No way for a theme or extension to import LESS files from vendor directory

[apiuser]

Feature request from leoquijano, posted on GitHub Apr 18, 2016

Hi,

As described in #2264, there's currently no way to import LESS files from a theme or extension directory to the vendor/ folder. This is particularly relevant for theme developers since most custom themes could include content from different LESS libraries, and those libraries are better maintained using Composer or Bower (Bower can be configured to also put packages inside vendor/).

So suppose I have this in my theme's main.less file:

@import '../../../../../../../vendor/twbs/bootstrap/less/bootstrap.less';

Now, I could use Bootstrap compiled CSS, but that wouldn't allow me to use variables and mixins from that deployment. If I try to copy Bootstrap files directly in the theme web directory, then the LESS preprocessor will pick them up and fail, since it tries to compile every file in the Bootstrap library instead of just the main one (which imports the other ones).

(And also, it's better to keep external CSS libraries in the vendor directory anyway) The error shown is this:

File path '../../../../../../vendor/twbs/bootstrap/less/bootstrap.less' is forbidden for security reasons.>

I tried to symlink the file (which is not always the best solution since some deployments may fail to reproduce symlinks adequately, especially on Windows), but it's not working either. I'll probably have to copy the full Bootstrap code in a file as a workaround, but it's more maintainable to enable some way of importing from vendor/ directory.

[apiuser]

Comment from mazhalai, posted on GitHub Apr 19, 2016

Thank you for reporting @leoquijano, we have created ticket MAGETWO-52044 to investigate and fix.

[apiuser]

Comment from BenSpace48, posted on GitHub Apr 22, 2016

I had a similar problem, my workaround was to include Bootstrap in my theme directory, and rename all the bootstrap files to include an underscore at the start. Then import _bootstrap.less in my theme's _extend.less.

It's far from ideal and I am getting some errors when running a static content deploy which could be related to my workaround.

[apiuser]

Comment from mazhalai, posted on GitHub Apr 29, 2016

Closing this since it was fixed in the develop branch, in the scope another internal ticket MAGETWO-48840 See commit https://github.com/magento/magento2/commit/98eb8f85e25bbc0aa39928f1783591747ba3ac72

[apiuser]

Comment from leoquijano, posted on GitHub Apr 29, 2016

Hi @mazhalai , I think commit #98eb8f8 actually fixes #2264?

My report is different, as it is directed to /vendor directory and not the Magento UI library. I was requested to open a new issue, and here it is.

[apiuser]

Comment from leoquijano, posted on GitHub Apr 29, 2016

I double checked, and yes, that commit only fixes #2264 .

$directoryWeb = $this->readFactory->create(
  $this->getDirectoryList()->getPath(DirectoryList::LIB_WEB)
);
$fileRead = $this->readFactory->create($realPath);
// Check if file path starts with web lib directory path
if (strpos($fileRead->getAbsolutePath(), $directoryWeb->getAbsolutePath()) === 0) {
  return

There's no provision for importing things from the vendor directory.

[apiuser]

Comment from MomotenkoNatalia, posted on GitHub May 11, 2016

Yes this issue exists and now it's not possible to use 3rd party composer packages web assets. Thank you for pointing out to this problem, architects will work on finding solution for this use case.

[apiuser]

Comment from leoquijano, posted on GitHub May 14, 2016

Can I suggest enabling a configurable set of directory prefixes? It would default to "Lib::" and "Vendor::". I'm thinking about people who might want to use Bower or other provisioning tools.

Also, I see that the issue is closed. Is there a way to track progress on it?

[apiuser]

Comment from giacmir, posted on GitHub Sep 12, 2016

Why is this issue closed? I don't see any evidence that it has been solved or rejected.

[apiuser]

Comment from pboisvert, posted on GitHub Sep 12, 2016

@tkacheva can ou review this one and reopen if original concern is not addressed?