How do I allow direct access to my custom .php file in a Joomla Module to be consumed from AJAX?

Question

This is my first time ever in PHP and my first time ever with Joomla. I come from a heavy non-Web C# / .Net background.

I have written a custom Joomla module that interacts with a third party WebService via nuSoap.

This all works great if I just run the .php files in my own non-Joomla PHP environment in my dev machine.

However, I if understand correctly, Joomla blocks all requests to everything except index.php, is this correct?

How do I allow direct access to my own .php file?

this is an example of how I'm requesting it from client-side javascript using jQuery:

$.ajax({
     url: 'MyFile.php',
     type: 'POST',
     data: { ... },
     success: function(data, status) {
          ....

where MyFile.php is currently located physically at /htdocs/modules/mod_mymodule/MyFile.php

I know that allowing direct requests to this file might present a security risk, however I need to get this running ASAP and I'll take care of security concerns at a later moment.

Answer 1

Typically the only thing preventing direct access to a joomla file is a line at the top of the file:

defined('_JEXEC') or die('Restricted access');

If that is not already at the top of the file, then you should have no trouble just accessing the file directly.

The htaccess file redirect already has conditions to not redirect if the file or folder exists:

# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d

If it didn't, you wouldn't be able to load any javascript or css files!

So really all you actually need to do is remove that line from the top of the file and you should be able to access the file directly.

The biggest thing to note is that none of the Joomla classes will be loaded, so you have to run this file as a stand-alone file (which you are already doing.)

As far as I'm aware, there should be no inherent security risk in accessing a php file directly, as long as that is the intended behavior. Since the majority of files in Joomla assume that they will not be accessed directly, it is best to block that direct access. In your case, you intend that code to be directly accessed, so no inherent risk. You might have other security risks by accepting POST data and not properly filtering it or such (which is easier if you let Joomla do it for you), but that is unrelated to whether the file is directly accessed or not.

Answer 2

An alternate solution ,

If you are developed the module in proper Joomla structure then instead of including Core Joomla framework to module file you can use com_ajax for making ajax call to module or plugin.

If you're working with Web services and plan to use it in many sites so simple creates a Joomla module/Plugin and that can be acceed via ajax and installation of this module/plugin is quite simple like any other joomla extensions.

A detailed documentation can be found here, Also if you are using older version of Joomla there is a component available to achieve the Ajax interface..

This Ajax feature is inbuilt with J3.2 version and above so below version should use this components.

Hope it make sense!