schema.sql on production systems
Permalink
In a recent network security screening of our production systems running concrete 5.4.1 we were flagged for having /concrete/config/install/schema.sql publicly viewable from any web browser. Based on this finding it has generated a discussion if the config or install directories should be publicly accessible or possible that the install directory should be removed after installation. Has anyone dealt with this issue?
Because concrete5 source code is available to anyone here and on github and that concrete5 lists the version number in the head of the served page, I don't really think that seeing the schema.sql really gives anyone anything special.
after concrete5 is installed, there are several checks that make sure that the installer cannot be run again, there is no risk with it being there.
