Does it really need to move the preview images?

There are 2 possible solutions here:

• move the files to media (which is a publicly accessible folder)
• keep the files in their existing place and add a controller function to stream them

I find using PHP for this task is overkill thus I went with the move of the files. Just a reminder that all these files moving make sense if you consider the reason behind them: keep the templates folder inaccessible from the browser, the entry points for any well-tuned Joomla site should be:

• images
• media
• index.php
• administrator/index.php
• api/index.php
• administrator/com_joomlaupdate/extract.php (or update.php)
• everything else should not be accessible from the browser or the surface of attack is hugely increased

Does it really need to move the preview images?

There are 2 possible solutions here:

* move the files to media (which is a publicly accessible folder)

* keep the files in their existing place and add a controller function to stream them

I find using PHP for this task is overkill thus I went with the move of the files. Just a reminder that all these files moving make sense if you consider the reason behind them: keep the templates folder inaccessible from the browser, the entry points for any well-tuned Joomla site should be:

* `images`

* `media`

* `index.php`

* `administrator/index.php`

* `api/index.php`

* `administrator/com_joomlaupdate/extract.php` (or update.php)

* everything else **should not be accessible from the browser** or the surface of attack is hugely increased

@dgrammatiko I still don't get why it needs to move the preview images. Can they really have been modified by a user for a core template and do we want to keep these modifications?