ProtectedUploads

Corex\Security\Upload\ProtectedUploads · class · Core layer

The directory uploaded personal data lives in, and the rules that keep a web server out of it (spec 081, FR-015). A CV somebody sent to one company is not a media-library asset. In uploads/ it gets a guessable public URL and shows up in every author’s media picker; the whole point of this directory is that neither is true. The deny rules are not the guarantee. They are configuration files, and CoreX cannot verify a server honours them — nginx ignores .htaccess entirely, and plenty of hosts disable AllowOverride. The guarantee is {@see \Corex\Security\Upload\AttachmentDelivery}, which checks the viewer before it reads a byte. These files are what stops a misconfigured server handing out a file the route would have refused, which is a real and common failure and worth two hundred bytes on disk.

Public API

ensure(): string

Ensure the directory exists and carries its deny rules. Called before every store rather than once on activation: activation hooks do not run when a plugin is updated by copying files over the old ones, and a directory that lost its .htaccess that way would be silently public until somebody noticed.

guard(string $path): bool

Make a folder and close it to a web server, wherever it is. For a folder CoreX keeps things in that are not for visitors and are not uploads: a release being installed lives beside uploads/, not in it, and wants the same three files.