Nette Documentation Preview

syntax 
Security Warning
****************

.[perex]
**It is EXTREMELY important** that the `config.neon` file, and indeed the entire `app`, `log`, etc. are NOT accessible from a web browser. If these directories can be accessed directly from the Internet, anyone will be able to see your passwords and other sensitive information.

How do you know if a file is protected? You can try to open it in a browser. If your site is located at `http://example.com/` and you have an `app/config` directory with a `config.neon` file located there, try opening the URL `http://example.com/app/config/config.neon`. The browser should report that the page does not exist. If it displays the contents of the configuration file instead, you have a serious security hole in your site and need to patch it.

It is your responsibility to protect critical directories from access from the web.

These directories must be located OUTSIDE the public folder (called document root). If your hosting does not allow you to create folders one level above the public directory, find another hosting. Otherwise, you run a significant security risk.

{{maintitle: Nette Security Warning: Protect config.neon and app}}
{{description: It is extremely important that config.neon and the app and log directories are not accessible from a web browser. Otherwise anyone can see your passwords.}}

Security Warning

It is EXTREMELY important that the config.neon file, and indeed the entire app, log, etc. are NOT accessible from a web browser. If these directories can be accessed directly from the Internet, anyone will be able to see your passwords and other sensitive information.

How do you know if a file is protected? You can try to open it in a browser. If your site is located at http://example.com/ and you have an app/config directory with a config.neon file located there, try opening the URL http://example.com/app/config/config.neon. The browser should report that the page does not exist. If it displays the contents of the configuration file instead, you have a serious security hole in your site and need to patch it.

It is your responsibility to protect critical directories from access from the web.

These directories must be located OUTSIDE the public folder (called document root). If your hosting does not allow you to create folders one level above the public directory, find another hosting. Otherwise, you run a significant security risk.