why are codeigniter application files in the public html folder

why are codeigniter application files in the public html folder  using -'php,security,apache,codeigniter'

Isn't having all of the files in public view a bad thing?

Surely things such as /system/application/config/database.php should not be publicly visible!

asked Sep 15, 2015 by MoniqueThiel
0 votes

6 Answers

0 votes

The developers of CodeIgniter, EllisLabs, have set up the framework in this way for ease of use. It means that people wishing to try out the framework don't have to fiddle with any permissions settings on their server.

Of course on a production server, you are absolutely right, putting your PHP files in the public HTML folder is not a good idea.

A better way to organise your folders would be:

  • root
    • code_igniter
      • application_folder
        • config
        • controllers
        • models
        • ...
      • system_folder
    • public_html
      • css
      • js
      • images index.php .htaccess

The only other change to be made here would be to change line 26 of index.php to read:

$system_folder = "../../code_igniter/system-folder";
answered Sep 15, 2015 by Cdevnokm
0 votes

You can add the following rule to your .htaccess file to further protect the system and application directories from being viewed (sends a 403 Forbidden error):

# Protect application and system files from being viewed
RewriteRule ^(application|system) - [F,L]
answered Sep 15, 2015 by NydiaDTTIshd
0 votes

Jon Winstanley's answer is perfect, also don't forget to secure file uploads folder, if you have one. I did that by also moving it outside public root, and get the images using below code:

answered Sep 15, 2015 by RosI20
0 votes

Accessing the files within /system/ from a browser will not reveal any sensitive information, because the PHP will be parsed and nothing is output from those files (CI system files may even check to see if a variable has been defined that indicates the file wasn't accessed directly).

That being said, however, you should probably install your entire system folder above web root anyway.

answered Sep 15, 2015 by DeanneEverin
0 votes

You can always place the system directory outside the public directory. Don't forget to update paths inside the the front controller (index.php).

answered Sep 15, 2015 by KariSiegelc
0 votes

With this structure:


You can change in public/index.php these two settings and you are done

$application_folder = '../application';
$system_path = '../system';
answered Sep 15, 2015 by VitoHurstmqv