As part of the PSR-12 pull request I removed almost all checks for directly directly executing files which only includes symbol definitions (functions, classes, interfaces...). This has been done to fit the PSR1.Files.SideEffects.FoundWithSymbols rule.
Sadly I assumed the coding standard would also take security serious (in this case path disclosure).

I only thought about the security aspect of directly executing code with may using input parameters provided by an attacker. Which actually would be mitigated because no code is directly execute if you only define classes or functions.

The path disclosure is normally not a problem because in production you should not have error reporting "on" and in such case you don't expose any error messages including "class not found in file".

Never the less Joomla sees this information disclose as security issue and try to save the user for miss configured webhosts.

A simple demonstration:

class a extends \Joomla\CMS\MVC\Model\AdminModel {}

This simple code would thru the following error message if you directly open the file with the webbrowser:

Fatal error: Uncaught Error: Class 'Joomla\CMS\MVC\Model\AdminModel' not found in /web//a.php:1
Stack trace: #0 {main} thrown in /web//a.php on line 1

The reason that the class can't be found is because no autoloader has been defined in this file.

At a future release we maybe can remove this statements if we are able to move the cms files out of the webserver scope but that's another story and have to be evaluated when we are at this point.

I want to thank @SharkyKZ notifying me about this issue.

/cc @nikosdion Your MFA PR didn't have defined die this PR adds them, you maybe want's to have a look.

I apologies for the inconvenience caused.

Summary of Changes

Added a script which checks all files changed in the PSR-12 PR and readd the same constent used before back into the current version of the file.
Also some additional files have been checked and defined die statements have been added.

New checks have the following pattern:

// phpcs:disable PSR1.Files.SideEffects
\defined('_JEXEC') or die;
// phpcs:enable PSR1.Files.SideEffects

I exclude this statement from the phpcs check because it's likely we will remove this side effect completely and introduce a new check which will force defined die to all files (except it's disabled in the file).
I also used the namespace version of this command even if not needed because it makes copy paste easier and doesn't hurt.
I also decided to keep the or operator instead of the || format because it's easier to read for non programmers (and this form is used for ever).
To be more in sync with the rest of the php world I moved the statement after the last use statement.

Testing Instructions

Install the CMS and test everything.
PHPCS and Unittests do some basic checking.

Actual result BEFORE applying this Pull Request

Path disclosure is possible on not proper configured webhosts

Expected result AFTER applying this Pull Request

Path disclosure is no longer possible again.

Documentation Changes Required

Should be mentioned in the programmers documentation

Further TODOs

After the release of 4.2.1 I will write a PR to get all other defined die in sync with this pr (moving below use, using \defined and try to get rid of defined('JPATH_PLATFORM').