[RFC] give web user rights to /web

[craigh]

In order for zikula to function, we may need to force the installer to require that the /web directory have 0777 rights. We currently have an htaccess file to prevent php files from running there. We should probably also at least document how to secure the same for nginx (https://symfony.com/doc/current/setup/web_server_configuration.html#nginx)

Giving full rights to the directory could have other security implications which could be a problem. But these problems may be the same as any current issues we may have.

Making this change is non-symfony preferred.

Making this change would allow dynamic (and quite simple) installation of assets and other required files (e.g. web/js/*)

refs #3273

[craigh]

one suggestion was

give the directory to the web group, then use chmod g+w
or use setfacl

https://linux.die.net/man/1/setfacl

another was to create web/zikula and chmod 0777 this directory only. move all assets related to the dynamic parts of zikula here. and then use asset groups to facilitate this

{{ asset('your_path', 'zikula') }}

framework:
    assets:
         packages:
              zikula:
                    base_path: /zikula

if its your default you can:

{{ asset('your_path') }}

framework:
    assets:
         base_path: /zikula

[Guite]

Workaround for #3807 which is related: 78d9e04

[Kaik]

I do not think it is a good idea. As far as I understand this, the problem is because PHP does not have permissions to write to specified dir. I think problems with permissions/access are because the server (apache/ngix + PHP ) set up forces specific permissions that all dirs and files need to have to work properly. There are various ways of setting up how PHP works under apache/ngix and those implicate what permissions/groups a file or directory should have in order to work properly.
The additional problem comes to play using cli you can use cli both ways:

• via php script - depending on php setup as apache user
• directly via terminal - as logged in user

Of course, the easiest way is to chmod everything with 777 and whoever needs to write delete etc will be able to do it but that is wrong.

The best way is to add cli user to apache group or add apache to user group and perms for user and group this way only 775 only for relevant dir.

[craigh]

@Guite I think this can be closed since there is no longer a web directory and the publicdirectory is fully accessible by the http client now.