I’ve just been looking at a PHP MVC Framework by a very talented Twitter friend of mine and while it does look great, and I will be using it in my next project, it suffers from the same flaw as many of the others. Web root pollution.
The diagram above shows how a framework should be laid out.
- System: Not web accessible. Contains Framework core files. Should not be user edited. Makes upgrades easy and multiple applications can share same core files.
- Application: Not web accessible. Contains application specific files.
- Application/HTDOCS: The only web accessible folder. Contains static files CSS/JS/Images/etc
It is more secure, easier to upgrade and IMHO neater than having everything in the Web-Root. It is also the first thing I do when I perform a new CI or Kohana install.
I also think this might be how Django and Rails does it. But I’ve only ever had a fleeting glance at both, so I might be wrong.
I understand why Framework authors do it this way, not everyone’s shared host lets them have folders outside of web-root. But the most secure way should be the default, with instructions for moving folders into web-root if required for host.