Security Issue

[gamort]

Php and resource files from dev/tests/functional are exposed and executable due to htaccess file:
dev/tests/functional/.htaccess

The simple solution is to rename it to something sane like testing.htaccess

Of course THAT will probably break a bunch more of the unit tests unless someone takes the time to fix it properly. And since the unit testing has currently been broken for weeks, I assume no one has the time to actually fix it and test it.

[orlangur]

Nice catch, there is no recommendation to remove dev/tests during deployment http://devdocs.magento.com/guides/v2.0/howdoi/deploy/deploy-to-prod.html#deploy-prod, so, it would be easily overlooked.

Of course THAT will probably break a bunch more of the unit tests unless someone takes the time to fix it properly.

No, it can only affect functional tests, which are not even running on Travis.

And since the unit testing has currently been broken for weeks, I assume no one has the time to actually fix it and test it.

To be precise, it is not actually broken, just not Travis-compatible.

All of tests are PHPUnit-based but not all of them are "unit" tests. In https://travis-ci.org/magento/magento2 you can see that integrity, integration, static and unit tests were running and integration tests did not succeed. Comparing this list to https://github.com/magento/magento2/tree/develop/dev/tests one may notice that no api-functional, functional or js tests are running on Travis CI (also, static tests are running only partially on Travis).

[lanken]

Created internal ticket MTA-3295

[jameshalsall]

Isn't the best solution here to use the pub folder as the document root?

The .htaccess files are useless if you're running your store on nginx.