Symphony.

In the README, under “Security”, we find:

1. For a smooth install process, change permissions for the root, symphony and workspace directories.

AFAIK, it is no more necessary to change permissions for the symphony directory.

Step 2 should be changed accordingly.

Right. Thanks for pointing that out.

This is a note for next release: to add in instruction for moving /manifest/ out of publicly accessible folder to boost security.

Can’t you just automatically create a .htaccess in /manifest/ and put deny from all in it?

I’d prefer phogue’s solution. Moving /manifest/ out of the site root folder would at least require renaming in order to allow several virtual hosts/Symphony installations to run side by side on one server.

Can’t you just automatically create a .htaccess in /manifest/ and put deny from all in it?

Yes, you can. That is a good idea and something that should be there in all installations.

Moving /manifest/ out of the site root folder would at least require renaming in order to allow several virtual hosts/Symphony installations to run side by side on one server.

It won’t be suitable for everyone, hence the idea of using deny from all, but in some situations it might be handy to have the manifest in a private location.

Also it’s a good idea to put requirements (like website) in the README.