Symfony 1.4 installation and security issues

Question

I have a shared hosting account in which I want to install my symfony 1.4 and deploy and application. I bumped into some issues because of the inability to change the apache config on the production server.

the structure of my web server is:

hosting_account_name   
  html                        <--- public folder

I then moved all files in symfony local app folder to my hosting_account_name and put the web folder content in html

So i got the following structure:

   hosting_account_name   
      apps
      cache
      config
      data
      html
          css
          js
          index.php
          .htaccess
          frontend_dev.php
      lib
      log
      plugins
      test

and i added the line bellow to config/ProjectConfiguration.class.php
$this->setWebDir($this->getRootDir().'/www');

I have a couple of issues though: 1. when i access the frontend_dev.php no images are due to the fact that symfony expects some files to be under a sf/ folder. Should I move the files there? 2. Index.php gives an error. Even with display errors set to yes and 500 internal server error is presented.

Also i had to set my permissions to 777 on cache and log. Their are under the folder html so that's ok for security right?

Make sure you remove the dev front controllers after your initial testing, or at least check if they die() correctly. If they're left there and they allow access to your system, that's a huge information leak. — Maerlyn

Grad van Horck Grad van Horck · Accepted Answer · 2011-10-06T07:40:57

First, you said that the "public" folder is html, but you used $this->setWebDir($this->getRootDir().'/www');. Is it html or www? (Just to make sure)

Then: setting the sf_web_dir should work like you expected, so that shouldn't throw any errors.

To link the /sf Symfony folder, you will need to add something to your apache configuration. As described on the first page of the Jobeet tutorial, you will need to add an Alias to the /lib/vendor/symfony/data/web/sf. If you don't have access to the httpd.conf, you could also add this to your .htaccess.

777 for log and cache is ok. It's what the default project:permissions task does as well.

Symfony 1.4 installation and security issues

1 Answers