1

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache.

I did the Magento Security Scan on my website, and it showed the following problem-

Your Web server is configured to run Magento from %MAGENTO_ROOT% directory. It is recommended to set %MAGENTO_ROOT%/pub as a Web server root directory.

In response I found my way to this page https://devdocs.magento.com/guides/v2.3/install-gde/tutorials/change-docroot-to-pub.html, which had instructions to fix the problem, but they seem to only apply to installations that are not on shared web hosting plans.

I tried to find the files that contain the document root url through SSH-ing into the shared server just in case, but since I don't have root access it didn't show.

I contacted my hosting provider twice to change the document root for me through /var/cpanel/userdata/username/example.com, but since there is a language barrier, they told me that that was beyond their expertise, or something like that.

My site is run under https, of course, if that helps any.

I am not too security savvy with Magento, so what I want to know is, if I use the .htaccess commands below to change the document root, would they alone make my Magento installation in public_html secure?-

RewriteEngine on
RewriteBase /

RewriteCond %{REQUEST_URI} !^/pub/

RewriteCond %{HTTP_HOST} ^(www\.)?example\.

RewriteRule ^(.*)$ /pub/$1 [L]

Do I need to move/copy any Magento files from public_html to public_html/pub if I use the .htaccess commmands above, if so, which files?

If I leave the Magento files in public_html and use the rewrite commands, will that be a security problem?

Do I need to change any settings in the Magento Admin after using the rewrite commands?

Thank you very much.

  • no need to move any files, if your root is /pub/ and you have working site its ok, magento can work from two web roots – MagenX May 20 at 19:13
  • Thanks for verifying that I don't need to move my files around. Do you know of any security problems that may arise if I do any of the other things like I spoke of above? – Krang May 20 at 22:39
  • correct way is to configure DocumentRoot to avoid any issues with rewrites. – MagenX May 21 at 8:35
  • any solution to fix this issue? – zuber bandi Jun 27 at 7:48
1

Depending on your host you may be able to sort yourself.

Do you have a cpanel login?

Check this demo

https://demo.cpanel.net:2083/cpsess6663391586/frontend/paper_lantern/index.html?login=1&post_login=30734131148808

Under domains you may have the option to change your document root to /public_html/pub/

You do not need to modify any Magento files. If you have modified any files undo your changes first.

Extract the site as normal under public_html

In terms of security the site will be in the same state. That said the point in all this is to avoid visitors being able to access folders to trigger a setup wizard or browse for other vulnerabilities. Providing you lock folders down via htaccess and maintain these then your site is secure. The idea is that one folder /pub is easier to keep safe than many app/etc bin etc

https://devdocs.magento.com/guides/v2.3/install-gde/tutorials/change-docroot-to-pub.html

  • Just quick note - last time I tried this on a cpanel server I couldn't get the setup screens to load. So you may have to install Magento first and then alter doc root after – Dominic Xigen May 20 at 21:00
  • Thanks for verifying that I don't need to modify any files. Yes, I have a cPanel login, and I was not able to do it through that. I also attempted to change the document root through SSH, but since I did not have filesystem root access, I could not. Do you know of any security problems if I do things like I spoke of above? – Krang May 20 at 22:30
  • In terms of security the site will be in the same state. That said the point in all this is to avoid visitors being able to access folders to trigger a setup wizard or browse for other vulnerabilities. Providing you lock folders down via htaccess and maintain these then your site is secure. The idea is that one folder /pub is easier to keep safe than many app/etc bin etc – Dominic Xigen May 20 at 22:52
  • If you care to, modify your answer by putting your comment just above into it, and possibly add a link to information about Rewrites and security (if there is one), and I will accept your answer. – Krang May 21 at 19:41
  • Sure. All done. – Dominic Xigen May 21 at 21:18
0

In case others want to know how to do this, this is what I did, and where I put the code to make the document root change work.

I edited the .htaccess file inside of my public_html folder, and placed the needed code under this section / heading:

############################################
## you can put here your magento root folder
## path relative to web root

    #RewriteBase /magento/

This is the code that needs to go in that section for a simple rewrite. Be sure to change "example" to your domain name, that is, if your domain name is bluecar.com, you would replace "example" below with bluecar:

RewriteBase /public_html/pub

# Rewrites all URLS without pub in them
RewriteCond %{REQUEST_URI} !^/pub/

# Rewrites all URLS
RewriteCond %{HTTP_HOST} ^(www\.)?example\.

# Rewrite all those to insert /folder
RewriteRule ^(.*)$ /pub/$1 [L]

That code worked for my site to direct web browsers to the /pub folder.

I'm not very savvy with .htaccess commands, so make any needed backups if you use this code.

After I made the changes, I ran the Magento Security Scan again, and again it showed the same error. This was expected seeing how it looks for the document root line in certain files I can't get to.

But, to make sure that my .htaccess changes were indeed working (calling /pub/index.php), I edited the index.php file in the /pub folder to have it write a line of text to a file, and it did.

From all of the research that I did, this appears to be a secure approach.

All of the tests that I have done on my site since this change are positive.

I hope this helps others.

If I have made any errors / mistakes, or overlooked a security issue, please someone point them out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.