CiviCRM Community Forums (archive)

Per the suggestions at https://civicrm.org/advisory/civi-sa-2014-001-risk-information-disclosure, I've moved the 'files' directory in my WP installation of CiviCRM to /var/www. I then want to "Move the sensitive data to a location outside the webroot (and update the configuration in civicrm.settings.php or Administer CiviCRM => System Settings => Directories)."

I was able to change the settings for Temporary Files, Images and Custom FIles at Administer>System Settings>Directories, but I do not see a place to change the location of configAndLogDir on that page. Do I have to do that in civicrm.settings.php, and if so, exactly where or how should I do that? There does not seem to be an entry for configAndLogDir now.

Thanks.

Addendum:
Now I'm confused, since CiviCRM has seemed to spawn a whole new /var/www/html/wp-content/plugins/files/ directory and I'm getting the security warning that the debug log should not be downloadable (http://<domain>/wp-content/plugins/files/civicrm/ConfigAndLog/CiviCRM.22d1aaf8f0edb7d46f1fdad932811854.log).