Problem/Motivation
Users are encouraged to modify their .htaccess file directly in a comment in that same file; since this comment has been in place for a while, people are used to doing it. Unfortunately, this sort of modification is erased during Drupal updates (e.g. when running drupal pm-update), and with the introduction of the Drupal Composer Scaffold tool, composer install also puts these files in danger of being overwritten. See #3092563: Avoid overwriting .htaccess changes during scaffolding > security problem for some of the implications of this.
It would be desirable if we could start guiding users towards a more modern, Composer-based way to manage their .htaccess and robots.txt customizations. The Drupal Composer Scaffold tool provides patching and append/prepend features to make these changes easier to maintain, for example.
Proposed resolution
Add two examples to drupal/recommended-project:
- Prepend to robots.txt
- Patch .htaccess
These examples should not be added to the legacy project for now, as that is used to generate downloaded tarballs.
Remaining tasks
The scaffold files in drupal/core should say "do not modify these files", rather than the patch file / prepend file in the template.
User interface changes
None
API changes
None
Data model changes
None
Release notes snippet
tbd
| Comment | File | Size | Author |
|---|---|---|---|
| #27 | interdiff-3095214_16-25.txt | 4.22 KB | bhanu951 |
| #16 | interdiff_3-16.txt | 1.73 KB | ravi.shankar |
| #16 | 3095214-16.patch | 7.19 KB | ravi.shankar |
| #3 | 2-to-3-interdiff.txt | 4.56 KB | greg.1.anderson |
| #3 | 3095214-3.patch | 7.19 KB | greg.1.anderson |
Issue fork drupal-3095214
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
greg.1.anderson commentedHere's the rough idea.
Comment #3
greg.1.anderson commentedCleaned up #2 and gave it some proper documentation. With this, users who start with drupal/recommended-project will have a fighting chance at being able to manage their .htaccess and robots.txt customizations without issue.
Comment #4
nickdickinsonwildeSeems pretty clear and covers the most common use cases.
+1
Comment #5
larowlanComment #6
mradcliffeQuestions:
Is there a trailing white space here or is it dreditor?
Would doing the following work as well for non-VCS?
cd web && cp ../scaffold-modifications/.htaccess ./Do these create a hidden dependency on git?
Comment #7
greg.1.anderson commented1. There is trailing whitespace on that line.
2. The suggested technique would work, but it is not a good idea. If you want to replace the entire file, you should just make the scaffold file unmanaged (set its path to FALSE) and commit your modified file. Patching is preferred because you will continue to get updates to the file when it changes in the upstream. If the patch fails to apply, you get an error. With full replacement, you do not get any warning when the upstream changes; you just miss out on the updates (until you notice yourself).
3. There is no dependency on git. There is a requirement to use git if you want to follow the instructions in the documentation, but once you have made your patch, there is no further need for git, as the patch is applied with the "patch" command. We could provide instructions on how to create a patch with "diff", but the instructions would be more complicated.
Comment #8
alexpottAdditional space on the end of the line
I'm not sure why the .patch file is double commenting these lines?
This is an odd one but I think once this lands all projects built on the recommended project template are going to have a scaffold-modifications directory with this file in it. The text in the file is telling you not to modify it when actually we want you to modify the robots.txt.prepend file.
I think the files that should have this text are in core/assets/scaffold/files. Not sure we should be adding this text using Scaffold operations.
Comment #9
greg.1.anderson commented2. I double-commented the patched-in lines so that folks who examined the scaffold file in its target location could see that the lines had been changed by the patch.
3. You're right, we want the source location to say YES MODIFY THIS FILE, and the destination location to say DO NOT MODIFY THIS FILE. This implies that the warning message should be inserted by the scaffold tool. The problem with this is that we do not necessarily know whether the target file can be commented, or what the comment characters should be, etc.
Maybe we could make
core/assets/scaffold/files/robots.txt.warningandcore/assets/scaffold/files/htaccess.warningand so on, for as many scaffold files as we want to support warnings for. Then, after the post-scaffold hook, we could prepend the warning for any file that has a warning and was modified. If we want to do that, then we should postpone this issue on #3092563: Avoid overwriting .htaccess changes during scaffolding > security problem, as we would use the hashing improvements there to detect post-scaffold-hook changes.I'm not sure what to say about always having a scaffold-modifications directory, as I view this as a net benefit of this patch. We could, perhaps, find a better name for it. It might also be worthwhile including a README.txt file in this directory with instructions on how to get rid of it.
Comment #10
greg.1.anderson commentedPostponing on #3103090: Avoid re-scaffolding unchanged files (and printing scaffold file information over and over)
Comment #11
greg.1.anderson commentedComment #12
greg.1.anderson commented#3103090: Avoid re-scaffolding unchanged files (and printing scaffold file information over and over) has been committed to 8.9.x and 9.0.x. We could re-roll here and then continue to address the feedback in #8.
Comment #14
karolus commentedSorry if I'm late to this—but for SEO reasons, I do modify my robots.txt, in addition to having a robots_noindex.txt file.
Has it been resolved on how to do this properly with drupal-scaffold?
Comment #15
ressaThis is a great idea. I recently created #3151695: Dissuade users from editing .htaccess in the same spirit.
Comment #16
ravi.shankar commentedPatch #3 is still applying on D-9.1.x.
I have addressed point 1 of comment #8.
Need work for remaining points of comment #8.
Comment #17
abaier commentedShould there also be an example/hint for drupal/legacy-project, regarding the directory structure and the "scripts" part?
Comment #20
pere orgaEverything worked for me except this line:
This worked instead:
patch -p1 < scaffold-modifications/htaccess.patchI created the htaccess patch following the instructions in composer/Plugin/Scaffold/README.md
Comment #27
bhanu951 commentedRerolled patch 3095214-16.patch against 11.x branch and updated web-root directory to web in all places instead of mixed docroot and web , updated patch generation git command to include
--no-prefixComment #28
needs-review-queue-bot commentedThe Needs Review Queue Bot tested this issue.
While you are making the above changes, we recommend that you convert this patch to a merge request. Merge requests are preferred over patches. Be sure to hide the old patch files as well. (Converting an issue to a merge request without other contributions to the issue will not receive credit.)
Comment #29
bhanu951 commentedTests failed due to missing patch utility in the docker image. Hence setting to NR again.
Comment #30
smustgrave commentedSeems this postponed on #3417586: Add the patch utilities back to the drupalci image
Comment #31
bhanu951 commentedComment #32
bhanu951 commentedComment #33
smustgrave commentedSeems to have some test failures