Admin Tools - Akeeba Ltd (2023)

[emailprotected]

Hello,

We are working to remediate some security vulnerabilities and have been implementing Admin Tools. I have run into an issue where after installing Admin Tools, it is blocking access to the EDocman files. See attached screenshot. Prior to the installation of Admin Tools, EDocman is configured to use a PDF viewer and display the contents of the PDF.

As a workaround I have used the default Joomla .htacces file as it seems if I use Admin Tools .htaccess file maker this causes the permissions issue.

Currently EDocman stores the files locally on the web server in this location:

[ROOTPARENT]/edocman

Is there a specific configuration setting or .htaccess parameter that is required to allow EDocman access to this file path or run the PDF viewer?

Thanks in advance for any tips you can provide.

Eric

Attachments

Akeeba Staff

Manager

The correct approach is tofollow the “How to determine which exceptions are required” troubleshooting documentation page.

If you get lost somewhere, we can do this together. In this case, I will need you to reproduce the problem. On that page with the problem, open your browser's developer tools (on Windows and Linux hit the F12 key). Go to the Network tab and reload the page. You will see a number of resources on your site which are red and when you click on them it tells you that the HTTP status was 403. Tell me their URLs so I can help you create the necessary exceptions.

I believe that you will need to add a few folders into the “Allow direct access, except .php files, to these directories” option in the .htaccess Maker. I believe that you need to add exceptions for both the file where the PDF files are stored, and the folder where the embeddable PDF reader's JavaScript files are stored in (assuming they are not under the media folder).

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native🇬🇧English: excellent🇫🇷French: basic •🕐My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[emailprotected]

Nicholas,

This is great information and I can get started on trying to fix the permissions. Hopefully with your tips I can find the files/folders that I need exceptions.

I really appreciate the support, patience and guidance as we work through these things.

Thank you,

Eric

Akeeba Staff

Manager

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native🇬🇧English: excellent🇫🇷French: basic •🕐My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[emailprotected]

Hello,

I tried to follow you instructions but was unsuccessful. On my test page I have attached the screenshots below.

Here is the full path to the file with the 403 error as shown in the browser debug tool:

https://was1.shorecrest.org/plugins/edocman/viewpdf/ospdfjs/web/viewer.php?file=https://was1.shorecrest.org/edocmanviewer/State_of_the_School_2023.02.07.pdf

I tried both "including .php" and "excluding .php" exceptions for the viewer as it appeared to be a .php file.

I appreciate any assistance you can provide.

Thanks,

Eric

Attachments

Akeeba Staff

Manager

If only this .php file is needed add

plugins/edocman/viewpdf/ospdfjs/web/viewer.php

to the “Allow direct access to these files” option.

However, I suspect that there are more files this reader pulls up. So, if that fails, do add

plugins/edocman/viewpdf/ospdfjs/web

to the “Allow direct access, including .php files, to these directories” option.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native🇬🇧English: excellent🇫🇷French: basic •🕐My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[emailprotected]

Hello,

I have tried as you have suggested. I have attached the updated exceptions list screenshot. Unfortunately, this is still not resolving the issue.

I contacted the EDocman developer and received this response:

"Please change permission of files in folder: "root -> plugins -> edocman -> viewpdf -> ospdfjs -> web" and "root -> edocmanviewer" to 777
Then, please check the PDF viewer tool again"

After following the instructions, I was still getting the 403 error. I have explained that this error is only present when a security enhanced .htaccess file is employed and asked for more information on additional helper files that may also need exceptions. I am waiting to hear back.

Do you have other tips on determining what additional files may used by the viewer? Reading through the viewer.php file I do see a few .js files called, but they are in the same directory as viewer.php, which was added as an exception. Do I need to add these .js files individually?

Thanks in advance for any additional suggestions or questions that I can ask the EDocman developer.

Eric

Attachments

Akeeba Staff

Manager

"Please change permission of files in folder: "root -> plugins -> edocman -> viewpdf -> ospdfjs -> web" and "root -> edocmanviewer" to 777

Jesus wept! No, do NOT change the permissions to 0777. For the reasons see the old, but always relevant, article I wrote back in 2010:https://www.dionysopoulos.me/777-the-number-of-the-beast.html.

Using 0777 permissions to address a read permissions issue is never, ever the right solution. If it was a permissions issue the far more sane, and infinitely more secure, 0644 would still do the trick. Having someone recommend 0777 permissions tells me that this someone understands neither how UNIX permissions work, nor the absolute basics of web site security. I am immediately skeptical about this extension given that its developer has failed at Security 101 in his reply to you…

Do you have other tips on determining what additional files may used by the viewer? Reading through the viewer.php file I do see a few .js files called, but they are in the same directory as viewer.php, which was added as an exception. Do I need to add these .js files individually?

No, you do not need to whitelist specific files. As long as you have their containing folder (or any of its parent folders) to the folders where any file access except .php is allowed then they are allowed to be loaded.

Do you see anything else that throws a 403 or 404 in the Network tab of your browser tools when you try loading the PDF viewer?

Moreover, do you see any other messages in the Console tab which indicate that the browser's security settings, or a Content-Security-Policy header, may be blocking the execution of some JavaScript?

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native🇬🇧English: excellent🇫🇷French: basic •🕐My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[emailprotected]

Nicholas,

I agree that the casual response to change the file permissions to 777 violates many "best practices". I am hopeful that the developer can provide more info on the behavior of their plugin and perhaps make changes once we understand what is causing the block.

In the meantime:

Reviewing the page again there are only (2) 403/404 errors:

I have attached screenshots of the console and network output.

As you hinted at, it does seem that the content-security-policy headers look like something that might cause issues.

is there a way to allow these in Admin Tools?

Thanks,

Eric

Attachments