compress.php shouldn't be accessible from the Internet about mpdf

[finwe]

Pretty good point, but the script works only with mpdf.php renamed to mpdf_source.php which is not present in the repository unless the user renames it manually, which would mean knowing what he/she is doing. So I guess this is more of a users concern and can be solved correctly with potential future code cleanup.

I have reposted this to the official forum http://www.mpdf1.com/forum/discussion/2376/compress-php-should-not-be-accessible-from-the-internet

[jkuchar]

Thanks! Because author do not use GitHub, should I close issue here?

Out of topic: You do not wanna know what happens when you run PHP Mess Detector on this project. :-) (or https://styleci.io)

[finwe]

I'd leave it open so it shows up when the cleanup is started. We hope to move the development to more community-driven manner but it can still take some time. The official github repository is a start.

I know what happens when I run my own eyes on the project, I don't need a PHPMD for that ;-)

[danielhjames]

Hi Jan, thanks for the tip!

I have updated the documentation http://sourcefabric.booktype.pro/booktype-20-for-authors-and-publishers/installing-a-pdf-renderer/ to suggest making the mPDF directory owned by root.

Then, even if the mPDF directory which contains compress.php and mpdf.php was served by Apache (which is not necessary in the case of Booktype, as we only use the cli), a user on the Internet side should not be able to write a new mpdf.php file in this directory. The user only needs write access to the graph_cache/ and tmp/ and ttfontdata/ subdirectories in order to generate PDFs.

Cheers!

Daniel