Magento – Security Risk of require_once ‘app/Mage.php’ in Root

Security

I have a file in my Magento root that require_once 'app/Mage.php'; to give me access to Mage::getStoreConfig system variables.

Does this cause a security risk? Should I place it in another folder?

This is my file, /twitter.php:

<?php
require_once 'app/Mage.php';
Mage::app();
$consumer_key = Mage::getStoreConfig("Social/twitterapi/consumer_key");
$consumer_secret = Mage::getStoreConfig("Social/twitterapi/consumer_secret");
$oauth_access_token = Mage::getStoreConfig("Social/twitterapi/access_token");
$oauth_access_token_secret = Mage::getStoreConfig("Social/twitterapi/access_token_secret");

Best Answer

Unless the script contains means by which to alter content in the Magento install via something like arguments sent to the script then no I don't see that it's a security risk - including Mage.php is only exactly what index.php (also at web root) does too.

Related Topic