{"action":"created","issue":{"url":"https://api.github.com/repos/modxcms/revolution/issues/12490","labels_url":"https://api.github.com/repos/modxcms/revolution/issues/12490/labels{/name}","comments_url":"https://api.github.com/repos/modxcms/revolution/issues/12490/comments","events_url":"https://api.github.com/repos/modxcms/revolution/issues/12490/events","html_url":"https://github.com/modxcms/revolution/issues/12490","id":91673830,"number":12490,"title":"/core/packages should not be visible to public","user":{"login":"mdxthemes","id":1188042,"avatar_url":"https://avatars.githubusercontent.com/u/1188042?v=3","gravatar_id":"","url":"https://api.github.com/users/mdxthemes","html_url":"https://github.com/mdxthemes","followers_url":"https://api.github.com/users/mdxthemes/followers","following_url":"https://api.github.com/users/mdxthemes/following{/other_user}","gists_url":"https://api.github.com/users/mdxthemes/gists{/gist_id}","starred_url":"https://api.github.com/users/mdxthemes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdxthemes/subscriptions","organizations_url":"https://api.github.com/users/mdxthemes/orgs","repos_url":"https://api.github.com/users/mdxthemes/repos","events_url":"https://api.github.com/users/mdxthemes/events{/privacy}","received_events_url":"https://api.github.com/users/mdxthemes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2015-06-29T02:26:37Z","updated_at":"2015-07-16T11:18:12Z","closed_at":null,"body":"/core/packages should not be visible to public. I can simply put blank index.html file but it should come default with modx installation. \r\n\r\nGoogle search for \"index of /core/packages\"\r\n\r\nhttps://www.google.co.in/search?q=index+of+/core/packages/&ie=utf-8&oe=utf-8&gws_rd=cr&ei=rqyQVYCFLYXGuASylYLwCQ\r\n\r\nA default robot.txt would be good. \r\n\r\n# Robots.txt\r\nUser-agent: *\r\nDisallow: /connectors/\r\nDisallow: /core/\r\nDisallow: /manager/\r\nDisallow: /setup/"},"comment":{"url":"https://api.github.com/repos/modxcms/revolution/issues/comments/121928830","html_url":"https://github.com/modxcms/revolution/issues/12490#issuecomment-121928830","issue_url":"https://api.github.com/repos/modxcms/revolution/issues/12490","id":121928830,"user":{"login":"inreti","id":2852461,"avatar_url":"https://avatars.githubusercontent.com/u/2852461?v=3","gravatar_id":"","url":"https://api.github.com/users/inreti","html_url":"https://github.com/inreti","followers_url":"https://api.github.com/users/inreti/followers","following_url":"https://api.github.com/users/inreti/following{/other_user}","gists_url":"https://api.github.com/users/inreti/gists{/gist_id}","starred_url":"https://api.github.com/users/inreti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inreti/subscriptions","organizations_url":"https://api.github.com/users/inreti/orgs","repos_url":"https://api.github.com/users/inreti/repos","events_url":"https://api.github.com/users/inreti/events{/privacy}","received_events_url":"https://api.github.com/users/inreti/received_events","type":"User","site_admin":false},"created_at":"2015-07-16T11:18:12Z","updated_at":"2015-07-16T11:18:12Z","body":"> MODX has always focused on letting the user do whatever and allowing more or less anything.\r\n\r\nThat does not speak against choosing wise default settings and actions. Doing things right per default does not prevent you from doing whatever you want afterwards...\r\n\r\n> The MODX core itself is secure, highly secure.\r\n\r\nIf that would be a valid argument, why do we advise to move the core outside of the webroot? \r\nAnd even if we consider that for the pure core files, as long as /cache/ and /components (!) are stored inside the core directory, MODX is in charge of securing that too, regardless of where the core is placed. It's not always about hacking something, but also about data privacy.\r\n\r\nBesides - *nothing* should be considered *secure by default*. Don't get me wrong, that is no criticism about the core or MODX at all. It is a paradigm.\r\n\r\n> Most applications/CMF/CMSes like MODX does not provide any security options like this at all.\r\n\r\nThen we should not take them as an archetype... And: that is not true in general. Typo3, OwnCloud, Drupal, Piwik. They are all delivered with default .htaccess files for their core directory or - e.g. Piwik - automatically generate .htaccess files (all with contents quite the same as in PR #12503).\r\n\r\nWhy shouldn't MODX auto-provide such a file for the core directory at setup? Why would we force a user to accomplish an extra task after installation when it can be done easily (that is not complicated) during setup? It is exactly the same as deleting the setup folder after setup - it is done by default. And if not, the configcheck warns you about it..."}}