About subfolder .htaccess setting

DursunCan

Google Translate is used.

I am using shared cPanel hosting. I am running my site by adding the following commands to the .htaccess file. But these commands do not work properly when the site is run in subfolder. The site link says /public. How can I remove /public from showing in the sitelink?

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteRule ^(.*)$ public/$1 [L]
RewriteCond %{SERVER_PORT} ^443$
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

clarkwinkelmann

See https://docs.flarum.org/install/#customizing-paths to remove public folder in a subfolder installation.

DursunCan

clarkwinkelmann I didn't move the public folder because mod_rewrite is active on shared hosting. Is moving the public folder a security vulnerability?

clarkwinkelmann

DursunCan if you see the /public folder in the URL, your forum is probably insecure.

You need to either move the files according to https://docs.flarum.org/install/#customizing-paths so that mod_rewrite can be used to protect the files or modify the DocumentRoot so Apache can protect the files through the built-in webroot path transversal protection. The latter is only possible when not using a subfolder, so you should probably use the first option "Customizing Paths".

If you need more details on how a public folder can be used to increase security, this discussion gives more explanations and describes other ways it can be used when changing the webroot is not an option https://discuss.flarum.org/d/17977-forum-public-why-not-just-forum/9

DursunCan

clarkwinkelmann The /public folder is currently not visible in the link. It's because /public was added to the config.php file.