[3.x] public access to /composer.json

[alexsoin]

Bug report

After installing modx3, there is public access to http://sitename.com/composer.json, which can affect security, as anyone has a list of installed packages and their versions.

[sdrenth]

I think it might be a good idea to make the repository contain both a public_html and a private folder, where the core directory is stored inside /private/core/ and the composer file inside /private/core/composer.json. The public_html name can be easily changed to the desired structure (E.g. public_html/httpdocs etc).

This way:

1. The composer.json no longer is publicly available by default.
2. The composer.json file location can also depend on the same setting as the MODX_CORE_PATH.
3. You'll be able to make the MODX installation less secure by moving the core directory into the webroot. So if your server configuration only allows access to the public_html directory you'll be able to move the core directory into the webroot again.

Now its the other way around, by default MODX is less secure and you'll have to harden the installation yourself by moving the core folder. Wouldn't it be nicer if the MODX installation by default is more secure and that a manual action is needed to make it less secure.

[JoshuaLuckers]

Great suggestion(s)!

Some things to consider:

1. If we add a "public" directory a "private" directory isn't necessary.
2. In most cases MODX will be installed in the web root.
   Unless the "public" directory is the actual web root we still have to to block access to non-public directories and files like composer.json.
3. How do we migrate the "old" directory structure to the new one for users upgrading?