Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that it is a good idea to store php application code outside of public folder but it creates a problem.

Let's say, we would like to create a completely modular structure like this one:

modules
   shop
      css
      js
      images
      controllers
      templates
   chat
      css
      js
      images
      controllers
      templates

Obviously, we would like to protect controllers and templates folders from direct access. But if we put modules outside of public folder, then we cannot server js/css/images directly. We would like to avoid creating a copy of the same modular structure in the public folder just for css/js files.

So if we "break the rule" and put all the modules in the public folder to allow access to css/js/images, we have a potential security issues. We could just throw .htaccess files in each of these folders but anyway this does not seem secure - what if someone forgets to add the .htaccess?

So the question is: is there some way to keep the modular structure in a single secure place (like outside of public root) and still allow direct access to css/js/images? Any Apache config, rewriterule or some trick?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Instead of linking to the static files directly use your controller to read in the files and return them.

Then in order to avoid the extra overhead on every call, cache the files in a separate cache location. You can then use the same process to cache your dynamic content and you it could also allow you to build things like your css dynamically.

For example you could merge the css from different modules into one file or change the human readable JavaScript into a highly minimized version.


Another way to do it would be to have a public folder inside each module. Then use alias' and/or rewrite rules to direct requests to the appropriate location. Using the <Directory> directive you can set explicit permissions for folders outside of the document root. Doing it this way though would likely require you to reconfigure Apache every time you added a module.

Something like this might work:

<Directory "/Docroot">
   ...
   RewriteRule ^(shop|chat)/(.*) /path/to/modules/$1/public/$2
   ...
</Directory>
<DirectoryMatch "^/path/to/modules/(.+)/public">
  Order Allow,Deny
  Allow from All
  ...
</DirectoryMatch>

Finally when you "install" your module you could just copy the public files into the document root. You can still keep the separated. Something like this:

modules
   shop
      controllers
      templates
   chat
      controllers
      templates
public
   modules
       shop
          css
          js
          images
       chat
          css
          js
          images
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.