Take the 2-minute tour ×
ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It's 100% free, no registration required.

I've just discovered that all of the templates I'm saving to the filesystem are accessible through the browser if the name is known, and now I've got a case of the screamin' heebie jeebies. For example, if I have a template-group/template arrangement such that the URL http://mysite.tld/news/recent delivers content, then when I point my browser at http://mysite.tld/templates/default_site/news.group/recent.html I'm then presented with all my raw template code. Is this expected behaviour and if so why? Is there a native EE way to stop this from happening, or is it best practice to use rewrite rules at the web server?

I'd really like to hear from some of you on how you've dealt with this problem in your own sites.

Many thanks in advance,

Andy

share|improve this question

1 Answer 1

up vote 5 down vote accepted

It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root?

Just remember to update the related settings.
(see "Server path to site’s templates" at the bottom of the page)

To keep all system files above the web root is good practice.

Alternatively...

If for some reason you don't want to or can not move above web root, another solution is to put a .htaccess file in your templates directory with:

deny from all

This will prevent direct access to the templates at URLs like http://example.com/templates/default_site/news.group/index.html, but ExpressionEngine will still be able to load the template just fine at http://example.com/news

share|improve this answer
    
Yes, of course, thank you, Robson. As soon as I began to read your answer it clicked. I've been dealing with this one particular deployment for so long (and to the exclusion of all others) that I had completely lost track of the fact that the template folder is normally in the system folder. Big mea culpa on this one. –  user1922 Jun 27 at 10:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.