Re: Template Security Advice (WASP - http://wasp.sourceforge.net)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

Tuesday, October 11, 2005, 3:37:13 PM, you wrote:
BF> I'm finishing up my WASP framework 1.0 release (http:// 
BF> wasp.sourceforge.net) and I'm trying to decide the best way to lay
BF> out the template directories.

BF> WASP uses HTML_Template_Flexy for its template system.  The templates
BF> are compiled using "Chunk" classes that each refer to a html template.

BF> The way it works now, the directory structure of applications is
BF> |_ /webroot/module/templates

BF> where module is where the php classes are stored, and templates is
BF> where the html templates are stored.  The templates used to be stored
BF> in a seperate directory outside of the web root, as such
BF> |_ /templates/
BF> |_ /webroot/ModuleDir

BF> however it becomes cumbersome to keep track of which templates go to
BF> which php classes, so for organization sake having the template  
BF> directory located beneath each module directory is easier to navigate.

BF> My problem is, anyone who realizes a particular application uses WASP
BF> can go to a url, say http://blah/module, and look at the html files
BF> in the template directory (ex. http://blah/module/templates). Is it
BF> too much of a security issue to justify this useful organization?
BF> Theoretically the addition of an .htaccess file in the templates  
BF> directories could solve the problem, but is that compounding the  
BF> issue even more?  I guess I'm asking for someone to tell me it's ok
BF> to do it this way, but if nobody agrees I can change it back.

BF> Thanks for the input.
BF> -Brian


BF> /**
BF>   * Brian Fioca
BF>   * Chief Scientist / Sr. Technical Consultant
BF>   * PangoMedia - http://pangomedia.com
BF>   * @work 907.868.8092x108
BF>   * @cell 907.440.6347
BF>   */

What about:

|_ /templates/ModuleDir
|_ /webroot/ModuleDir


Or even better if the modules should not be accessed directly

|_ /Modules/ModuleDir
|_ /Modules/ModuleDir/templates/
|_ /webroot/

ModuleDir
-- 
regards,
Tom

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux