Why are public files in Joomla admin directory?

Question

I was attempting to lock down our Joomla admin folder with an additional Apache-level password, and discovered that there are some Civi resources under the admin folder that need public access (css, js, etc.). On the face of it, it seems to me this would be a bad practice (other public joomla resources do not seem to be under admin), but there are vast oceans of information that I don't know! Could someone explain (as briefly and simply as possible!) why these files are under www/administrator/components/com_civicrm/civicrm/ rather than under www/components/com_civicrm/ or such?

I suppose I should also say that I haven't knowingly put these resources under admin, so I am assuming they were placed there as standard Civi installation. If I've improperly configured Civi, then my question becomes: What did I do/not do to cause this?

Answer 1

I have found the same thing. I think there is a misalignment in the configuration, as the components settings file:

* CIVICRM_UF_BASEURL - home URL for your site: * Administration site: * define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/administrator/'); * Front-end site: * define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/'); * */ if (!defined('CIVICRM_UF_BASEURL')) { define( 'CIVICRM_UF_BASEURL' , 'http://www.xyc.com');

For the front end forms to work, it needs to be /administrator to load the resources, however the form then posts to this URL, which is not correct for unauthenticated users.

I am going to copy the relevant resources for now.

Answer 2

I've done this for now. You could update to lock down further if the file doesn't match.

            # if file exists, ignore
            RewriteCond %{REQUEST_FILENAME} !-f
            # rewrite css, js, images & other public
            RewriteCond %{REQUEST_URI} \.(?:css|js|jpe?g|gif|png|tiff|woff|woff2)$ [NC]
            RewriteRule ^components/com_civicrm/civicrm(/.*|)$ /administrator/components/com_civicrm/civicrm/$1 [L,NC]