How can I disable access to local.xml and config.xml for external visitors?

Question

I problem that anybody from web can observe my file local.xml and config.xml

I enabled Deny From all in htaccess file in folder app and direct access have been disabled for all files in this folder except for local.xml and config.xml. Unfortunately.

Can somebody advice anything?

Thankx

Answer 1

You should have a app/.htaccess file with this in it:

Order deny,allow
Deny from all

First double check that that file is there. If it is, ask your server admin or hosting company if your server supports .htaccess files. Some hosts restrict .htaccess stuff.

Hope that helps!

Answer 2

i dont trust htaccess, so i use something like this in apache 2.4.x vhost config directly:

<LocationMatch ^/(app/|var/) >
    Require all denied
</LocationMatch>