Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've developed a PHP framework that operates with the directory structure of

/  
/classes/  
/templates/  
/.../  
/www/ (public_html)

But I've come across a host that only allows ftp to the DocumentRoot, so this imposes a security risk to my scripts. I don't want the root of the site to point to the root where my framework lies.

I've asked a question over at stackoverflow with a question to an .htaccess rewriterule to potentially solve this

Is there a better method to do this?

share|improve this question
add comment

2 Answers

Presumably you just need to block HTTP access (return an HTTP status code of 403 - Forbidden) to these folders, if stored in the document root? In your document root .htaccess file:

# Block HTTP access to certain folders
RewriteRule ^classes/.* - [F]
RewriteRule ^templates/.* - [F]

(...and build flexibility into your framework to allow your framework to be located at the same level as the public HTML.)

If I understand your other/alternative question correctly... I can't see any benefit in trying to fake a document root using rewrite rules. Presumably this is to maintain the directory structure? I don't think this will add any more security and just introduces an additional layer of complexity IMO.

share|improve this answer
    
This was my next option if. I guess I am making things more difficult haha –  StrikeForceZero Mar 14 '13 at 2:53
    
The main reason was to prevent and collisions on client files and framework files and their names or locations. Edit: I realized I can make my framework in a directory like wp. And have a config file. –  StrikeForceZero Mar 14 '13 at 3:02
add comment

The better solution is to code so that there is no security risk from someone requesting these files. Remember that since PHP is interpreted at the server-side then you can code your files to return an empty document or redirect elsewhere when requested.

This is what Wordpress does. Try asking for any of the files you are not supposed to and what the browser gets is simply an empty document. Even if you ask for wp-config.php which is the standard file containing the most sensitive access information, what you get is simply nothing.

share|improve this answer
    
I did notice that. Probably good practice even if the files are one directory up. Thanks for the advice. –  StrikeForceZero Mar 14 '13 at 2:54
1  
While this is true, security is all about layers. Moving sensitive code outside the web root adds an extra layer of security, for example in the (rare) situation of server misconfiguration it could mean the code from PHP files gets displayed/served instead of executed. –  DisgruntledGoat Mar 14 '13 at 14:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.