Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Why store the CakePHP files outside of the webroot?

For example, this is the way way that I have always been told to do it.

/home/username
  /app
  /cake
  /public_html
      index.php

I know its because of security, but why? its not like the users can view files in the /app/ folder anyways. The htaccess prevents that correct?

If the user was able to get a malicious script on my webserver it wouldn't matter if the /app/ folder was in the /public_html/ or outside of the webroot, they would still alter the files under the /app/ folder, right?

So why bother?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Why take the risk? If they are not in the webroot they can never be served by Apache by mistake. Sure it shouldn't make a difference but it goes against the Principal of Least Privilege.

Also you would normally want to have your public folder as the root of the URL, sending people to www.example.com/home/username/public_html looks a bit naff?

share|improve this answer
    
the fewer files that people have access to , the simpler your access logs will be. –  djangofan Sep 17 '10 at 22:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.