Difference between revisions of "Vendor directory security check"
From Learnit docs
(Created page with "{{Security overview report}} '''The vendor directory should not be present on public sites.''' The directory <tt>vendor</tt> inside the Moodle dirroot contains various third...") |
(Removed redirect to Vendor directory security check) (Tag: Removed redirect) |
| (One intermediate revision by the same user not shown) | |
(No difference)
| |
Latest revision as of 11:16, 16 May 2019
Template:Security overview report
The vendor directory should not be present on public sites.
The directory vendor inside the Moodle dirroot contains various third-party libraries and their dependencies, typically installed by the PHP Composer. It may be needed for local development, such as for installing the PHPUnit framework. But it can also contain potentially dangerous code exposing your site to remote attacks.
It is strongly recommended to remove the directory if the site is available via a public URL, or at least prohibit web access to it.
