2

I've searched around and can't find an explanation. According to some documentation, it seems to be something for the admin to execute from the shell.

4

CLI applications included in Joomla perform checks to ensure they're being executed from command line. They do not run when accessed directly by URL (using browser, cURL or anything else).

1
3

The /cli directory holds command line routines that can be executed either manually via terminal or via host managed tools like cron(scheduler) and can be called directly from the php directory or by a service like cURL which is why it needs to visible to the public with a permission of 755.

Using the .htaccess directives, the list of files in the /cli directory not should be able to be listed nor should it be searched by crawlers, hence if you go to www.mysite.com/cli then you should receive a blank page, not a listing of files.

2

Yes, the /cli/ scripts can only be run from the command line on the server.

Note that the PHP run on the CLI might use another PHP version + settings, set in /etc/php/[your php version]/cli/php.ini

The Joomla site itself might use another PHP version. On an Apache web server that configuration might be loaded from: /etc/php/[your php version]/apache2/php.ini

2

For Joomla 3 - There is nothing to worry about; the CliApplication class constructor checks to see if the command is being called from the command line

// Close the application if we are not executed from the command line.
if (!defined('STDOUT') || !defined('STDIN') || !isset($_SERVER['argv']))
{
    $this->close();
}

For Joomla 4 - you are rightly concerned, and I'm about to make a PR for a security fix for this: https://github.com/joomla/joomla-cms/pull/33946

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.