kieranbarnes Independent PHP, WordPress & CubeCart Programmer

Smarty Security – Stop .tpl access

WHMCS uses the Smarty template engine. Which means your .tpl files are accessible to anyone that knows the path. Quite easy in WHMCS. Whilst not really a major security risk, its bad practise to all these files to be accessed directly.

Add this code into your .htaccess file.

<Files ~ "\.tpl$">
Order allow,deny
Deny from all
</Files>

Related posts

1. [Snippet] Allow PHP in Smarty (CubeCart 5)
   Although it is generally bad practise to put PHP code directly into your (CubeCart 5)...
2. Redirecting non-www to a www prefix
   This old chestnut again. Create or edit the .htaccess file...
3. SSH Security Ramblings
   SSH - Secure Shell isn't that secure. If you're not using it behind a Layer...
4. [Snippet] Debugging Smarty on a live site
   Development server? Staging server? What are they? Sometimes we have to debug code on a...
5. [Snippet] Allow mysql root access from anywhere
   A small annoyance of mine is on local development servers, I can't login to the...