Site Security, Files available to download publically.

[TeleMagic]

Hi guys.

 

I have today noticed that a large part of the whmcs site is availabel to download from my server if anyone knows the url.

 

For instance any of my template files can be accessed and same for my modules. This poses a security issue, especially if a hacker can download and view the code for part of my site.

 

Any idea? Can I put .htaccess which denies access to all but the root directory? or would this stop the site from working?

 

Regards

[arhost]

Move your download folder to outside of the public accessible folder tree on your account.

 

See:

 

Further Security Steps

 

http://docs.whmcs.com/Further_Security_Steps

[TeleMagic]

I have had a look at this page, however I am unsure how any of that will stop files in the modules and templates directory being readable?

 

Regards

[SoluteDNS]

On which access level are your files set? (chmod)

 

Folder should not exceed 755 and files should not exceed 644.

[chrismfz]

Use this in your .htaccess for your template files

 

<Files ~ "\.tpl$">

Order allow,deny

Deny from all

</Files>

 

 

<FilesMatch "configuration.php">

Order allow,deny

Deny from all

</FilesMatch>

 

For attachments, templates cache (template_c) and downloads this is enough

http://docs.whmcs.com/Further_Security_Steps