Support

Hello Jeremy,

The folder browser, used for the Output Directory, can browse every single folder that your host has made visible to your site's user on your server. Please remember that we are NOT your host and we can't be possibly be held liable for security issues that have to do with the server setup. I would also like to remind you that even if we basically blatantly lied to you and forbade you to browse to top level directories an actual hacker who uploads an exploit kit (like C99) can still access those folders. So yeah, there is that security issue, but it's coming from how your host has set up their server, not how our software works. Do note that it's only visible to Super Users, the same people who can install eXtplorer that also does the same – or, worse, install any kind of executable code including exploits which can do MUCH more malicious things than produce a directory listing. If you do not blindly trust someone do NOT give them Super User access!!!!!!!!!!!!

As for why show all the folders: please read the security chapter. It makes security sense to put the output directory outside the web root. Ideally, you should put it somewhere as far removed from the server as possible. On SHARED hosting this means a subdirectory of the site root's parent directory. Having ONLY that in mind you are semi-correct in saying that top level directories should not be visible. However this is NOT the case on dedicated servers. Typically the web root of the (one and only hosted) web site is /var/www/html, with the /var/www and /var folders being intentionally unreadable and unwriteable by the unprivileged user the web server runs under. This means that a good location for the backup folder would be an arbitrary top level directory such as /backups. And that's why you have to be allowed to enter top level directories on the browser popup.

As for why ENTER brings up the directory browser for the Output Directory: pressing ENTER anywhere in the form always triggers the first click handler on the form which happens to be the Directory Browser for the Output Directory. I have tried to work around it but it breaks other things. However, that's simply mildly annoying. I would recommend not pressing ENTER on web forms you do not intend to submit anyway.

I'm not implying that you are creating a security issue directly, but it seems like you should not be able to browse above the public_html area from joomla.

I explained why it's possible and why it's necessary. Please do read the Security Information chapter in our documentation. Your impression is based on a very false idea of what security means.

Hint: if you put your backups in a predictable directory you make hackers' life MUCH easier in their attempt to compromise your site.

Just my opinion, I realize there are simple ways for even non-educated hackers to get anywhere on the server if it is not setup correctly.

Let me repeat that in order to see that page you need to ALREADY BE A SUPER USER. In other words, you must already be GOD. If you are God there are MUCH better things to do with your infinite power than look at a directory listing that does NOT list files and does NOT allow you to read files.

Hint: I have made a Joomla! component installation which can be "installed" through Extensions, Manager. It will install a C99 script in a predictable but non-obvious URL and immediately remove all traces that this package was ever installed. I did that as a proof of concept, proving that if you give Super User access to someone untrusted they CAN hack your site in a way that you will be none the wiser for a very, VERY long time.

So my question, is it intentional that the "Post-processing engine"-"upload to remote processing"- "initial directory" shows the "Output Directory" on the Joomla server and does not browse the FTP server directory any longer? It seemed like a bug

As I explained it's neither intentional nor a bug. Pressing ENTER anywhere in the form (NOT necessarily in the FTP fields) always triggers the first click handler on the form. It happens to be the Directory Browser for the Output Directory field.

I have tried to work around it but it breaks other things. However, that's simply mildly annoying. I would recommend not pressing ENTER on web forms you do not intend to submit anyway.

Or did I just miss the whole point of the browse button not being there any longer and you didn't want people to be able to browse the remote FTP server anylonger?

Yep, you did :) The FTP browser didn't work with all FTP servers. Over the years we found out that each server implementation returns a completely different format for the directory listing. Trying to support all of them was nigh impossible with our limited resources so the only reasonable course of action was to remove that feature altogether.

Thank you very much for the feedback! I missed the documentation which needs changing. Have a nice weekend :)