2

I was attempting to lock down our Joomla admin folder with an additional Apache-level password, and discovered that there are some Civi resources under the admin folder that need public access (css, js, etc.). On the face of it, it seems to me this would be a bad practice (other public joomla resources do not seem to be under admin), but there are vast oceans of information that I don't know! Could someone explain (as briefly and simply as possible!) why these files are under www/administrator/components/com_civicrm/civicrm/ rather than under www/components/com_civicrm/ or such?

I suppose I should also say that I haven't knowingly put these resources under admin, so I am assuming they were placed there as standard Civi installation. If I've improperly configured Civi, then my question becomes: What did I do/not do to cause this?

  • My hosting support gave me this fix: We just created www/administrator/components/com_civicrm/civicrm/.htaccess and added the following lines to the file: satisfy any allow from all Which then allows for Control Panel v2 "Protection" settings of the /Administrator directory to not affect the civicrm directory. This fixes my immediate concern, but doesn't answer the question about why certain Civi admin components need to be public. – Phil Morice Brubaker Mar 2 '17 at 18:08
1

I have found the same thing. I think there is a misalignment in the configuration, as the components settings file:

* CIVICRM_UF_BASEURL - home URL for your site: * Administration site: * define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/administrator/'); * Front-end site: * define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/'); * */ if (!defined('CIVICRM_UF_BASEURL')) { define( 'CIVICRM_UF_BASEURL' , 'http://www.xyc.com');

For the front end forms to work, it needs to be /administrator to load the resources, however the form then posts to this URL, which is not correct for unauthenticated users.

I am going to copy the relevant resources for now.

0

I've done this for now. You could update to lock down further if the file doesn't match.

            # if file exists, ignore
            RewriteCond %{REQUEST_FILENAME} !-f
            # rewrite css, js, images & other public
            RewriteCond %{REQUEST_URI} \.(?:css|js|jpe?g|gif|png|tiff|woff|woff2)$ [NC]
            RewriteRule ^components/com_civicrm/civicrm(/.*|)$ /administrator/components/com_civicrm/civicrm/$1 [L,NC]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.