Change store.php to optionally use store directory outside of web root.

[foofoodog]

Problem

When self-hosting Layerling with PHP, project files are typically saved in a store/ folder located right next to store.php inside the public web document root (/var/www/html/store/).

While store.php generates a .htaccess file to block direct HTTP access, storing user files inside the document root presents a security risk if:

• The web server misconfigures or disables AllowOverride (ignoring .htaccess).
• A non-Apache server (like Nginx) is used without manual deny rules configured.
• Files or directories become publicly browsable or downloadable directly by URL without going through PHP.

Currently, store.php hardcodes the storage location to __DIR__ . DIRECTORY_SEPARATOR . STORE_DIRECTORY, preventing deployments from relocating the data directory outside the web root.

---

Solution

Modify store.php to resolve its storage path from an optional environment variable (e.g. LAYERLING_STORE_PATH), falling back to the current default path for full backward compatibility.

1. Change in store.php

Define a helper function to resolve the base directory:

/** Resolves the base directory for stored projects. */
function store_base_path(): string
{
    $env = getenv('LAYERLING_STORE_PATH') ?: ($_SERVER['LAYERLING_STORE_PATH'] ?? null);
    if (is_string($env) && trim($env) !== '') {
        return rtrim(trim($env), DIRECTORY_SEPARATOR);
    }
    return __DIR__ . DIRECTORY_SEPARATOR . STORE_DIRECTORY;
}

Then in store_root() and ensure_store_guard(), replace:

// Old:
$base = __DIR__ . DIRECTORY_SEPARATOR . STORE_DIRECTORY;

// New:
$base = store_base_path();

2. Change in compose.yml

Mount the storage directory outside /var/www/html/ (e.g., at /var/shared-projects) and set the environment variable:

services:
  web:
    image: php:8.4-apache
    environment:
      - LAYERLING_USER_HEADER=X-Forwarded-Email
      - LAYERLING_STORE_PATH=/var/shared-projects        # <--- points outside web root
    volumes:
      - ./layerling:/var/www/html/
      - ./legal.html:/var/www/html/legal.html
      - ./layerling-shared-projects:/var/shared-projects # <--- mounted outside web root
      - ./uploads.ini:/usr/local/etc/php/conf.d/uploads.ini

---

Why This Addresses the Problem

• Physically Inaccessible Over HTTP: Apache’s DocumentRoot is /var/www/html. Because /var/shared-projects is completely outside the web root and has no URL mapping, the web server cannot serve those files under any URL.
• Zero Reliance on .htaccess: Security no longer depends on web server override rules or .htaccess parsing.
• Seamless PHP Access: store.php reads and writes files via local filesystem calls, completely unaffected by web server routing.
• 100% Backward Compatible: Existing installations without the environment variable continue working with the default local store/ folder as before.

[henmedia]

@foofoodog Good point, thanks for spelling it out with code. store.php now reads the same setting as the Node server, LAYERLING_SHARED_PROJECTS_DIR, so one variable works for both. Point it at a folder outside the web root (/var/shared-projects in your compose file) and no URL reaches the projects, .htaccess or not. Without the variable everything stays as before, with the store folder next to store.php. Like store, the folder has to exist and be writable for the web server, otherwise the server storage stays off. It comes with the next release.

[henmedia]

@foofoodog It's out now in layerling 1.125.0: store.php reads LAYERLING_SHARED_PROJECTS_DIR from this version on, in the static ZIP and in the Docker image, whose build follows shortly.