If this is a real problem and should the cms consider that is another question.

  • 1
    In fact, it used to be a requirement at JED – Anibal Apr 25 '14 at 20:30
0

To my knowledge, there was never a PR for that. There is a feature tracker (http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=30192) which is "ready for review". The patch only exists in a branch and isn't a PR. Thus this is likely the reason why it never was merged.

Or are you referring to another PR?

  • Thanks for finding this JC tracker, thought there was a PR mentioning the removed files, but maybe that was wishfull thinking. Don't recall the proposed changes to .htaccess or the patch. – sovainfo Apr 25 '14 at 23:13
  • Shouldnt that have been a comment rather than an answer? – jo-erlend Apr 26 '14 at 3:59
  • It's the correct answer to the question :) – Bakual Apr 26 '14 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.