Re: A patch to keep cache directory out of webroot

"Jonn Beames" <[email protected]> wrote in message
news:[email protected]...
> ...
> if the goal is to make it possible to operate with no writable
> directories under the webroot, then it seems to me the only pertinent
> question is whether the user's environment supports this, and their use
> of xaraya modules support this - if they want to upload files but don't
> want to use the uploads module, and they want to use a calendar module
> that require web accessible, writable files, then they can't operate
> without writable directories under the webroot so there is no value in
> moving it.

It's not so much about whether a directory is writable. The security issues
concern whether a [writable] directory is accessible from a web client or
not.

-- JJ