30,997
edits
Language and development rules: Difference between revisions
Jump to navigation
Jump to search
m
→About composer
m (→About composer) Tag: 2017 source edit |
m (→About composer) Tag: 2017 source edit |
||
| Line 639: | Line 639: | ||
* Last point is about security: As we view in the second point, when using composer, a very high number of PHP files are installed even if you don't need them. Dolibarr is a critical application that need a very strict security policy. Requirement for security is at a high level (See our page [[Security_information]]). When using composer, you install a lot of files and small sub-project and sub-project of sub-projects where security is not considered as important than what we need on the Dolibarr project. If we make an analysis on a given period, the number of vulnerability reported on the whole project Dolibarr + files of external libraries when installed by composer (that we mostly don't need) is multiplicated by 20 compared to the number of vulnerabilities that are reported only in the scope of Dolibarr + external libraries when they are embedded in their minimal version manually). | * Last point is about security: As we view in the second point, when using composer, a very high number of PHP files are installed even if you don't need them. Dolibarr is a critical application that need a very strict security policy. Requirement for security is at a high level (See our page [[Security_information]]). When using composer, you install a lot of files and small sub-project and sub-project of sub-projects where security is not considered as important than what we need on the Dolibarr project. If we make an analysis on a given period, the number of vulnerability reported on the whole project Dolibarr + files of external libraries when installed by composer (that we mostly don't need) is multiplicated by 20 compared to the number of vulnerabilities that are reported only in the scope of Dolibarr + external libraries when they are embedded in their minimal version manually). | ||
As we can see, composer, even if it was largely adopted by a lot of small projects, is far away from the state of the art. For all this reasons, it is just not possible to use composer so we keep the composer.json file in the project so we can use it for some development tests or make upgrade tests of | As we can see, composer, even if it was largely adopted by a lot of small projects, is far away from the state of the art. For all this reasons, it is just not possible to use composer so we keep the composer.json file in the project so we can use it for some development tests or make upgrade tests of some libraries with it, but we have renamed it by adding the extension ".disabled" to be sure that end users won't try to install or update their Dolibarr with it (in which case, the application will become unsecured and unstable). | ||