Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: SQLite3 database file created in /public folder #3113

Closed
ramiresviana opened this issue Jun 17, 2020 · 5 comments
Closed

Bug: SQLite3 database file created in /public folder #3113

ramiresviana opened this issue Jun 17, 2020 · 5 comments
Labels
bug Verified issues on the current code behavior or pull requests that will fix them

Comments

@ramiresviana
Copy link

Describe the bug
When using database with SQLite3 as DBDriver parameter, the database file is created in the /public application folder.

CodeIgniter 4 version
4.0.3

Steps to reproduce

  1. Set database and DBDriver parameters in database configuration file.
  2. Create new table with CodeIgniter Forge;
  3. Database file is created in /public folder.

Expected behavior
Database files can contain private information and should not be created in the public folder by default.

Context

  • OS: Ubuntu 18.04.2
  • Web server: CodeIgniter Spark
  • PHP version: 7.2.24
@ramiresviana ramiresviana added the bug Verified issues on the current code behavior or pull requests that will fix them label Jun 17, 2020
@lonnieezell
Copy link
Member

You can change the location of the file using the $database value in the configuration for that connection. Give it a path and filename.

@ramiresviana
Copy link
Author

@lonnieezell the problem is not being able to change the location of the file, but rather the default path being the public folder. This is a undocumented behavior and can add a security flaw on applications that use CodeIgniter, not every developer is going to check where is the database is going to be write.

If a framework offers me sqlite support, i would expect that it will take some measures to protect the file from being leaked on the internet.

@lonnieezell
Copy link
Member

That's a fair point. And I guess it is default behavior inherited from CI3. I don't recall it having ever been changed, honestly.

We should set the default location in the writable folder somewhere that makes sense.

Thanks.

@lonnieezell lonnieezell reopened this Jun 17, 2020
@samsonasik
Copy link
Member

I think the directory can be named "writable/data"

@MGatner
Copy link
Member

MGatner commented Jun 23, 2020

Cross-referencing my opinion: #3151 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Verified issues on the current code behavior or pull requests that will fix them
Projects
None yet
Development

No branches or pull requests

4 participants