4 ms·

Yes but that’s a framework specific issue. And usually your documentroot would point to a directory below that which holds .env. Oh the memories of apache and p

Yes but that’s a framework specific issue. And usually your documentroot would point to a directory below that which holds .env. Oh the memories of apache and php.

tacker2000 3y ago
Your comment makes no sense. How is that framework or PHP specific? Its simply a misconfiguration the server.
- gumballindie 3y ago
  Some frameworks in the old days of PHP relied on .htaccess files to restrict access to unwanted files. Properly implemented frameworks would load everything from a directory above the documentroot to avoid these issues.
  - tacker2000 3y ago
    .htaccess is a config file type used by the Apache web server. The server software reads the config file and then decides if the folder can be accessed externally or not. It has nothing to do with PHP what framework or any other language you are running.
    - gumballindie 3y ago
      > .htaccess is a config file type used by the Apache web server. Yup. That's why I am saying that in the past .htaccess used to be used, but modern php frameworks no longer rely on it. Poor phrasing on my end.
Nextgrid 3y ago
The mere concept of a "document root" is a problem though and a major footgun if you don't know what you're doing. Every other language acts as its own web server which wouldn't even be capable of serving files even if you tried; the only thing it does is respond to web routes defined by the application. This eliminates a whole chunk of security issues, from the one described above to malicious file uploads (PHP is probably the only language where a malicious file upload leads to RCE by default - other languages could happily accept and serve the malicious file back but wouldn't execute it).
- gumballindie 3y ago
  > The mere concept of a "document root" is a problem though and a major footgun if you don't know what you're doing. A non issue though after 2-3 days of working with this approach. All modern PHP frameworks have a so called front controller (an index.php file) that loads what it requires from ../ after, ideally, properly validating the request to avoid issues.
  - pavel_lishin 3y ago
    > A non issue though after 2-3 days of working with this approach. Tell that to all the people with bleeding feet.

Yes but that’s a framework specific issue. And usually your documentroot would point to a directory below that which holds .env. Oh the memories of apache and php.

tacker2000 3y ago

Your comment makes no sense. How is that framework or PHP specific? Its simply a misconfiguration the server.

gumballindie 3y ago
Some frameworks in the old days of PHP relied on .htaccess files to restrict access to unwanted files. Properly implemented frameworks would load everything from a directory above the documentroot to avoid these issues.
- tacker2000 3y ago
  .htaccess is a config file type used by the Apache web server. The server software reads the config file and then decides if the folder can be accessed externally or not. It has nothing to do with PHP what framework or any other language you are running.
  - gumballindie 3y ago
    > .htaccess is a config file type used by the Apache web server. Yup. That's why I am saying that in the past .htaccess used to be used, but modern php frameworks no longer rely on it. Poor phrasing on my end.

Nextgrid 3y ago

The mere concept of a "document root" is a problem though and a major footgun if you don't know what you're doing. Every other language acts as its own web server which wouldn't even be capable of serving files even if you tried; the only thing it does is respond to web routes defined by the application. This eliminates a whole chunk of security issues, from the one described above to malicious file uploads (PHP is probably the only language where a malicious file upload leads to RCE by default - other languages could happily accept and serve the malicious file back but wouldn't execute it).

gumballindie 3y ago
> The mere concept of a "document root" is a problem though and a major footgun if you don't know what you're doing. A non issue though after 2-3 days of working with this approach. All modern PHP frameworks have a so called front controller (an index.php file) that loads what it requires from ../ after, ideally, properly validating the request to avoid issues.
- pavel_lishin 3y ago
  > A non issue though after 2-3 days of working with this approach. Tell that to all the people with bleeding feet.