We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 51428
    • 42 Posts
    Hi!
    I didn't get the answer last time, so maybe now:

    The questions are about .htaccess.
    1. The one that is in the "core" folder. It looked like this in my case:
    IndexIgnore *
    Redirect /core http://www.google.com
        <Files .htaccess>
            Deny from all 
        </Files>

    Then I was adviced to add two strokes, and the file turned to this:
    IndexIgnore *
    Redirect /core http://www.google.com
        <Files .htaccess>
            Deny from all 
        </Files>
    Order Allow,Deny
    Deny from All

    But the current variant does not redirect to google, it just shows the Internal server error. What is wrong?

    2. And the one that is in the site's root folder. Here it is:
    IndexIgnore *
        <Files .htaccess>
            Deny from all 
        </Files>
        <Files config.core.php>
            Deny from all 
        </Files>
    Order Allow, Deny
    Deny from All

    Is it normal that file config.core.php was placed in the root directory automatically? It contains a path to core and has an open access. And how should a well-protected .htaccess look like in case of site's root folder placement?
    • The location of the core files needs to be available, so there are three of these config.core.php files, one in the site root, one in /manager/ and one in /connectors/. Since those folders can be renamed and/or relocated, they each have to have their own source for the core's location. And of course upon initialization via the index.php file, MODX needs to know where its core is located.
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 51428
        • 42 Posts
        Okay )) But I set "Deny from all" for config.core.php. Will the engine still work? I just denied access for visitors, they don't need to know where the core folder is. Right?

        So, what about the other questions?
        • Those directives only apply to requests to the web server. Scripts that internally include other scripts via the file system, as is done with the various include files, aren't effected by them, since they aren't involving the web server at all. The only scripts the web server deals with are the various index.php files, such as the one in the root and the one in the manager directory.

          The rest of it, I have no idea, so cannot answer those questions.

          If concerned about access to the core, I just move it outside of the web root.
            Studying MODX in the desert - http://sottwell.com
            Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
            Join the Slack Community - http://modx.org