move logs, temp, include and config out of web tree

[tensor1982]

For security sake please consider moving logs, temp, include and config directories out of the DocumentRoot?.

DocumentRoot? should only have .php and static files which are directly accessible by requesting the corresponding URL.

A common approach is too carelessly delete .htaccess files and forget about any access control if something does not work. With a new approach only public (world known) files will be in document root and there will be no sensistive files directly accessible though a web server.

[thomasb]

Logs and temp can be moved by config. Howto_Install describes what's needed to be protected. There's no one-structure-fit-all solution we could implement.

[tensor]

Quote from the HOWTO:

This is a very common problem. One solution is to either empty out the .htaccess file, or delete it entirely, in the root of the RoundCube installation folder.

It may happen with a facist (==good) admin who prohibited some overrides.
Having critical, epecially conf, file outside of web tree would be helpful.
If I implement it in installer (with upgrade capability) and change the default layout, whould it be included in 0.3 series?