Take the 2-minute tour ×
Craft CMS Stack Exchange is a question and answer site for administrators, end users, developers and designers for Craft CMS. It's 100% free, no registration required.

Due to the way our build and deployment process works, it's convenient for us to have the Craft templates inside our /public/assets folder together with our css and javascript, instead of in /craft. Does this make the site less secure than having them outside of the public root?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

If you’re running Apache, you can put a .htaccess file in your templates/ folder with this in it:

Deny from all

and any HTTP traffic to that folder will be given an Apache 403 error.

Even better, you can put this in there:

# Send the request to Craft
RewriteEngine On
RewriteRule (.*) /index.php?p=$1 [QSA,L]

and the request will be redirected to Craft’s index.php file behind the scenes, the same way that would-be 404s are sent there. So even if you go to /templates/index.html, or any other URL that points to an actual file within your templates/ folder, it will end up as /index.php?p=templates/index.html, leaving Craft to handle the request, which will most likely result in a Craft-based 404.

share|improve this answer

It depends on what kind of secure infos you write into your templates. I wouldn't put my credit card infos into a twig comment for example, if the template is not above the root.

But normally all one could make up from the raw template code is rather uninteresting and not really relevant for further hacking attempts, I'd say.

Note: please do NOT put the craft/config/ folder above the root!

share|improve this answer
    
Agree with carlcs, but to be safe, I'd add a .htaccess which denies direct user access –  Victor In Jul 29 at 20:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.