This is used to specify pathes to migrations that do not have
namespaces.
While not directly supported by the migration command provideded by the
framework, these migrations exist in a lot of extensions because custom implementations
of migration controllers out of the framework were using this approach
to load multiple migrations from multiple paths.
Even the framework itself currently ships non-namespaced migrations:
- 17a1d91e4a/framework/rbac/migrations/m140506_102106_rbac_init.php
- 17a1d91e4a/framework/caching/migrations/m150909_153426_cache_init.php
- 17a1d91e4a/framework/log/migrations/m141106_185632_log_init.php
This change allows existing applications to adopt the new namespace-based approach
while keeping existing migrations. While it would be possible to add
namespaces to migrations in the application itself, it is not easily possible
to add namespaces to migrations that come from external sources like
extensions.
By default, the class BaseMigrateController property migrationPath is assigned the value '@app/migrations'. In the method getNewMigrations() is the conversion migrationNamescpaces in the path to the file and merges it all into a single array along with the path migrationPath. If the project for migration module is a separate table in the database, all migration came from migrationPath are not initialized and therefore try to migrate. Therefore, it is necessary to specify the property 'migrationPath' => null.
Currently security guide is very thrifty with information on what a topic is about. So for beginners it is not clear why something like CSRF or XSS protection is even needed.
I added a few reference links to allow reading about more background behind the topics.
