1

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product.

The folder structure reveals a protected folder under app which contains the config files, which should probably be secured.

By default, the folder and subfolders have 755 and files have 644 permissions. Owner is root:root, but I have changed that to www-data:www-data to make the Model Generator work.

What would be considered safe permission settings for dooPHP? I'd like to find that out before I go live with it.

I already tried to find advice in the DooPHP forum, but all I found is a statement about missing security settings from 2011.

1

I don't see anything in their configuration that prevents somebody browsing into that protected folder. You could add configuration to the .htaccess file to prevent access to it:

<Directory /app/protected>
   Order deny,allow
   Deny from all
</Directory>
  • You would use the <Directory> container if placing these rules in the server config. If in .htaccess, just place these directives directly in the /app/protected/.htaccess file without the <Directory> wrapper. – MrWhite Feb 4 '16 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.