Thread

Hi,

I’m running into an issue with my EE 1.6.8 installs where a public/guest user could potentially view any and all ‘raw’ template files as long as they knew the direct path. For instance, on my server a URL such as the one below would expose an unprocessed version of a template (including all EE tags, but not PHP):

http://www.domain.com/themes/site/index.php

For now I’ve gone ahead and created a .htaccess file in the ‘themes’ directory to deny all requests for .php files. Unfortunately that’s causing trouble for one of my add-ons (Wygwam) which has some core .php files that exist in ‘themes/wygwam’.

So, I was wondering if there was a more elegant/easier way to prevent all such “template.php” files from being viewable, while not hindering other .php files from being used by EE from the ‘themes’ directory.

thanks,

Can you just drop the htaccess file in your templates directory? Not for the entire themes directory?

Thanks for the assist, Adam.

colddigital, does that make sense?

Thanks Adam and Sue. I’ll definitely give that a try.  I mistakenly presumed that all the template groups had to exist in the ‘themes’ folder, woops!

They can reside anywhere. Just set the path in Global Template Preferences.

Glad we cleared that up, colddigital. Do you still need assistance with this, or are you all set?

I’m all set and Adam’s suggestion worked great. Thanks!

Very glad to hear it 😊