Support

Admin Tools

#9772 admin tools permission issues keep arising

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Friday, 04 March 2011 04:36 CST

njonow
Hi,

I'm sure admin tools professional is a great product, but for me, it continues to cause headache and grievances.

From the day i installed it to today, I continue to have extensions that i install function poorly. And yes, I have read the documentation. My folders are 775 and i even upped the default file to 664 rather than 644.

Even so, every bloody extension i upload has either functionality that is not working, or images that are not loading, or stylesheets or other files that can't be accessed.

I can't be going into these folders and guess what permissions each extension need. My initial reaction is to call it a day and uninstall this thing. But since its rated so high, it must provide some utility for everyone who likes it so much.

So....what am i doing wrong? I can't imagine its intended to work this way.

Cheers

nicholas
Akeeba Staff
Manager
There are two things which may be causing this.

Permissions all by themselves mean pretty much nothing. The combination of ownership and permissions does mean everything. That said, 755/644 permissions are adequate for the web server to serve the files. If you had any permissions issues, that would manifest itself as an inability to install extensions. The solution would be rather simple: enable Joomla!'s FTP Options in the Global Configuration. After installing an extension, run the Fix Permissions again, especially if you have a Plesk-based server. On Plesk-based servers, the default permissions for uploaded files and directories are 0600 which, of course, do not allow the web server to serve the files to the visitors of your site. In all fairness, this is the exact reason why that feature went into Admin Tools in the first place!

The other thing you have to bear in mind is that the default .htaccess Maker settings are purposely set too tight. One of the things you might want to disable is the "Anti-leech protection for static resources outside images/stories" as it may interfere with some extensions (especially if your site can be accessed as www.yoursite.com and yoursite.com - with and without the www).

The other option which may interfere with extensions is the "Front-end protection". The rationale behind this setting is that, since you are using Joomla!, no rogue PHP file should ever (EVER!) be accessed, except Joomla!'s index.php. Why? Because even if a hacker would upload a malicious PHP script due to a component's unpatched vulnerability he'd have no way to access it. In an ideal world where all developers would be security conscious or, at the very least, competent that would indeed be the case. In the Joomla! world where the narrow profit margin forces the use of cheap and inexperienced developers, this is not the case. I've seen many extensions (free and commercial) use their own rogue PHP files, scattered throughout the Joomla! folders. Even worse, I've seen developers serve raw XML files over the web browser (that's a big security no-no). In order to let such extensions work, you have to follow the documentation's instructions for identifying and applying extensions. Either that, or turn off the Front-end Protection, but that is like flying USS Enterprise through a meteor field with shields down: you'll be sitting on a timebomb.

As I've written in the disclaimer (in a much more blunt form), security is not easy and it takes more than a component to achieve. "Fire and forget" security extensions are the fabrication of a vivid imagination of some marketing guy. That's why we never claimed that Admin Tools "is the only protection you need" like some other guys. In the real world where we live in, web application security is a process which you have to continuously adjust and practice. More so whenever you modify something substantial in the application, like installing or upgrading a Joomla! extension or Joomla!'s core itself.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

njonow
Hi Nicholas,

Thanks for your (always) very quick and thoughtful response. To give some more detail:

1. I'm running a VPS account with Linux and Cpanel.
2. Installing extensions have never been a problem. But they won't run properly once installed.

So once i installed Admin tools I noted that consistently the extensions I added were not behaving properly. At first I thought it was bad coding on the developer part, but soon realized it was not the case. To be specific...

I installed Core Design's CDcaptha. It didn't work, but threw an error that the javascript file was blocked. Thanks to CD's support I learned that the file permissions were inadequate. So i changed it. Problem solved.

2. Now i installed eXtplorer, and the small images that show the site tree don't load. Same issue.

3. And lastly, JA Highslide won't load either.

So I consistently need to go into the modules or plugins folder and up the permissions for these extensions to work. This can be a pain if you don't know where in Joomla the files reside, and which files need what permission (tempting to put 775 on all files rather than testing each one, but of course that defeats the purpose of Admin tools).

So this is my issue in a notshell. Every extension i upload so far has been unable to properly execute. Once i go in and modify the permissions it works. But it adds an onerous step to each installation, and negates much of the value that Admin Tools would otherwise provide.

nicholas
Akeeba Staff
Manager
To cut a long story short, here's what you have to do:

1. Go to Joomla!'s Configuration page and enable the FTP options. Make sure you supply the FTP username and password, as well as define the correct FTP path to your site's root.
2. After installing ANY extension, click on Admin Tools' Fix Permissions button.

The problem you are experiencing has NOTHING to do with Admin Tools. It's the way your server is set up. Admin Tools can help you work around the limitations of your server setup with its Fix Permissions feature.

Don't want to believe me? Try something for yourself. Uninstall Admin Tools completely. Uninstall eXtplorer too. Then reinstall eXtplorer. You'll see that the icons, once more, do not display due to wrong permissions. Since Admin Tools doesn't run, which piece of your site software stack do you think is responsible? The web server. QED.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!