updates folder used by c5

Permalink
I just found a really ugly problem. I wanted to apply a patch for c5.4.0.5 on a server and it just didn't work..

I modified the helper but it still showed the old behaviour. It took me a while to figure this out but it seems like Loader::helper pulls files from my updates directory:

This code:
$ps = Loader::helper('form/page_selector2');


shows me this error:
/home/usr/<customer-anme>/public_html/updates/concrete5.4.0.5/concrete/config/../helpers/form/page_selector2.php


I deleted the updaes folder and things are working fine now but it seems like the updates folder has the higher priority than the acutal core folder!

It seems like this is an intentional behaviour but I'm having a hard time to understand why this is helpful. Sure you can easily go back to an older version but having several c5 cores on one server seems a bit odd. (lots of providers have a limitation of file numbers).

This is going to be really messy imho.

Can't we just create a more advanced backup tool that zips the current concrete folder before the actual update? This would be a lot cleaner than having javascript includes that pull files from lots of different places..

Also, if there's a security issue in an old version of c5 it's going to stay there until someone removes the old core files..?

Remo