Bug 26140 - .tt template files should be deployed separately from static assets
Summary: .tt template files should be deployed separately from static assets
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-08-05 07:23 UTC by David Cook
Modified: 2020-08-06 01:36 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2020-08-05 07:23:38 UTC
At the moment, Koha deploys Template::Toolkit *.tt files to /usr/share/koha/intranet/htdocs and /usr/share/koha/opac/htdocs. Those are the directories (ie DocumentRoot) from which Apache serves static files.

If you type in http://<mykoha>/opac-tmpl/bootstrap/en/modules/opac-main.tt, Apache will serve you the template file.

It's not really a security issue per se, but it's completely unnecessary. 

It would be better to store templates somewhere like /usr/share/koha/tt/intranet and /usr/share/koha/tt/opac.
Comment 1 David Cook 2020-08-05 07:24:51 UTC
Once we move the .tt files out of the "htdocs" directories, it will also be easier to determine how many static assets Koha has.
Comment 2 Marcel de Rooy 2020-08-05 11:09:30 UTC
What about adding one line in Apache to stop it instead of moving hundreds of files in git ?
Comment 3 David Cook 2020-08-05 11:46:12 UTC
(In reply to Marcel de Rooy from comment #2)
> What about adding one line in Apache to stop it instead of moving hundreds
> of files in git ?

That stops it from serving the files, but it doesn't really fix the structure of the project. 

There are other assets that are included in this as well like .scss files, .xsl files, etc.
Comment 4 David Cook 2020-08-05 11:53:06 UTC
(In reply to Marcel de Rooy from comment #2)
> What about adding one line in Apache to stop it instead of moving hundreds
> of files in git ?

If I recall correctly, it shouldn't matter to git if the files are moved.
Comment 5 Marcel de Rooy 2020-08-05 12:19:45 UTC
(In reply to David Cook from comment #4)
> (In reply to Marcel de Rooy from comment #2)
> > What about adding one line in Apache to stop it instead of moving hundreds
> > of files in git ?
> 
> If I recall correctly, it shouldn't matter to git if the files are moved.

Git should be able to apply a commit referring to the old location.
With history, you need to remember to add the --follow flag to see the old commits for the former location. Humans tend to remember badly ;)
Comment 6 David Cook 2020-08-06 01:07:14 UTC
(In reply to Marcel de Rooy from comment #5)
> Git should be able to apply a commit referring to the old location.
> With history, you need to remember to add the --follow flag to see the old
> commits for the former location. Humans tend to remember badly ;)

That's true. I figured that's probably what you meant, but figured I'd ask anyway.

I know that re-structures are really hard to do with a project of this size and age, but I think that they're still worth doing.
Comment 7 David Cook 2020-08-06 01:10:25 UTC
Maybe a more feasible path forward would be to start putting "new" templates into a "new" filesystem path. 

C4::Template::_get_template_file() could look in both locations. 

Looking at it now, I see that has consequences for translations though...
Comment 8 David Cook 2020-08-06 01:16:20 UTC
Actually, I should've realized before, but the smarter thing would be not moving the template files, but rather moving the static assets, and then changing Apache's DocumentRoot.
Comment 9 David Cook 2020-08-06 01:30:36 UTC
(In reply to Marcel de Rooy from comment #2)
> What about adding one line in Apache to stop it instead of moving hundreds
> of files in git ?

In hindsight, I didn't actually say we should move the files in git, but your question got me thinking that was what we were talking about.

Originally, I was actually talking about the "deployment" path rather than the "source" path. 

We could change the Makefile.PL to put the static assets somewhere different. That would be the most minimal change.

Although we'd still need to update templates and potentially other files to point to the new paths.
Comment 10 David Cook 2020-08-06 01:36:33 UTC
Maybe... it is too hard to change the ageing monolith.

I guess at a bare minimum maybe we should just stop serving .tt pages through the web server...