5 ms·

Great point. How much do you want to bet most of these are PHP, where it takes special discipline not to make your top directory web-accessible?

TazeTSchnitzel 11y ago
Does it? If you're on a shared host with just the one directory, maybe. But if you are configuring your own server, you still point it to htdocs and keep the config below it.
pmx 11y ago
It takes very little effort in php. You simply have your index.php and any public assets in the document root and then use index.php as a bootstrap to bring up your application. Everything else goes outside of the document root.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- vog 11y ago
  Yet, almost all well-known PHP applications don't have a public directory. And almost all non-PHP webapplications do have a public directory (e.g. practically all Python/Django and Ruby/Rails projects). So the connection to PHP is apparent till today, although it may have to do more with crappy super-cheap hosting providers than with the language itself.
leftnode 11y ago
Very simple setup. You have: .git web/index.php src/*.php Make the document root /full/path/to/web/index.php. Edit: Also use a deployment tool like Capistrano which removes the .git directory as well.
- vog 11y ago
  Yes, it is easily avoided. But it is still violated by lots of PHP projects, including well-known projects with large userbases: * Wordpress * Tiki * ... and so on. I don't think this is by accident: This technique is too old and well-known to be ignored by large projects. Rather, they conciously don't do that to cause less hassle for the occasional admin: Those can simply dump it into some directory and don't have to setup a proper docroot or anything. And extra work for those who want a more secure setup. This is clearly a usability versus security issue, resolved in the unfortunate, usual way.
  - jbeales 11y ago
    I don't have insight into the decision-making at WordPress, but they probably do this because they want to be compatible with as many web hosts as possible, and so many super-cheap shared hosts just give you a public directory that you're supposed to dump everything in. It's possible to set it up properly on most of these hosts, but it's much more difficult, and if you ever have issues the support team says you're using a "non-supported configuration." At least WordPress lets you move your config file one level above the webroot and will find it automatically.
  - juliangregorian 11y ago
    Drupal, MediaWiki, Laravel, Slim, it's a pretty long list, and it includes projects that target Serious Devlopers.
    - vog 11y ago
      Also, this is really PHP specific. Look at any larger Python (Django/Flask/...) or Ruby (Rails/...) project, and you will always find a proper "public" directory, although it may be named differently. Not sure about Perl though ...

TazeTSchnitzel 11y ago

Does it? If you're on a shared host with just the one directory, maybe. But if you are configuring your own server, you still point it to htdocs and keep the config below it.

pmx 11y ago

It takes very little effort in php. You simply have your index.php and any public assets in the document root and then use index.php as a bootstrap to bring up your application. Everything else goes outside of the document root.

deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
vog 11y ago
Yet, almost all well-known PHP applications don't have a public directory. And almost all non-PHP webapplications do have a public directory (e.g. practically all Python/Django and Ruby/Rails projects). So the connection to PHP is apparent till today, although it may have to do more with crappy super-cheap hosting providers than with the language itself.

leftnode 11y ago

Very simple setup. You have: .git web/index.php src/*.php Make the document root /full/path/to/web/index.php. Edit: Also use a deployment tool like Capistrano which removes the .git directory as well.

vog 11y ago
Yes, it is easily avoided. But it is still violated by lots of PHP projects, including well-known projects with large userbases: * Wordpress * Tiki * ... and so on. I don't think this is by accident: This technique is too old and well-known to be ignored by large projects. Rather, they conciously don't do that to cause less hassle for the occasional admin: Those can simply dump it into some directory and don't have to setup a proper docroot or anything. And extra work for those who want a more secure setup. This is clearly a usability versus security issue, resolved in the unfortunate, usual way.
- jbeales 11y ago
  I don't have insight into the decision-making at WordPress, but they probably do this because they want to be compatible with as many web hosts as possible, and so many super-cheap shared hosts just give you a public directory that you're supposed to dump everything in. It's possible to set it up properly on most of these hosts, but it's much more difficult, and if you ever have issues the support team says you're using a "non-supported configuration." At least WordPress lets you move your config file one level above the webroot and will find it automatically.
- juliangregorian 11y ago
  Drupal, MediaWiki, Laravel, Slim, it's a pretty long list, and it includes projects that target Serious Devlopers.
  - vog 11y ago
    Also, this is really PHP specific. Look at any larger Python (Django/Flask/...) or Ruby (Rails/...) project, and you will always find a proper "public" directory, although it may be named differently. Not sure about Perl though ...