While working on FreshRSS/Extensions#23 I stumbled upon this comment #1456 (comment) by @Alkarex regarding the ./data/extensions-data/ directory.

Some thoughts about that:

• What about adding a second method besides Minz_Extension::getFileUrl() which uses the new path and a deprecation warning for the old one? By now, its unclear where files should be stored.
• What about a helper method like Minz_Extension::getUserPath() which could be consumed by extension authors?
• Maybe some sentences about these directories in the extension docu?

But my main issue is:
I cannot use the new directory due to security limitations in the p/ext.php:
https://github.com/FreshRSS/FreshRSS/blob/master/p/ext.php#L20

The script only allows to access files in the extensions static/ sub-directories

Edit: Probably the old behaviour should be removed in 2.0 completely, as the data/ directory seems to be the place where such file changes should happen exclusively.