How do I disallow access to the core folder?

I’ve been running www.compeek.net on Revolution 2.0 Beta 2 (SVN), and I just realized that going to www.compeek.net/core gets you access to seeing the folder structure.

What’s the best way to prevent this? The ways I can think of are using mod_rewrite for redirection, httpd.conf files for disallowing (although I can’t seem to get this to work), or simply putting an index.html file in that’s blank. The problem with this last option is that I would have to put a file in every single subfolder.

How should I accomplish this?

You can add

Options -Indexes

to your .htaccess file (or the httpd.conf file)

Thanks! I never thought about that. Is this secure enough? I mean, if somebody goes to www.compeek.net/core and get that, they’ll know it exists.

It stops Apache from producing a directory listing. Which, unless for some reason you want one, is a good idea in any case.

Yes, it is definitely a good idea, but I’m just asking if it’s enough security?

Actually, there are two options here, but I’ll save relocating the core folder for the documentation. The .htaccess I use when I must locate the Revolution core in a directory served by the web server contains the following:

This should prevent direct access to the php files from the internet within any of the core directories. No files within the core directory need to be accessible other than by include.

Thanks, OpenGeek. That should pretty much cover anything I was concerned about.

Is there an equivalent for Evo?

I think Evo still has directly access dependencies scattered about, like Captcha for one. It would take some testing and time to be sure. See this as an example: http://svn.modxcms.com/docs/display/MODx096/Friendly+URL+Solutions#FriendlyURLSolutions-ManagerProtection