writable directories under the web root directory

[dank]

Hi,

I am always very nervous about having apache writable directories under web root, and feng is configured with 4:

1) cache
2) config
3) upload
4) public/files

Can I change config files to point these to a directory outside of the public_html directory?  I would help me sleep at night ;-)

Many thanks,
Dan

[dank]

Hi guys, i'm not having a dig - feng is brilliant, but this is a big security concern i have. 

Any advice  would be appreciated - I really don't want cached private emails to be under web root for the world to see and hack....

Many thanks.

[conrado]

Hi Dan.

There are two things that should be done on a Community Edition installation (we do this for all Feng Sky and Feng Onsite installations).

Both have to do with Apache .htaccess settings

1. Prevent directory listing:

Code: [Select]

Options -Indexes
2. Prevent direct files access:

Code: [Select]

<Files ~ "\.inc$">
Order allow,deny
Deny from all
</Files>

Thanks for bringing this topic up!