I see in Drupal documentation about Configuration Management it is adviced to change the location of the sync directory in a production environnement.

But I can't find an explanation about the actual use of this directory. For what does Drupal use it ? (I expect a more accurate answer than "synchronizing", which I can formulate myself but is not very helping...)

And why is it unadvised to keep this directory accessible from the web ? What could be the consequences ?

up vote 2 down vote accepted

It's where Drupal exports configuration (YAML files) to, and reads configuration from (for example using drush config-export and drush config-import respectively). The term "synchronising" refers to Drupal comparing the contents of those files to the site's active configuration, and applying any config that's changed.

You want to keep that folder out of the public web server for at least 2 reasons:

  1. Those files could potentially contain sensitive data
  2. You're potentially exposing the structure and configuration of your site to the world. Those details could be advantageous to an attacker.

Best to err on the side of caution and keep them away from prying eyes.

  • Thanks. So this directory is used only if I use Drush ? – Eria Aug 18 '17 at 13:19
  • No it's used regardless of Drush; without Drush it's a slightly more manual process of going to the Admin -> Development -> Configuration page, exporting, putting the files in the sync folder manually, sending them to the remote server, then re-importing them through the UI again. Drush is generally preferable as you can at least partially automate it as part of the deployment process – Clive Aug 18 '17 at 13:28
  • Ok. But using the UI, you don't have to put files in the sync folder, you can upload it directly on the UI. I understand know you can also unzip the content of the full export archive in this sync directory. – Eria Aug 18 '17 at 13:34
  • Correct - many ways to solve the same problem. I guess that's why it's a bit confusing – Clive Aug 18 '17 at 13:38

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.