Hi MODx team,
wouldn’t it be advisable to restrict access to the sensitive files in assets/cache with a .htaccess file and the usual "Order allow,deny" "Deny from all" directives? I know the PHP interpreter will throw an error when loading these file in most cases, but can that always be guaranteed and not something compromised by accident?
On the same note, one also could protect direct access to other .php and .tpl files in the asset directory by putting this into a assets/.htaccess file:
# Restrict direct access to script file types and templates
<FilesMatch "\.(php|tpl)$">
Order allow,deny
Deny from all
</FilesMatch>
Just in case somebody tries to temper with those files.
Henrik
