Why does a Joomla distribution still contain index.html in each folder?

Question

There has been an PR to remove the index.html files, but it was never applied. Why is that?

Answer 1

I feel like this is an "edge case" scenario. A large portion of Joomla users would be secure and safe without these files, but some people run Joomla on a mis-configured host (and some on a misconfigured host that won't let them reconfigure) which would display directory contents if the directory was requested. This file prevents that.

On a personal level, if you don't need the files, it is unnecessary bloat in the cms and you can remove them.

At the CMS level, I think that it solves a problem that can have major security issues with relatively minor bloat. (The files are usually empty or contain a tiny line of html.)

I can't speak to the exact reason that the PR was not accepted (since I don't even have that power, much less chat with the people that do); I think that the relative benefit to the community outweighs the bloat.

---

That being said there is an alternate method that I have heard mentioned at a few Joomla events about moving the majority of the files "up a level". The idea is to get all the files above the public_html directory so that the files could not be accessed directly. You would only want the index.php file, .htaccess file, and the images and media folders web accessible (to keep your CSS, JS, and images accessible.)

At this point, you rely less on a base server configuration and can more guarantee that the files won't be accessed inappropriately. This would have its own configuration issues (since now we need to access files above our "root").

All in all, I'm not sure that there is a more fool-proof plan to keep people secure without lots of issues than using index.html files. So if I was releasing a platform generally, I would stick to index.html files.

Answer 2

The reason for a index.html in each folder is to protect it for disclose information on mis-configured hosting environment.

If this is a real problem and should the cms consider that is another question.

Answer 3

To my knowledge, there was never a PR for that. There is a feature tracker (http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=30192) which is "ready for review". The patch only exists in a branch and isn't a PR. Thus this is likely the reason why it never was merged.

Or are you referring to another PR?