2

I want to use hatemile-for-php library (https://github.com/hatemile/hatemile-for-php) in my plugin.

As I am only ever using this library within this one plugin, I included it in the plugin folder instead of the libraries folder.

Now I wonder, if I had to add the line

defined('_JEXEC') or die;

to the begin of each PHP file of this external library.

I had a look into the Joomla libraries folder (for example /libraries/phpass/PasswordHash.php) and into some popular Joomla extensions. I realized that there are the third party PHP files included without the line

defined('_JEXEC') or die;

on the top of the file.

Is it the correct way to use an external library with Joomla!?

2

It’s a good question and a bad question at the same time. Why? Good, because the question sounds ‘exotic’ for many many Joomla users/superusers. Why this small line of code is there everywhere like the coca-cola of Joomla. :) 'Nobody' understands why it works that much.

defined('_JEXEC') or die('gooo to hell!');

The question is bad because in the Joomla documentation it is quite clearly explained what this line is, why it is there and when to use it and when not to. So the regular, knowledgeful users of Joomla stackexchange do not like to answer these kind of questions, since it takes a click to the official Joomla doc and someone just has to read it within 2 minutes. Why to copy it here? But, let’s just put the info here, really just for fun:

_JEXEC is a constant that is typically defined in the index.php file at the root of the Joomla! instance and is used to mark a secure entry point into Joomla. The defined or die check makes sure that _JEXEC has been defined in the pathway to get to the file

The general rule for the JEXEC check is if the PHP file depends on another file to operate properly. Typically if you access a file directly without the JEXEC check and a PHP error is raised (presuming your PHP error reporting is set to show errors by default) about a missing variable, function, object or similar then the file needs to be protected.

Some files don't need to be protected from this check. They might be files with no external dependencies (e.g. a simple class or bit of code) or they might be external files that can operate without being within Joomla!. Examples of this include TinyMCE's GZip'd Javascript generator which is entirely self contained.

It’s quite clear explanation (copied from the doc) Based on the above:

I would not put jexec on the top of those files mentioned in the question.

;)

Link to the doc: https://docs.joomla.org/JEXEC

It's not only an exotic question, but a good horror subject apparently with all kinds of nasty ghosts in it, anytime, anywhere. But what if this and what if that... Good question. :) So if a person is more like a paranoid type, then in any case it's better to include _jexec check on top of all files even without investigating the files and functions and understanding anything. That's for sure. (I’ll ask OSM to officially add these last missing sentences to their docs). ;

This was not part of the question but important:

If your extension is made for public and going to be distributed and used on many Joomla websites then it’s a must for using _jexec defined check on the top of all PHP files. It’s the ‘Better to be paranoid’ law.

  • 1
    I think the doc linked is incomplete. That is not the only reason to force the use of a secure entry point. Bypassing the secure entry point also allows you to bypass all Joomla security. This can be a major issue if the used library has, for example, code for uploading files to the server and a vulnerability that allows remote access to that code. I had a site hacked because (at the time) Joomla extension update did not remove obsolete files and an old version of the extension had a library with such a bug. So should probably also check if the code can do file or DB access IMHO. – Ville Niemi Jan 31 at 10:23
  • @VilleNiemi - you are right (partially). The external file package has to be checked what kind of functions there are in the files, but the original question does not mention anything about this that the files would have db connection functions in it. Obviously it has to be covered with ‘_JEXEC’. This for me can be also understood clearly from the doc. DB connection for any purpose would mean dependency on Joomla db for this external library. – Zollie Jan 31 at 10:46
  • Many thanks for your response. Now I know that it depends on the contents of the file. Just to explain: I had seen the documentation. Maybe I should have mentioned that in the question. The documentation was not clear to me. The headline says 'This article is tagged because it NEEDS REVIEW.'. And then I had my extension tested by Jedchecker (extensions.joomla.org/extension/jedchecker). Jedchecker says that the line 'defined('_JEXEC') or die;' should be on the beginning off all PHP files within Joomla!. – astridx Feb 1 at 9:39
  • @astridx - yes, few quite important details were left out of your question. :) Of course not many people have time to review and check your files instead of you. The documentation of Joomla is made also by volunteers mostly and it won’t never be exhaustive, not to mention always uptodate. If you make an extension which will be distributed on many websites your responsibility gets higher than a folk who is just creating an extension for your own purpose. So in your case, no question about using jexec on the top of the files. – Zollie Feb 1 at 9:53
  • @astridx - I added that notice to my answer, just for the future researchers on this question. ;) – Zollie Feb 1 at 10:12
1

There is a good video from Joomla World Conference 2016 on a presentation of Namespaces by Jisse Reitsma that around the 23 minute mark goes into an example that eventually describes a situation where you would not use Jexec in your code so that it can be shared with other platforms like Wordpress/Magento, https://www.youtube.com/watch?v=Dyx05GR4Bms With a few more of the popular Joomla extension coming out with Wordpress flavours and some of newer features coming with Joomla 4, I think there might be a relaxing of the expectation that Jexec will be in every file. So to get back @astridx's question, I would not add Jexec to the external library because it is not Joomla code.

  • Good additional info, thanks for your contribution to the subject! – Zollie Feb 6 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.