Re: proposal to remove replacements in PEAR2

Hi Greg, This sounds very good to me. A hard coded data dir will make things easier definitely. Also, I would like to propose the following things. -There is a recommendation to store the *public* web content of a package (e.g. index.php, css/*, javascripts/*, etc...) in a separate CVS/SVN directory. It should probably be called "public" vs "web" or "www", as a recommendation. This directory would be at the same level as "data" etc... This would keep some consistency across packages, and make some of us more aware of security considerations. - During the install process the web_dir content could be moved *by default* into <docroot>/pear/<package-name> which should be fine for many of us. - The web_dir role could probably be put in place before PEAR2 is implemented, this would be more than nice. Regards, MC ----- Original Message ---- From: Gregory Beaver <greg@chiaraquartet.net> To: PEAR Announce <pear-dev@lists.php.net> Sent: Friday, August 24, 2007 11:48:54 PM Subject: [PEAR-DEV] proposal to remove replacements in PEAR2 Hi all, After a lively discussion on IRC, I think we (Helgi, Josh, Chuck, Brett and I) may have a solution to the conundrum of using replacements in PEAR2 packages to locate data files and other non-php_dir files. The proposed solution is to eliminate the configurability of data_dir (meaning data_dir is always hard-coded at php_dir/data), and to add a new configurable location called www_dir. The reasoning behind this change is that data_dir is the only configuration variable used actively by the run-time programming code to locate non-PHP files, such as DB_DataObject's .ini files, HTML or JS files and so on. It is a best practice to keep all web frontend files in a separate location from your PHP files, to help avoid potential exploits by browsing to the library code, and so allowing www_dir to be a separate location solves this problem. www_dir is intended to make official the web_dir role created by the pearified.com/Role_Web package. What this will mean practically is that within code, one can always rely upon the data directory being in php_dir/data. If your package is PEAR2_Blah and you're in PEAR2/Blah.php, you can find the data.txt file via: $contents = file_get_contents(dirname(__FILE__) . '../data/PEAR2_Blah/data.txt'); This eliminates the need for any of the weird hacks I had proposed originally to locate data files for PEAR2. Comments? Does anyone actually NEED to be able to move data_dir to a different location for anything other than the need to have a separate www frontend? I will update the RFC on the wiki in 3 weeks to reflect this change if feedback is positive. Thanks, Greg -- PEAR Development Mailing List (http://pear.php..net/) To unsubscribe, visit: http://www.php.net/unsub.php ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/