Support

Admin Tools

#42394 Tuning HTACCESS for component Dropfiles

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
5.4.0
PHP version
8.3.26
Admin Tools version
7.8.3

Latest post by BigStef on Tuesday, 28 October 2025 07:43 CDT

Tuesday, 28 October 2025 07:02 CDT

BigStef

Hi Akeeba team !

I've met an issue when using .htaccess maker on this website: I can't download anymore mys files from component DROPFILE (from Joomunited).

So I get back to the HTACCESS default from Joomle and sent to Joomunited the AT HTACCESS to get their advice.

Here's their answer : 

Based on your provided .htaccess, the most likely cause of the 404 error when opening download file URL is this section near the bottom:

Front-end protection
## Allow limited access for certain directories with client-accessible content
RewriteRule ^(components|modules|templates|images|plugins|media|libraries|files)/.*.(7z|CSS|EOT|GIF|JPEG|JPG|JS|PNG|TTF|WEBP|WOFF|WOFF2|avi|bmp|bpe|css|doc|docx|eot|flv|gif|htm|html|ico|jp2|jpe|jpe2|jpeg|jpg|js|json|mov|mp3|mp4|mpeg|mpg|odp|ods|odt|ogg|ogv|pdf|png|ppt|pptx|rar|svg|swf|ttf|txt|wav|webp|woff|woff2|xls|xlsx|xps|xsl|zip)$ - [L,NC]
RewriteRule ^(components|modules|templates|images|plugins|media|libraries|files)/ - [F]

If I disable the "Frontend protection" on the HTACCESS maker, it's right : I can then download the files...

So i tried to tuned that part of the Maker :

I added the directory "media/com_dropfiles" - But it is still not workibg : Downloading files stopped again.

Today I just disable that part and everythings work well.

But i wanted to know if you possibly know a trick to put this part of HTACCESS back into action?

Thanks in advance.

Stephan Herby PAO Production New Caledonia - Canada - France

Tuesday, 28 October 2025 07:33 CDT

nicholas

If you need to disable the frotnend protection to download files they are doing something wrong. Most likely they have an arbitrary PHP script, i.e. they are not going through Joomla.

Sure, you can find out which one it is and add an exception to it as explained in https://www.akeeba.com/documentation/admin-tools-joomla/server-protection.html#determine-required-exceptions. However, you should be VERY wary of the fact that this means that you have a script which is not part of Joomla (therefore not protected by Admin Tools). Any security issue on that script can mean that your site is compromised.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 28 October 2025 07:39 CDT

nicholas

I forgot to also explain what is obvious to me. No developer who knows what they are doing and understands the basics of Joomla needs to circumvent Joomla to create a download manager component. Even plugins, modules, and templates can implement a download feature – using Joomla's com_ajax and format=raw. There's a reason why Joomla has format=raw.

As for why this is obvious to me. It's because we are using Joomla the right way to implement downloads on our site for our software downloads and the ticket system attachments for the past 15 years. It wasn't even anything novel back then. There are dozens of extensions which use format=raw to deliver raw binary data be it downloads, images, JSON documents, or whatnot. It's just a fundamental core Joomla feature.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 28 October 2025 07:43 CDT

BigStef

Hi Nicholas,

Thank you very much for your feedback.

I will keep in touch with Joomunited with that issue.

And maybe come back here if they solve that issue (or maybe I will simply change the component for another one with a better Joomla implement.

That ticket can be closed.

Stephan Herby PAO Production New Caledonia - Canada - France

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!