My deploy of symfony stopped to work #47257
-
Symfony version(s) affected5.4.11 DescriptionWarning: require(WEBROOT/src/config/bundles.php): failed to open stream: No such file or directory The problem is produced by fact that I do not upload to the web server any file that is not directly required for the execution. It is a risk to share the list of library versions on the web server. It is minor issue that I can workaround by emptying the content of the file. It would be important to document that fact in visible place. How to reproduceCreate new project. Possible SolutionThe possible alternative would be to let developer:
Additional ContextThe expose of composer.json and composer.lock can be seen as a security risk. As it is completely normal to have those files in dev environment of CI build environment. That exposing those or risking exposing to the public can bring damage as it will make easier to find potential vulnerabilities and exploit them. |
Beta Was this translation helpful? Give feedback.
Replies: 1 suggested answer 1 reply
-
Deploying them does not mean exposing them. Those files should not be placed in your webroot. And neither should your framework configuration, your vendor directory or your src folder. In fact, composer.json and composer.lock don't contain any information that could not be reconstructed from the vendor directory, so not deploying them because security is kinda pointless. That being said, if you still don't want to deploy them, override the |
Beta Was this translation helpful? Give feedback.
-
|
I replaced content of that file with dummy that Symfony can find it. I hope you will not plan to use that content in production environment. |
Beta Was this translation helpful? Give feedback.
Deploying them does not mean exposing them. Those files should not be placed in your webroot. And neither should your framework configuration, your vendor directory or your src folder. In fact, composer.json and composer.lock don't contain any information that could not be reconstructed from the vendor directory, so not deploying them because security is kinda pointless.
That being said, if you still don't want to deploy them, override the
getProjectDir()method of your kernel to fix your problem. It's probably a good idea to do so either way.