Support

Admin Tools

#10053 htaccess prevents extension "widgetkit" from creating necessary files

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by user48152 on Sunday, 09 October 2011 01:32 CDT

Thursday, 06 October 2011 05:08 CDT

formfranska
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (My components, modules or templates stopped working after using Admin Tools .htaccess Maker and how to determine and apply exceptions, Admin Tools troubleshooting guide)? Yes
Have I searched the forum before posting? Yes
Have I read the documentation before posting (The .htaccess maker: Server protection)? Yes, and I think the answer is here somewhere but not sure how to apply...
Joomla! version: (1.7.1)
PHP version: (5.3.4 )
MySQL version: (Server version: 5.1.56, MySQL client version: 4.1.22)
Host: (http://www.oderland.se)
Admin Tools version: (Admin Tools version 2.1.10)


Description of my issue:
The issue has to do with files that Widgetkit (extension from yootheme) has to create to build its interface.

This is what Michael Maass at Yootheme told me:

The culprit was a security setting that you must have added to your .htaccess using the 3rd party extension "Admin Tools". This denied access to the cache folder so two important files could not be used to build the Widgetkit interface.


I don't have the proper knowledge but as far as I can understand, maybe I would have to apply the following setting in htaccess maker:
"Allow direct access, including .php files, to these directories"
I do read your warnings about allowing direct access to the cache folder but wouldn't this be the only solution for me if I need to use the Widgetkit extension? Or do you have more clever suggestions in store? :-)

Until I can solve this Michael disabled my beloved (Admin Tools customed) .htaccess but I do wish to use it.

What would you suggest, please, Nicholas?

Best Regards
Anna

Thursday, 06 October 2011 05:33 CDT

nicholas
Yes, that's correct, Admin Tools' .htaccess Maker does that on purpose because the cache directory is not supposed to be accessible directly over the web. Unfortunately, this is a fact that most developers seem to ignore.

In any case, you can add the exact cache directory where WidgetKit adds its files to the "Allow direct access, including .php files, to these directories" list, e.g. add
cache/widgetkit
in there. I am not sure if I remember the directory correctly; you can check with your FTP programme.

Please note that this is a potentially unsafe setting. By doing that, this directory is now allowed to host any kind of executable PHP files which will happily run over the web. In the unlikely (but not impossible) event that an attacker exploits a vulnerability on any extension installed on your site to upload file to that directory it is perfectly possible that he'll be able to install a hacking script in there, execute it and hack your site despite having Admin Tools installed. That said, the possibility of this happening is considerably small.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Thursday, 06 October 2011 08:22 CDT

formfranska
All is good now with your help Nicholas.

Thank you :-)

Greetings
Anna

Thursday, 06 October 2011 08:55 CDT

formfranska
Update:

Hello again Nicholas,

Talked to Michael at Yootheme again. It turns out Widgetkit is not using php files in the cache so I changed to this safer setting:

htaccess maker Setting in Admin Tools
Server protection > Exceptions > Allow direct access, except .php files, to these directories:
cache/widgetkit

Now all is perfect then :-)

Greetings
Anna

Thursday, 06 October 2011 09:08 CDT

nicholas
Yup, if it's not using PHP files in the cache directory it's a good idea to put that directory in the "Allow direct access, except .php files, to these directories" list. It's the safest approach, as it safeguards your site against rogue PHP scripts, while allowing WidgetKit to work properly :)

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Sunday, 09 October 2011 01:32 CDT

user48152
Thank you to all who investigated and sought out solutions to this issue! I was also experiencing issues with my Widgetkit, but by adding cache/widgetkit as an exception (as mentioned by Anna), I was able to get my site working exactly how it should.

Thanks again!
Belen A.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!