I was browsing the prestashop forum and ended up on a thread concerning an issue with people stealing a site design by downloading the template files from the theme directory. It struck me that this is probably something that those of you who use other template systems with your sites may also face, so thought I’d post the solution here too.
The problem is that although php files cannot be viewed directly on your browser, other source files can be e.g. files ending in .tpl
The best way to protect your site is to change the permissions on these files to 600. This will make them accessible only by your own code on the server and present anyone nosey enough to try and look at them with a 403 (forbidden) error. The same is true for php files (although these shouldn’t display the source unless your server configuration is broken).
Simple.
Comments
6 responses to “Preventing the copying of your site design templates”
I broke and then fixed the permissions, so the example above should work again. The .htaccess trick can work too, and in some cases may be better. Some shared hosting environments for example might not be able to read the .tpl file internally either if the permissions are set strictly. In saying that it never hurts to have too tight security and then relax it until it works again.
thanks for share this tips
stripped my tags… sorry…
<Files ~ “\.(tpl)$”>
deny from all
</Files>
You can also create an “.htaccess” file in the themes folder and put the following inside it:
deny from all
Should work equally well to put it in the site’s .htaccess, but that may get overwritten on a store update.
A bit late at responding to this – I must have missed it! You are quite right that the example is broken as the permissions for that file are no longer 600. I suggest the best thing to do is try it yourself – I use that subdomain for demonstrations and testing, so it was a bad choice to use as an example!
hello, nice post!
i tried the protected template file above. it seemed it did not work. i still could see the content of index.tpl
am i missing something?
regards,