Can't import Polymer elements

[Manaus]

Hello,

I'm trying to import some polymer elements, but for some reason I get a 403

this is the code

<link rel="import" href="<? echo $config->urls->templates ?>bower_components/paper-input/paper-input.html" />

Is there a workaround?

Thanks!

[kongondo]

For security reasons, you can't directly access files like that within the the PW templates directory (as well as others). Hmm...I always thought it's only PHP files that this restriction applies to but possibly HTML files as well? Somebody more knowledgeable will clarify

Possible workarounds if restriction also applies to HTML files:

1. use an include in a template file
2. place the file outside PW directories and reference it from those locations

Edited December 11, 2014 by kongondo

[adrian]

This is the bit in .htaccess that blocks access to files in the templates directory:

  # Block access to any PHP or markup files in /site/templates/
  RewriteCond %{REQUEST_URI} (^|/)(site|site-[^/]+)/templates($|/|/.*\.(php|html?|tpl|inc))$ [OR]

Which is why css, js etc work, but php, html, tpl, inc etc don't.

[gebeer]

This might be a dumb question.

But what would be the solution to work with web components import links in a PW template and still maintain good security?

I guess that rewrite condition is there for a good reason. But also the use of polymers imports is probably going to increase in future. So it would be great to find a secure way of making them work together smoothly with PW.

[adrian]

This might be a dumb question.

But what would be the solution to work with web components import links in a PW template and still maintain good security?

I guess that rewrite condition is there for a good reason. But also the use of polymers imports is probably going to increase in future. So it would be great to find a secure way of making them work together smoothly with PW.

I am not sure I understand why they can't be referenced to your site root - is it just a matter of keeping things all together?

<link rel="import" href="/bower_components/paper-input/paper-input.html" />

Actually looking into this more, I see that import is not supported in Firefox and apparently there are no plans to support it:

http://caniuse.com/#feat=imports

I guess the platform.js polyfill is making it functional across all browsers - is that what you guys are using?

[LostKobrakai]

But what would be the solution to work with web components import links in a PW template and still maintain good security?

It's not really a big security risk to allow access to html files, as that are static files. It's just that by now it wasn't a intended behavior to be able to access html files, therefore the rule. Also in the templates folders are maybe docs and such things in html format, which should probably be hidden. But if you use markdown this security is gone as well. Writing a custom .htaccess rule to allow access in the bower_components folder would probably be the best / most flexible bet.

[gebeer]

@adrian

I guess the platform.js polyfill is making it functional across all browsers - is that what you guys are using?

Yes, that is the one. Info also at http://webcomponents.org/polyfills/

@LostKobrakai

Your idea with custom .htaccess rule to allow access of html in bower_components is great I'll see if I can put one together...