ProtectedExportDirectory
Corex\Config\Export\ProtectedExportDirectory · class · Config layer
Exports hold personal data, so they are written where uploaded personal data is: the protected uploads directory, which a web server is told not to serve. A file leaves it only through a route that checks who is asking. Some hosts do not let PHP write to uploads at all: a read-only filesystem, or a web server running as a user that does not own the directory. There an export is written to the system’s temporary directory instead, which is not served either. It is saved by the browser as soon as it is ready; what such a host gives up is downloading it again later, once the system has cleared its temporary files.