Godaddy上的CodeIgniter安装具有最佳安全性

Question

On godaddy hosting public_html is given as a web root. I'm trying to install CodeIgniter on it so I'd like the whole framework to be outside of webroot (for security reasons). For this specific purpose, in the public_html directory I've created .htaccess with the following code:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^(www.)?example.com$ [NC]
RewriteCond %{REQUEST_URI} !^/sub_webroot/
RewriteRule ^(.*)$ ./sub_webroot/index.php?$1 [L]

Directory/file structure looks like this:

public_html
    .htaccess
    CodeIgniter (whole framework files except index.php)
    sub_webroot
        index.php (CI index.php)
        assets
             sample.png

The framework is loaded successfully and index.php is removed as well. The problem which I am facing is that I can't open sample.png via example.com/assets/sample.png and it is obvious it is happening because of the line RewriteRule ^(.*)$ ./sub_webroot/index.php?$1 [L]. I can't made up my mind how it would be possible to access the assets directory and keep the framework working successfully as it is working now. Any ideas how to change .htaccess that meets my needs ?

Answer 1

This is how we solved this problem: adding a condition to ignore the rewrite if requesting from the assets folder. You can add/remove options to ignore as required - really you only need the assets option in your case.

#Checks to see if the user is attempting to access a valid file,
#such as an image or css document
RewriteCond $1 !^(index\.php|assets|css|png|jpg|gif|robots\.txt|favicon\.ico)

Place this before your RewriteRule.

There's a pretty comprehensive Codeigniter .htaccess for troublesome hosts at: http://www.chrishjorth.com/blog/one-com-codeigniter-htaccess-rewrite-rules/, that's nicely commented:

# @author: Chris Hjorth, www.chrishjorth.com
# Make index.php the directory index page
DirectoryIndex index.php
#Protect the .htaccess files
<Files .htaccess>
    order allow,deny
    deny from all
</Files>
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /subfolder/
    # START CodeIgniter ------------------------------------------------------------------------------------------------------------
    # based on http://www.danielwmoore.com/extras/index.php?topic=7691.0 and http://ellislab.com/forums/viewthread/132758/
    # Redirect default controller to "/".
    # This is to prevent duplicated content. (/welcome/index =&gt; /)
    RewriteRule ^(welcome(/index)?)/?$ /subfolder/ [L,R=301]
    # Remove /index/ segment on the URL, again to prevent duplicate content.
    RewriteRule ^(.*)/index/? $1 [L,R=301]
    # Remove trailing slashes, also to remove duplicate content
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    # Remove multiple slashes in between, just to remove the possibility of fabricating crazy links.
    RewriteCond %{REQUEST_URI} ^(.*)//(.*)$
    RewriteRule . %1/%2 [R=301,L]
    # Ignore certain files and folders in this rewrite
    RewriteCond $1 !^(index\.php|assets|frameworks|uploads|robots\.txt|favicon\.ico)
    # [NC] = no case - case insensitive
    # [L] = Last rule, last rewrite for this set of conditions
    # [QSA] = Query String Append, should be used to prevent all redirects from going to your default controller, which happens on 
    # some server configurations.
    RewriteRule ^(.*)$ /subfolder/index.php?$1 [NC,L,QSA]
    # END CodeIgniter --------------------------------------------------------------------------------------------------------------
</IfModule>
# If Mod_rewrite is NOT installed go to index.php
<IfModule !mod_rewrite.c>
    ErrorDocument 404 /index.php
</IfModule>