|
|
| (39 intermediate revisions by 10 users not shown) |
| Line 1: |
Line 1: |
| − | {| cellspacing="0" cellpadding="0" style="margin:0em 0em 1em 0em; width:100%"
| + | {{archived|68318|Where can you learn more about file permissions?|Security Checklist|reason=As the page notice indicated, the security information on this page is generally accepted by the security moderators as no longer relevant and provides no additional or very minimal additional security to a website.|cat=Security,FAQ,Tutorials}} |
| − | | colspan="1" style="width:100%; vertical-align:top; text-align: center; border:1px solid red; background-color:#FFF8DC;" |
| |
| − | <div style="border-bottom:1px solid #red; background-color:#F5DEB3; padding:0.2em 0.5em 0.2em 0.5em; font-size:130%; font-weight:bold;">Note</div>
| |
| − | <div style="text-align: center; padding:1em 5em 1em 1em;"> <!--Note: Top, right, bottom, left -->
| |
| − | Please note that the {{{1|content}}} on this page is currently incomplete. Please treat it as a work in progress.
| |
| − | </div>
| |
| − | |}
| |
| − | {{underconstruction|notready=message text|placedby=mandville}}
| |
| − | | |
| − | | |
| − | | |
| − | == Moving sensitive files outside the public_html ==
| |
| − | | |
| − | One challenge in Joomla! is ensuring that certain PHP files in ''public_html'' (or otherwise known as ''httpdocs'' or'' www'' depending on your server setup) containing executable code or confidential data are protected from direct Internet access.
| |
| − | | |
| − | There are various ways to protect such files, but most are not optimal. Many users and developer groups, such as [http://gallery.menalto.com/ Gallery2] and [http://www.apache.org/ Apache.org] strongly recommend against keeping vulnerable files and confidential data inside public_html.
| |
| − | | |
| − | The following method seems to be the simplest and most elegant way to protect read-only files that, for whatever reason, must be stored in public_html. In this example, we protect configuration.php, perhaps the most confidential file of any Joomla! site.
| |
| − | Using this method, even if the Web server somehow delivers the contents of PHP files, for example due to a misconfiguration, nobody can see the contents of the real configuration file.
| |
| − | | |
| − | == Directions ==
| |
| − | | |
| − | | |
| − | 1.Create a directory in your domain outside of your public_html directory. You can name it anything you want. We used the name '''design2-files''' for the directory name in this example.
| |
| − | Note: If you have multiple Joomla installs then each Joomla install you have should have it's own directory outside of public_html to contain it's configuration.php file.
| |
| − | | |
| − | 2. Move configuration.php to the '''design2-files''' directory and ''rename it'' whatever you want. We used the name '''joomla.conf''' for the configuration file in this example.
| |
| − | | |
| − | 3. If your Joomla site is installed in the root of the public_html directory and not in a subdirectory under public_html, then create a new configuration.php file for your joomla install in the public_html directory containing only the following code:
| |
| − | <source lang="php">
| |
| − | <?php
| |
| − | require( dirname( __FILE__ ) . '/../design2-files/joomla.conf' );
| |
| − | ?>
| |
| − | </source>
| |
| − | If Joomla has been installed in a subdirectory under public_html ( public_html/subdirectory/ )
| |
| − | then create a configuration.php file containing only the following code.
| |
| − | <source lang="php">
| |
| − | <?php
| |
| − | require( dirname( __FILE__ ) . '/../../design2-files/joomla.conf' );
| |
| − | ?>
| |
| − | </source>
| |
| − | | |
| − | '''Important!'''
| |
| − | Do not include blank lines or any characters (including blank spaces) before the php start tag or after the php end tag. If you make this mistake, you very likely will see the following error.
| |
| − | <pre>
| |
| − | Warning: Cannot modify header information - headers already sent by (output started at
| |
| − | /home/xxxxx/public_html/configuration.php:2) in /home/xxxxx/public_html/index.php on line 250
| |
| − | </pre>
| |
| − | | |
| − | 4. Make sure the new configuration.php file is set to permissions of 644.
| |
| − | | |
| − | '''Warning!!'''
| |
| − | | |
| − | If you need to change configuration settings, do so manually by downloading the relocated joomla.conf file, making the needed edits and uploading it back.
| |
| − | | |
| − | Do not use the Joomla web administrator interface global configuration button to edit the global configuration.
| |
| − | *<font color="#ff0000">'''WARNING:''' Do not attempt this procedure unless after reading several times you understand it. This is not for beginners, ensure you have a back up of your site before attempting
| |
| − | </font>
| |
| − | | |
| − | == Editing and saving/applying ==
| |
| − |
| |
| − | Making edits to the global configuration in the Joomla web administration interface will overwrite the 3 line configuration.php file pointing to the real configuration file with the real configuration.php file contents upon saving or applying the edits. This will undo your efforts to move and protect the configuration.php file by placing it in a directory outside of public_html.
| |
