8

This is my first time ever in PHP and my first time ever with Joomla. I come from a heavy non-Web C# / .Net background.

I have written a custom Joomla module that interacts with a third party WebService via nuSoap.

This all works great if I just run the .php files in my own non-Joomla PHP environment in my dev machine.

However, I if understand correctly, Joomla blocks all requests to everything except index.php, is this correct?

How do I allow direct access to my own .php file?

this is an example of how I'm requesting it from client-side javascript using jQuery:

$.ajax({
     url: 'MyFile.php',
     type: 'POST',
     data: { ... },
     success: function(data, status) {
          ....

where MyFile.php is currently located physically at /htdocs/modules/mod_mymodule/MyFile.php

I know that allowing direct requests to this file might present a security risk, however I need to get this running ASAP and I'll take care of security concerns at a later moment.

  • Try changing your code to url: '/modules/mod_mymodule/MyFile.php', – TryHarder Oct 19 '14 at 3:23
5

Typically the only thing preventing direct access to a joomla file is a line at the top of the file:

defined('_JEXEC') or die('Restricted access');

If that is not already at the top of the file, then you should have no trouble just accessing the file directly.

The htaccess file redirect already has conditions to not redirect if the file or folder exists:

# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d

If it didn't, you wouldn't be able to load any javascript or css files!

So really all you actually need to do is remove that line from the top of the file and you should be able to access the file directly.

The biggest thing to note is that none of the Joomla classes will be loaded, so you have to run this file as a stand-alone file (which you are already doing.)

As far as I'm aware, there should be no inherent security risk in accessing a php file directly, as long as that is the intended behavior. Since the majority of files in Joomla assume that they will not be accessed directly, it is best to block that direct access. In your case, you intend that code to be directly accessed, so no inherent risk. You might have other security risks by accepting POST data and not properly filtering it or such (which is easier if you let Joomla do it for you), but that is unrelated to whether the file is directly accessed or not.

  • Thanks for your answer. I'm afraid my solution won't work in that case, since I will need to integrate Joomla's user features and load other Joomla specific data. I've been reading about com_ajax but since I'm totally new to Joomla (and PHP altogether) I wanted a quick way out that didn't require to implement extra stuff. Now that you mention that none of the Joomla classes will be loaded I realize that's not a proper solution for my problem. Unless there's a way to manually "load" the Joomla framework on demand from my own standalone .php file? – Federico Berasategui Oct 19 '14 at 16:38
  • 4
  • Great! thanks! will this enable me to, for example, retrieve current logged in user profile? – Federico Berasategui Oct 19 '14 at 16:41
  • 2
    Any Joomla call should work. So $user = JFactory::getUser() should work to get you the current user's information. – David Fritsch Oct 19 '14 at 16:50
4

An alternate solution ,

If you are developed the module in proper Joomla structure then instead of including Core Joomla framework to module file you can use com_ajax for making ajax call to module or plugin.

If you're working with Web services and plan to use it in many sites so simple creates a Joomla module/Plugin and that can be acceed via ajax and installation of this module/plugin is quite simple like any other joomla extensions.

A detailed documentation can be found here, Also if you are using older version of Joomla there is a component available to achieve the Ajax interface..

This Ajax feature is inbuilt with J3.2 version and above so below version should use this components.

Hope it make sense!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.