6

Upgraded to 4.5 a few weeks back on Joomla 3.3.6 and everything is working fine, except for a warning that I see when I first access CiviCRM. Reads:

Security Warning File /home/[directory]/public_html/administrator/components/com_civicrm/civicrm/packages/dompdf/dompdf.php presents a security risk and should be deleted.

Any idea what's causing this and what the proper way to address it might be (short of deleting the file)?

5

You can (and should) resolve this by removing that dompdf.php file from your system. It sounds like the previous version codebase was not removed during your most recent upgrade.

CIVI-SA-2015-001 was a security release which removed dompdf.php from the CiviCRM installation, as it permitted attackers to read arbitrary files from your webserver. This permits an attacker to retrieve the contents of files they would not normally be permitted to view - even system configuration files.

CiviCRM upgrade instructions advise to back up and then delete previous version code files before installing the new CiviCRM codebase, since leaving old code files in place may affect the behaviour of CiviCRM (and in cases like this, the removal of a file is the fix required).

A full list of recent CiviCRM security advisories is available at https://civicrm.org/advisory, and CiviCRM site administrators should sign up for security upgrade notifications

| improve this answer | |
  • 1
    I see the Joomla instructions don't include this advice, but they probably should. – Chris Burgess Apr 7 '15 at 8:00
  • 1
    There might be a problem with Joomla upgrade workflow. In Drupal, it's easy enough to just move out the old code and untar the new code. But Joomla's process for loading code feels convoluted/mysterious to me, and there are some local-only files that need to be preserved (eg civicrm.settings.php). It may be that an alert is the best way to handle important deletions. – Tim Otten Apr 7 '15 at 9:39
  • This is because Joomla's extensions have files in multiple locations, thus requiring deployment that is not required in Drupal. Using the installer script will allow us to make those changes to the files at the appropriate point in the process. Additionally, we need to get down to one civicrm.settings.file that both the frontend and admin components refer to. If that, along with all other local-only files are stored in the /media/civicrm directory structure, that should simplify the installation. – Jeremy Proffitt Apr 7 '15 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.