Support

Admin Tools

#32129 Getting fine-tuning to work with a custom directory structure

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by CloudPlanet on Saturday, 04 January 2020 06:54 CST

CloudPlanet
Hello!

I need some help understanding how the fine-tuning of directories works in htaccess maker.

I run a Joomla shop, but one of the things that I like about WordPress is how they handle user-generated media. In Joomla this is spread out all over the place, some in media/, some in images/, etc.

I like to clean this up and create an uploads/ directory in which I then copy the images/ directory and create a sym link to point images/ to uploads/images/.

This works great in everything but the AdminTools htaccess maker for some reason.

In the 'Server Protection' section, under the 'Frontend directories where file type exceptions are allowed' field, if I replace the 'images' directory with the 'uploads' directory, images on the front-end fail (403 forbidden errors).

It was my understanding that the addition of these directories was recursive? AdminTools seems to be acting recursively in all other instances, except when I'm trying to use the uploads directory.

I have also tried adding 'uploads' to the 'Allow direct access, except .php files, to these directories' field as wel, but this doesn't seem to have any effect either.

I appreciate you assistance and advice on this matter.

Kind regards,

Todd

nicholas
Akeeba Staff
Manager
WARNING AND DISCLAIMER: WHAT YOU ARE TRYING TO DO IS NOT SUPPORTED BY JOOMLA, IT IS A "CORE HACK" AND MAKES YOU INELLIGIBLE FOR SUPPORT BY PRETTY MUCH EVERY JOOMLA EXTENSIONS DEVELOPER OUT THERE. EVEN IF YOU ARE FINE WITH THAT, IT HAS VERY LOW CHANCES OF SUCCESS AND EVEN IN THIS CASE IT WILL MAKE YOUR SITE CONSIDERABLY SLOWER. WE DO NOT RECOMMEND DOING WHAT YOU ARE TRYING TO DO.

I will start with why there are separate folders.

Joomla has different directories for different purposes. This was the most positive step taken during the development of Joomla 1.5. Before that media files were all over the place with no rhyme or reason.

The images directory is meant to be the direct equivalent of wp-content/uploads in WordPress. In other words it is user-uploaded media files that can be managed with Joomla's Media Manager. The name of this folder is hard-coded in Joomla and cannot be changed.

The media directory is used by the Joomla core and all third party extensions to store two kinds of files. One is immutable files such as the CSS, JavaScript and images they use to render their interface. The second type is generated files that needs to be web-accessible such as resized images (the original should be placed in images). While in theory you can change the on-disk location of the directory through the JPATH_MEDIA constant it is also hard-coded in several places in Joomla, making it practically impossible to change.

On this note I would like to note that Joomla is doing it right and WordPress is doing it wrong. WordPress puts all kinds of user-managed media, system media and even plugin executable code under the same folder, wp-content. This is a recipe for disaster. Even Joomla 1.0 fared a bit better than that. Back in 2006 it was understood that mixing media and executable code is a terrible idea, just like mixing user uploads and system managed media. Hence the media directory was born. You are essentially trying to roll back 15 years of evolution and security best practices into an ill-thought hodgepodge which will jeopardize your site's performance and your ability to use it.

In any case, here's what is going on.

Trying to move either folder will break your site, as I explained. I understand that you are trying to sidestep this restriction by using symlinks. However, symlinks are not only slowing down Apache by a factor of 5 when serving images, they are also subject to different handling that regular files.

Accessing a symlinked file results in two kinds of checks. First, Apache needs to know if it can follow the symlink. By default, the generated .htaccess does not tell Apache what to do. You can control that with the "Follow symlinks (may cause a blank page or 500 Internal Server Error)" option. The Always is a very dangerous option. The Only If Owner Matches is the recommended option but the symlink owner and the file owner must match, otherwise you get a 403.

The next check is on the web path being accessed. Actually, that check happens first. Therefore you'd need to add uploads to the "Frontend directories where file type exceptions are allowed" (note that it is without any slashes).

The other problem you have is that all Joomla extensions emit links to media files using the images/ and media/ prefixes since as I explained they are hardcoded to Joomla and expected to work. Therefore, if you remove either of these folders from "Frontend directories where file type exceptions are allowed" your site will break with 403s whenever a file is being accessed in the images or media folder. You'd have to also use a third party extension to rewrite these URLs which is far, far, far, far, far trickier than it sounds. It is also slow as hell and it will fail when some extensions use a plugin event to inject their media after the HTML document is constructed (as we had to do for years with jQuery in Joomla 1.5 to 2.5 inclusive because some stupid plugins would remove even the core's inclusion of jQuery!).

Most importantly, what you are doing does not have possible negative effects to the public frontend of the site but also your administrator backend. The images and media folders are hardcoded everywhere. Messing with them may end up not loading some CSS or JavaScript with potentially catastrophic results on your administration. Don't complain if everything fails to work.

I'd like to note that this is not only a very difficult endeavour but one that even if you manage to pull it will make your site incredibly slower. There are numerous drawbacks and no benefits.

Finally, I'd like to explicitly state that doing that on your site counts as a "core hack" and makes you ineligible for support. While you didn't technically override any Joomla core files you have modified your Joomla environment in such a way that Joomla features which are expected to always be available (the images and media folders) are not. Joomla itself does not give you reasonable tools and configuration options to do so, making your changes arbitrary and impossible to reasonably expect in the standard course of developing a mass distributed extension. Therefore no support will be provided for your site as we can very reasonably expect things to break when our code tries to do something as standard and pedestrian as including a CSS file from the media folder.

Again, I am warning you that what you are doing is really bad and should not be attempted. Ignore my warning at your own risk and peril. If you choose to ignore me be advised that I will not be able to help you with all the different manners your site will be broken. It won't be Admin Tools' fault, that's for sure.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

CloudPlanet
Hi Nicholas,

Thank you for your considered reply. While I understand what you are saying, I'm not actually attempting to move the media/ directory. Only the images/ directory. I have spoken with the Joomla devs themselves regarding this, and was given the green-light to proceed as no core files or systems were being altered.

In fact, Joomla allows for the modification of the images and files directories to be altered in the back-end global configuration. It seems strange to me that they would include this feature if, as you say, it will totally break the installation.

Regardless, I will stop trying to organise the end-user uploads, even though not doing so is causing confusion and difficulty with my end-user clients, who ask, rightly-so, why they're forced to upload documents, files and other media into an 'images' directory.

Thank you again for your reply, and I hope you had a very happy holiday season.

Todd

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!