CLI directory is publicly accessible. Is it supposed to be? Is that safe?

Question

I've searched around and can't find an explanation. According to some documentation, it seems to be something for the admin to execute from the shell.

Answer 1

CLI applications included in Joomla perform checks to ensure they're being executed from command line. They do not run when accessed directly by URL (using browser, cURL or anything else).

Answer 2

The /cli directory holds command line routines that can be executed either manually via terminal or via host managed tools like cron(scheduler) and can be called directly from the php directory or by a service like cURL which is why it needs to visible to the public with a permission of 755.

Using the .htaccess directives, the list of files in the /cli directory not should be able to be listed nor should it be searched by crawlers, hence if you go to www.mysite.com/cli then you should receive a blank page, not a listing of files.

Answer 3

Yes, the /cli/ scripts can only be run from the command line on the server.

Note that the PHP run on the CLI might use another PHP version + settings, set in /etc/php/[your php version]/cli/php.ini

The Joomla site itself might use another PHP version. On an Apache web server that configuration might be loaded from: /etc/php/[your php version]/apache2/php.ini

Answer 4

For Joomla 3 - There is nothing to worry about; the CliApplication class constructor checks to see if the command is being called from the command line

// Close the application if we are not executed from the command line.
if (!defined('STDOUT') || !defined('STDIN') || !isset($_SERVER['argv']))
{
    $this->close();
}

For Joomla 4 - you are rightly concerned, and I'm about to make a PR for a security fix for this: https://github.com/joomla/joomla-cms/pull/33946