Re: A patch to keep cache directory out of webroot

Marcel van der Boom wrote:
>[...]
> And managed by xarCacheManager i assume?  Let me rephrase a bit what i 
> meant. The location should be a modvar for the xarCacheManager module, 
> just like all the other settings. config.caching.php is currently the 
> way we have to store these variables during runtime (note the 'currently').
> I actually thought the other settings were already modvars in 
> xarCachemanager, am i wrong?
> 

Yes, the xarCacheManager module is intended to manage the values in 
config.caching.php.  xarCache only cares about the values in this file. 
  modvars are used for other settings related to module flushing of 
cache, but are not adequate for the xarCache settings as xarCache 
sometimes does its job without ever making a database connection.

You are correct in noting that the config.caching.php values are stored 
in modvars as well.  This was a change added post 0.9.10.  These values 
are now stored as modvars for safe keeping but are not read unless the 
config.caching.php file goes missing, at which point it can be 
regenerated from config.caching.php.dist and the values in the modvars.

>[...]
> 
>> Marcel - is there a bug on this, or something else we can be pointed 
>> to?  I did a quick search, but couldn't find it.  If there isn't, I'll 
>> submit a feature request so we can track it.
> 
> As far as i know there is no bug on this.
> 
> 
OK, I've added one:

http://bugs.xaraya.com/show_bug.cgi?id=3440

>>> Other than those, and given some more eyeballs, i dont see much 
>>> problems.
> 
> That was a bit of an understatement probably.  If we are going all the 
> way, this should be a scenario in which we clearly define what the 'var' 
> directory is for, because it is now a bit of a catch all for things that 
> need to be writable.
> I would, for example, like to make a distinction between the 'data 
> storage' part which is under the var directory (the workflow module for 
> example, and the messaging templates) and the ' cache like' storage for 
> templates and output.
> 
> RSS is a whole other story i think. Also, only recently i elminated the 
> need for rsd.xml in the var directory. Are we ready to take this problem 
> as a whole?
> 
> marcel
> 
> T
> 

Hmm, I do see the difference you are delineating, but I'm not convinced 
it is relevant to the movable var/security issue:

if the goal is to make it possible to operate with no writable 
directories under the webroot, then it seems to me the only pertinent 
question is whether the user's environment supports this, and their use 
of xaraya modules support this - if they want to upload files but don't 
want to use the uploads module, and they want to use a calendar module 
that require web accessible, writable files, then they can't operate 
without writable directories under the webroot so there is no value in 
moving it.

Not to discourage organization and differentiation/distinction in the 
system, just wanting to stay on target with the problem to be solved.

  - Jonn