Is it good practice to make system root unable to be accessed? - php

Let's say we have the following schema:
root/
application/
-public/
index.php
css/
img/
javascript/
...
system/
...
I was thinking that if I create an .htaccess file in the root with the following rules:
RewriteEngine On
RewriteRule \.(css|jpe?g|gif|png|js|ico)$ - [L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ application/public/index.php?url=$1 [QSA,L]
I would be able to make other folder except public unable to be accessed. Assume index.php is the file that load all the file the application need and include and require them (with relative paths obliviously): the application is actually run in index.php and every public file such as css stylesheet, images or javascript script are in the public folder. So you, as user, cannot access the system folder because if you digit www.site.com/ it refers to root/application/public/. Am I right?
But the htaccess rule I set there does not work... If I put that htaccess in the root folder and I try to access the root folder the browser shows me the list of the file of the root folder (application and system). Why isn't it working?
I used this while ago when index.php was in the root folder:
RewriteEngine On
RewriteRule \.(css|jpe?g|gif|png|js|ico)$ - [L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php?url=$1 [QSA,L]
and it worked just fine. Why isn't the new one working?

The document root of you project should be set to the /public folder.
This way that's the only folder to web-user would have access to.
Edit: for more info check the apache manual http://httpd.apache.org/docs/2.0/mod/core.html#documentroot

My initial code was right. Except for the third line which obliviously considered / a folder and made me see it instead of redirecting to application/public/.
Commenting the third line everything worked fine.
RewriteEngine On
RewriteRule \.(css|jpe?g|gif|png|js|ico)$ - [L]
#RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ application/public/index.php?url=$1 [QSA,L]

Related

How do I remove /public from the URL?

I am using Slim framework to build a website. How to I re-write the url using .htaccess ?
This is what my .htaccess file looks like, any route is redirected to index page, I got this from the Slim Documentation
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]
This is my directory structure.
|--app
|--bootstrap
|--public
|--css
|--js
|--index.php
|--.htaccess
|--routes
|--vendor
|--views
|--composer.json
|--composer.lock
This how it works now
http://localhost/SlimApplication/public/ - points to the index page
http://localhost/SlimApplication/public/Users - points to the users page
This is how I want it to work
http://localhost/SlimApplication/ - should point to the index page
http://localhost/SlimApplication/Users - should point to the users page
What can I do to make this work ?? I am new at .htaccess and Slim as well so any help would be great. Thanks, Cheers !
Create new .htaccess file in level up folder hierarchy (the same as public folder). RewriteBase /public/ directive is what you need.
RewriteEngine On
RewriteBase /public/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

Apache Document Root using .htaccess

I have a directory structure
mymvc
|--App
|--Core
|--logs
|--public
|--index.php
|--vendor
|--.htaccess
what i want is that if someone hit my url www.example.com/mymvc/ then all the request must go through public->index.php using .htaccess file. i do not have access to httpd.conf file.
|--public
|--index.php
I want my public folder to be accessible only as a document root and request pass through index.php file inside public folder. No one can access directly App , Core , logs etc. directories. Means i want my public folder to be DOCUMENT ROOT.
First you need to create an .htaccess file in the root of the project.
mymvc/.htaccess
RewriteEngine On
RewriteCond %{REQUEST_URI} !public/
RewriteRule (.*) public/$1 [L]
Then, in the .htaccess file in the public directory (which would be mymvc/public/.htaccess), you need to add a RewriteBase directive to the existing code, so it looks like this:
mymvc/public/.htaccess
# Remove the question mark from the request but maintain the query string
RewriteEngine On
RewriteBase /mymvc
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.*)$ index.php?$1 [L,QSA]

How to write RewriteRule for a page that resides in a subfolder in root folder using htaccess

I am writing Rewrite Rule to call a .php file that reside in a folder(folder 1) in root. it says not accessible when i use clean URL. here is the code i have written:
RewriteCond %{REQUEST_URI} !^/folder1
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^page1/(.*)$ page1.php?pid=$1 [L,QSA]
root folder contains folder 1 within that i have the page "page1.php".
Here I have written rewrite rule for all the pages that is in root directory. but not able to write code for sub directory(folder 1).
i am newbie for clean URL.

.htaccess error : The requested URL was not found on this server

I have a php file which is home.php
my url on localhost is
http://localhost:8888/photo/home.php
I want to remove .php from the url
so i create .htaccess file
RewriteEngine On
RewriteRule ^home?$ home.php
but i keep getting this error
The requested URL /photo/home was not found on this server.
First of all, ensure your .htaccess file is in the base directory of your project. Next, follow these htaccess rules to set up your redirect.
The .htaccess solution you might be looking for is:
RewriteEngine On
#Neither a file nor a directory
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^photo/home$ photo/home.php [QSA,L]
Try it like this, in your photo directory.
RewriteEngine On
# neither a file nor a directory
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^home$ home.php [QSA,L]
I got this problem when I put the .htaccess code in the root .htaccess. It works when I create a new .htaccess in the subdomain folder on the same level with public_html folder and fill it with the RewriteRule needed

Run laravel project in a directory folder on shared hosting

My question is: How can i run a laravel application in a directory
(not in root) on a shared webhosting?
For some of my clients I run Laravel applications in the root folder of their selected shared webhosting and remove the /public part from the URL. To make this work i move the index.php to the root folder and change the information from the index.php to:
require __DIR__.'/bootstrap/autoload.php';
$app = require_once __DIR__.'/bootstrap/app.php';
Now i know that this can cause security problems but I already have found solutions to that case for shared webhosters.
The .htaccess i use to make this change is:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)/$ /$1 [L,R=301]
RewriteCond %{REQUEST_URI} !(\.eot|\.woff|\.css|\.js|\.png|\.jpg|\.gif|robots\.txt)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !^/public/
RewriteRule ^(.*)$ public/$1/$2 [L,NC]
But in this case i want the laravel project to be run in a directory called test.
Folder structure:
root (public_html)
|-- test (directory with laravel project)
Now I'm not sure if i can simply change the .htaccess as i'm not very skilled with .htaccess files. What changes do i have to make, to make this work?
Note my urls:
// this link will be changed to:
www.[text-placeholder].com/test/public/css/style.css
// Output above result now:
www.[text-placeholder].com/public/css/style.css
// But should be:
www.[text-placeholder].com/test/public/css/style.css
It's easy, just place the project 1 level above the public_html folder and rename the public folder itself to public_html.
P.S. This is maybe a better way, than to use .htaccess, because now you really know fore sure the files outside of public html are out of your webroot (not accessible by hackers) and with htaccess you can make a mistake and the files are exposed.

Categories