I know that it is a good idea to store php application code outside of public folder but it creates a problem.
Let's say, we would like to create a completely modular structure like this one:
modules shop css js images controllers templates chat css js images controllers templates
Obviously, we would like to protect controllers and templates folders from direct access. But if we put modules outside of public folder, then we cannot server js/css/images directly. We would like to avoid creating a copy of the same modular structure in the public folder just for css/js files.
So if we "break the rule" and put all the modules in the public folder to allow access to css/js/images, we have a potential security issues. We could just throw .htaccess files in each of these folders but anyway this does not seem secure - what if someone forgets to add the .htaccess?
So the question is: is there some way to keep the modular structure in a single secure place (like outside of public root) and still allow direct access to css/js/images? Any Apache config, rewriterule or some trick?