From 3143128798e7800f137be0647c25095bc4c6eb8e Mon Sep 17 00:00:00 2001 From: Twooey Date: Fri, 28 Aug 2026 11:11:11 -0400 Subject: [PATCH] Block web access to bookstore-core's tests/vendor/composer files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit They're bind-mounted straight into the webroot (docker-compose.*.yml) and nothing strips them on a git-checkout deploy, so php_fastcgi/file_server would otherwise execute/serve them directly. 404 instead of 403 so their existence isn't confirmed. Verified live against a scratch Caddy instance — plain `*` matches across path segments in Caddy 2.11.4 (the `**` token I first tried did not match nested paths at all). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg --- docker/caddy/Caddyfile.production | 8 ++++++++ docker/caddy/Caddyfile.staging | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/docker/caddy/Caddyfile.production b/docker/caddy/Caddyfile.production index bbb3293..9af403c 100644 --- a/docker/caddy/Caddyfile.production +++ b/docker/caddy/Caddyfile.production @@ -10,6 +10,14 @@ max_size 32MB } + # bookstore-core's tests/, vendor/, composer.json/.lock, and + # phpunit.xml.dist ship in the repo (and are bind-mounted straight into + # this container — see docker-compose.*.yml) so they exist under the + # webroot, but nothing about a git-checkout deploy strips them before + # they land here. 404 instead of 403 so their existence isn't confirmed. + @dev_only path /wp-content/plugins/bookstore-core/tests/* /wp-content/plugins/bookstore-core/vendor/* /wp-content/plugins/bookstore-core/composer.json /wp-content/plugins/bookstore-core/composer.lock /wp-content/plugins/bookstore-core/phpunit.xml* + respond @dev_only 404 + php_fastcgi wordpress:9000 file_server diff --git a/docker/caddy/Caddyfile.staging b/docker/caddy/Caddyfile.staging index 1090d81..c3dd553 100644 --- a/docker/caddy/Caddyfile.staging +++ b/docker/caddy/Caddyfile.staging @@ -37,6 +37,14 @@ max_size 32MB } + # bookstore-core's tests/, vendor/, composer.json/.lock, and + # phpunit.xml.dist ship in the repo (and are bind-mounted straight into + # this container — see docker-compose.*.yml) so they exist under the + # webroot, but nothing about a git-checkout deploy strips them before + # they land here. 404 instead of 403 so their existence isn't confirmed. + @dev_only path /wp-content/plugins/bookstore-core/tests/* /wp-content/plugins/bookstore-core/vendor/* /wp-content/plugins/bookstore-core/composer.json /wp-content/plugins/bookstore-core/composer.lock /wp-content/plugins/bookstore-core/phpunit.xml* + respond @dev_only 404 + php_fastcgi wordpress:9000 file_server }