Question

I’ve this .htaccess file that move all the request to index.php?request=(URI) that elaborates them, except for URI that starts with -file/ that means we are trying to access a public file. Inside the system/root/ there’s only the public index.php file that manage the request so that final users cannot see any system/ file. And application/public/ contains only CSS, images, javascript and public stuff.

1. Is this safe?

   RewriteEngine On
   
   RewriteRule -file/(.*) application/public/$1 [L]
   
   # RewriteCond %{REQUEST_FILENAME} !-f
   RewriteRule ^(.*)$ system/root/index.php?request=$1 [NC,L]
   

2. It works, but does this code has something more that should be deleted or something that miss that should be added?

3. The commented line has any sense now?

Answer 1

It should be

RewriteRule ^-file/(.*) application/public/$1 [L]

Otherwise, it would match something like

http://domain.com/controller/method/any-file/

Unless you know that you’ll never use -file in any of your system/root requests.