Forum

Thread tagged as: Question, Add-on-development, Members

location of Members App bucket.php file

Simple question I think (not requiring Diagnostic Report, templates or page code):

I am installing my first Members App on an existing site. The bucket.php file needs to be stored in a folder (which can be called "secure") located "outside the web root".

Does this mean the secure folder needs to be in its own separate url/domain?

Kimberly Olmsted

Kimberly Olmsted 0 points

  • 3 years ago
Drew McLellan

Drew McLellan 2638 points
Perch Support

No, the buckets.php file goes into your perch/config/ folder.

Thanks Drew. I have created the buckets.php file and placed it in the perch/config/folder.

The Secure Downloads directions say: "First, you’ll need to create a new bucket that stores its files outside the web root. If you don’t have a perch/config/buckets.php file, create one like the example below. The secure folder should be above the public_html folder, i.e. outside of your web root."

So a more accurate phrasing of my question is, "Does the secure folder need to be in its own separate url/domain?"

Or, in your understanding, is any folder within the main perch folder (and folders within it) considered "outside the web root"?

Drew McLellan

Drew McLellan 2638 points
Perch Support

The web root is the path your web server points to to serve files. If you want your files to be secure they need to be outside that folder so that they can't be downloaded directly.

I know I've read in the Perch documentation that in order for Perch to work it has to be stored in the root of the domain, not in any subdomain, and that is where I have placed it and that is where it works perfectly.

Since my Perch folder lies in the root of the domain, along with my pages folder, my styles folder, etc., I do not have an option of putting a "secure" folder in the root and having it "above" the public_html folder (which in my case I don't have) or "outside" the root.

So -- again, does this secure folder need to be housed in a completely separate domain?

I apologize if I am being completely thick on this subject and I appreciate your patience with helping me to understand the language.

Drew McLellan

Drew McLellan 2638 points
Perch Support

Yes it does. Otherwise it's not secure, as the files can be downloaded without permissions being checked.

If the files are under public_html then they are not secure.

Thank you Drew!