4

I've developed a PHP framework that operates with the directory structure of

/  
/classes/  
/templates/  
/.../  
/www/ (public_html)

But I've come across a host that only allows ftp to the DocumentRoot, so this imposes a security risk to my scripts. I don't want the root of the site to point to the root where my framework lies.

I've asked a question over at stackoverflow with a question to an .htaccess rewriterule to potentially solve this

Is there a better method to do this?

| improve this question | |
4

Presumably you just need to block HTTP access (return an HTTP status code of 403 - Forbidden) to these folders, if stored in the document root? In your document root .htaccess file:

# Block HTTP access to certain folders
RewriteRule ^classes/.* - [F]
RewriteRule ^templates/.* - [F]

(...and build flexibility into your framework to allow your framework to be located at the same level as the public HTML.)

If I understand your other/alternative question correctly... I can't see any benefit in trying to fake a document root using rewrite rules. Presumably this is to maintain the directory structure? I don't think this will add any more security and just introduces an additional layer of complexity IMO.

| improve this answer | |
  • This was my next option if. I guess I am making things more difficult haha – StrikeForceZero Mar 14 '13 at 2:53
  • The main reason was to prevent and collisions on client files and framework files and their names or locations. Edit: I realized I can make my framework in a directory like wp. And have a config file. – StrikeForceZero Mar 14 '13 at 3:02
3

The better solution is to code so that there is no security risk from someone requesting these files. Remember that since PHP is interpreted at the server-side then you can code your files to return an empty document or redirect elsewhere when requested.

This is what Wordpress does. Try asking for any of the files you are not supposed to and what the browser gets is simply an empty document. Even if you ask for wp-config.php which is the standard file containing the most sensitive access information, what you get is simply nothing.

| improve this answer | |
  • I did notice that. Probably good practice even if the files are one directory up. Thanks for the advice. – StrikeForceZero Mar 14 '13 at 2:54
  • 1
    While this is true, security is all about layers. Moving sensitive code outside the web root adds an extra layer of security, for example in the (rare) situation of server misconfiguration it could mean the code from PHP files gets displayed/served instead of executed. – DisgruntledGoat Mar 14 '13 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.