I've just discovered that all of the templates I'm saving to the filesystem are accessible through the browser if the name is known, and now I've got a case of the screamin' heebie jeebies. For example, if I have a template-group/template arrangement such that the URL http://mysite.tld/news/recent delivers content, then when I point my browser at http://mysite.tld/templates/default_site/news.group/recent.html I'm then presented with all my raw template code. Is this expected behaviour and if so why? Is there a native EE way to stop this from happening, or is it best practice to use rewrite rules at the web server?

I'd really like to hear from some of you on how you've dealt with this problem in your own sites.

Many thanks in advance,

Andy

up vote 5 down vote accepted

It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root?

Just remember to update the related settings.
(see "Server path to site’s templates" at the bottom of the page)

To keep all system files above the web root is good practice.

Alternatively...

If for some reason you don't want to or can not move above web root, another solution is to put a .htaccess file in your templates directory with:

deny from all

This will prevent direct access to the templates at URLs like http://example.com/templates/default_site/news.group/index.html, but ExpressionEngine will still be able to load the template just fine at http://example.com/news

  • Yes, of course, thank you, Robson. As soon as I began to read your answer it clicked. I've been dealing with this one particular deployment for so long (and to the exclusion of all others) that I had completely lost track of the fact that the template folder is normally in the system folder. Big mea culpa on this one. – Andy Jun 27 '14 at 10:18

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.