Hi! That is not an issue, but feature request, which must increase security overall.
For now all joomla files are placed in web server root, but in fact for joomla site works it must contains for direct access:
I'm tried to create folder /public, than create symlinks to previously listed elements and configure web server-root to /public. It's works perfectly. Extensions are installing/uninstalling in private folder and for any direct request to any files which not in public I'm catching 404 (of course).
This practice (moving to private folders any files except static and entry-point) is widely used in most popular php web frameworks such as symfony or laravel. Maybe it's time for Joomla!?
Yes, that's big B/C for dirty-maked extensions, but how many of their are brokes Joomla! reputation?
Labels |
Added:
?
|
Labels |
Removed:
?
|
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-11-30 14:15:10 |
Closed_By | ⇒ | brianteeman |
Thanks or your comments. I am closing this however as it is not possible to achieve this (even if the issues Michael raised are resolved) with the majority of hared hosting which do not allow access outside of the web root
First of all, I totally understand that it is not possible in joomla 3 as default behavior, but maybe it's possible in v.4 as option on installation.
Updates are extracted in place from the site root, the updater would have to be rewritten to be path constant aware
But it's works properly. I'm not tried to update joomla, but updating extensions works fine.
Any of the supported XML manifests (forms or extension manifests as an example) which define a custom path for entities would need to become path constant aware (and no, a magic "well we just replace administrator/components with custom_path_for_administrator/components" isn't the answer on its own)
calculate path relative JPATH_BASE?
You're breaking anything not using the path constants correctly as is
Their are MUST be broken
For templates, what we have? <FilesMatch ~ ".(php|inc)"> Deny from all?
majority of hared hosting which do not allow access outside of the web root
Yeah, and any of their MUST be RIP too
Thank's for yours answers!
First of all, I totally understand that it is not possible in joomla 3 as
default behavior, but maybe it's possible in v.4 as option on installation.
Its not and it opens a massive heap of issues to have both at the same
time. Maybe it is something that is being worked on for Joomla-X
(pythagorus) I dont know.
Yeah, and any of their MUST be RIP too
Perhaps - but its not something that we can control
Regarding template media, ... So no, this shouldn't be moved.
@mbabker actually this could be done and retain 100% B/C. Give the media/tmpl_isis/js
priority and if that doesn't exist fall back to administrator/templates/isis/js
, this is like one dir check more, nothing too expensive in processing. Also this will allow Joomla to have 2 places for all its static files: media and images (easier to sync with a custom CDN, etc)
That's change for the sake of change. What practicality does it offer? Also, how do you then cope with if someone were to use the same template name for a site and admin template? Yes, I get it CAN be done, but that doesn't necessarily mean it SHOULD.
The extension install libraries make use of the path constants correctly IIRC, so install/update routines would work fine for those (caveat the files extension would have issues because it uses path attributes relative to the site root). The core update though would fail because it is literally just extracting the ZIP package in place from the Joomla root path.
The issue with fixing the updater and stuff using file paths in a non-PHP context (XML primarily) is it has to become fully aware of all of the path constants. For example, in the administrator directory, you have a JPATH_MANIFESTS
, JPATH_THEMES
, and JPATH_CACHE
equating to administrator/manifests
, administrator/themes
, and administrator/cache
respectively. So in the XML elements you couldn't just straight up replace /administrator
with whatever is defined in the JPATH_ADMINISTRATOR
constant. It's a little easier with paths that aren't nested into a directory (which if I'm not mistaken is every other path constant). You also have to cope with the fact that JPATH_BASE
, JPATH_CACHE
, and JPATH_THEMES
are not constant paths; they change based on whichever application you're running.
Even if the codebase can be fixed up to allow someone with the right knowledge to move the filesystem around, it shouldn't be an installation option. IMO it's not too hard to run the various move commands on a server and create the needed defines.php
to tell Joomla where everything is at. For those with the requisite skill set, they'll have no issue doing so. For those who buy into WordPress' philosophy of a user not needing to understand much of anything about the platform their site is running on, they don't really need to know nor care where the files are or be concerned with options to move them around.
Because of how Joomla is distributed, this can't be a default behavior (there are webhosts people use which disallow writing stuff outside the web root).
I had a decent list on another issue here somewhere in the past, but it's not that simple to just move the directory structure, even if the code would otherwise suggest it with the
JPATH_*
path constants.JPATH_ADMINISTRATOR . '/whatever'
gets broken)Regarding template media, if you move this media to the
/media
directory you're introducing major B/C breaks regarding the logic used to override media (remember through the JHtml media loaders everything in themedia
directory can be overridden with a file in the template) for no real benefit (you lower the directory count in the web space for files that will be in the web space anyway). So no, this shouldn't be moved.Regarding images versus media, one is in essence a user upload path and the other primarily for extension web assets (CSS, JS, etc.). At best you might consolidate that into a single "assets" directory with two branches but there is a valid reason to split the two.