Do you put the system folder outside of web root?

[eluser]gh0st[/eluser]
I'm wondering, in the Zend framework you put their library folder outside of the web root, or perhaps putting it in a directory with certain htaccess rules.

I'm wondering, is it safe to put the system folder inside the web root, or are you meant to put it somewhere else?

If so, what htaccess rules are applicable to ensure security?

[eluser]GSV Sleeper Service[/eluser]
personally I separate out the application and system folders and put them both outside of the web root. The only thing I have in htdocs is index.php, and folders for css, images and js.

a suitable .htacces is

Code:

#send everything to index.php unless the file or folder exists in the webroot
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

[eluser]gh0st[/eluser]
When you don't have access to before the web root, is it okay to put it in the web root and include a .htaccess file to ensure security?

[eluser]cahva[/eluser]
Yes. You can simply put .htaccess file which contains this inside system folder:

Code:

deny from all

[eluser]gh0st[/eluser]
I'm wondering...

I can get access to one level up from the web_root.

If I put my system folder in here, what do I change the

$system_folder = "system";

to in the index.php file?

Is it the full path?

Thanks

[eluser]Tom Schlick[/eluser]
if you saying you can get to the folder before the webroot then it would be

$system_folder = "../system";

[eluser]gh0st[/eluser]
I'll try it and see what happens.

Thanks!

[eluser]searain[/eluser]
CI or Not, I always like to put the folders or files outside of the web root if they don't have to be in the web root.

My questions are:

1) To put system folder outside the web root is a better practice in CI? (it is the min. access rule, right?)

2) in addition to $system_folder = “../system”; what else I should do differently or I should know if I put system outside web root?

Thanks!

[eluser]Thorpe Obazee[/eluser]
1. for me, as long as access to the system folder is prevented via .htacess is already fine.
2. You could do the same for the application folder.

[eluser]cahva[/eluser]
In webroot I personally dont have anything else than:

.htaccess
index.php
assets/ (containing images,js,css etc.)

You can see from this thread how I have set up my system.