Re: A patch to keep cache directory out of webroot

Hello all,

Marcel - thanks for drawing this to my attention.

Alla - thanks for the patch and interest in xaraya security.

I've reviewed the patch and it looks good.  However, I'm going to 
propose that we address the problem identified by Alla another way, for 
other reasons.  The patch has great value for identifying the problem 
and what is required to fix it, but rather than applying it directly, I 
think we should learn from it and make similar, but slightly different, 
changes, as explained below...

Marcel van der Boom wrote:
> Jonn,
> 
> You should probably take this one. Couple of remarks:
> 
> - i think the cache location for the 'output' cache should be a mod var 
> for the cache manager module if possible

Unfortunately, not possible for a number of reasons.  For page caching, 
the output directory must be known before the modules are loaded.  For 
the most efficient page caching, the output directory must be know 
before xarCore is loaded.

We can, however, consider setting the output directory in the 
config.caching.php file which is read by both xarCache and xarCacheManager.

But this does not address the problem, which is the var/cache directory, 
so this alone is insufficient.

Side note: it is important to remember that the xarCacheManager module 
does no caching or cache serving.  It only helps set up the environment 
for xarCache, allows admin configuration of the variables xarCache 
operates with, and invalidates cache when changes are announced via hooks.

> - the cache location for compiled template can indeed be a config var, 
> but if possible i would like to keep it out of  config.system.php, using 
> our current value as the default in the absence of  config var.
> 

At this point we still have the problem of var/cache/rss and 
var/cache/adodb ...or any other writable directory placed under 
var/cache.  I would prefer that we solve the problem in one pass, as 
suggested by this patch.  However, it seems to me that it makes more 
sense to make the whole var directory movable, as has been the plan for 
some time but has been stalled for likely good reasons I am unfamiliar with.

Marcel - is there a bug on this, or something else we can be pointed to? 
  I did a quick search, but couldn't find it.  If there isn't, I'll 
submit a feature request so we can track it.

> Other than those, and given some more eyeballs, i dont see much problems.
> 
> marcel
> 
> 
> 
> Alla Bezroutchko wrote:
> 
>> Hello MrB or whoever is reading this,
>>
>> Here is a patch that allows a configurable location of cache 
>> directory, so it may be kept out of web root. As far as I can see it 
>> does not break anything, but I only tested my setup, so more testing 
>> is necessary I guess.
>>

Very cool idea.  What do you think of the idea of making the whole var 
directory movable to outside of the web root?

>> I create a new system config variable and then use it everywhere where 
>> the path to cache is needed.
>>
>> The patch is made against xaraya-0.9.10-full.
>>
>> Alla.
>>

Thanks again for the patch Alla - xarCache/xarCacheManager have already 
gone though some post-0.9.10 revisions - mostly cleanup and refactoring, 
but some design changes and bug fixes as well.  The submission of this 
patch indicates that you are familiar with BitKeeper.  I invite you to 
clone the actual xaraya repositories so that you can participate in code 
refinement with us in real time. It will make patch integration easier. 
Details:

http://xaraya.com:15000/


>>[...]
>>   */
>>  
>>  /**
>> + * Load the Xaraya core
>> + */
>> +
>> +/* Doing this before xarCache_init to have cache dir
>> + * configured via system config
>> + * This does not seem to break anything in my install
>> +*/
>> + +include 'includes/xarCore.php';
>> +
>> +
>> +/**
>>   * Set up output caching if enabled
>>   */
>> -if (file_exists('var/cache/output/cache.touch')) {
>> +
>> +
>> +$varCacheDir = xarCore_getSystemVar('CacheDir');
>> +if (file_exists($varCacheDir . '/output/cache.touch')) {
>>      include_once('includes/xarCache.php');
>>      // Note : we may already exit here if session-less page caching 
>> is enabled
>> -    if (xarCache_init(array('cacheDir' => 'var/cache/output'))) {
>> +    if (xarCache_init(array('cacheDir' => $varCacheDir . '/output'))) {
>>          define('XARCACHE_IS_ENABLED',1);
>>      }
>>  }
>>  
>>  /**
>> - * Load the Xaraya core
>> - */
>> -include 'includes/xarCore.php';
>> -
>> -/**
>>   * Main Xaraya Entry
>>   *
>>   * @access public

One thing to note here is that it is very important that xarCache get 
loaded before xarCore - on my dev box it means the difference of 98 
cached pages per seconded over 18 cached pages per second for 
session-less cached page serving.

>> [...]
>>  
>> +/*
>> + * This value tells the system where the cache directory is located
>> + * Thus it is possible to keep the writable cache directory
>> + * outside of web root. It is particularly useful on Windows/IIS
>> + * where a writable directory means an ability to upload files
>> + * It can be set to var/cache to have the cache in its normal place
>> +*/

Currently, in the absence of the ability to move it out from under the 
webroot, I recommend protecting var/ with mod_rewrite rules.  For apache 
servers, this can achieve the same security benefit.

I've heard that there is something similar to mod_rewrite for IIS. 
Unfortunately, I do not know anything about it, including whether or not 
it is capable of limiting unwanted access.

Note: the cache directories do not actually need to be world writable, 
only writable by the web server process owner.  If you have fine grained 
control of your Windows/IIS environment, you may be able to further 
limit your vulnerability with this information.

>> +
>> +$systemConfiguration['CacheDir'] = '/var/www/cache';
>> +
>>  
>>  /*
>>   * This value is used to change the default behavior of the

What do people say?  Are we up for finally making the var directory 
movable?  If we are, I'm up for being a part of it, and working out the 
issues that this will raise for xarCache.

Of course, I'm particularly interested in mikespub's thoughts/input.

  - Jonn