keystonejs/keystone-classic

Make less files not publicly available

Open

#1,639 opened on 2015年9月2日

GitHub で見る
 (1 comment) (0 reactions) (0 assignees)JavaScript (14,656 stars) (2,288 forks)batch import
bughelp wanted

説明

Every file under /public/styles/ is available through http when keystone is running.

Since *.less files could be considered as a part of the source code, could we move them to another location, e.g. /templates/styles/ to protect them from being available publicly?

It may be a good idea to keep /public/ folder only for files that are required during runtime, and keep source files elsewhere.

コントリビューターガイド

技術スタック
javascriptnodejscss
領域
securitybackend
Issue 種別
security
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
3
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
1-3 hours
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
stale
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
clear
前提条件
Keystone file structureLess CSSNode.js static serving
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
65
調査方針
Investigate the current file structure under /public/styles/ and /templates/ to understand how Keystone serves static assets. Identify all references to style files in the application (e.g., in templates, layout files, or server configuration) that would need updating after the move. Check if there are any existing mechanisms to prevent public access to certain file types, and consider if a more general solution (like a .htaccess or middleware) is preferred. Review any comments on the issue for maintainer guidance on the desired approach.
Make less files not publicly available · keystonejs/keystone-classic#1639 | Good First Issue