Using Extension Manager to Install Packages from a Password Protected Directory

Question

This question is for J3.3+

I'd like to set up my extensions in a password protected directory on one web site.

This will act as repository for customized extensions to be used by several other Joomla! sites.

I'd like to use the 'Install from URL' in the Extension Manager of my other Joomla! web sites to install those packages.

Using a password protected directory breaks this feature and throws an error.

I am considering 2 solutions

1) A 'hack' on the Extension Manager to submit the username/password

2) Restricting access to only specific domains (those could include Joomla! sites on subdomains or external domains)

A combination of both would be ideal as urls are easy to spoof, so the first level of protection would the .htaccess password protected directory, and the second level would be to only allow access from specific URLs.

I am using HostGator on a reseller account.

Answer 1

While I'm not sure this is a good idea.

You could use IP restrictions, allowing access only from the IP address of the website you want to have access. This does present an issue if other websites are on the same IP address.

e.g.

# ALLOW BY IP
<Limit GET POST> 
 order deny,allow
 deny from all
 allow from 111.111.111.111
 allow from 222.222.222.222
 allow from 333.333.333.333
</Limit>

The Limit directive affects the directory it's placed in and sub-directories. You would probably be better off using if you can figure out the exact HTTP that's being used.

Answer 2

You can read carefully through this PR in Github: https://github.com/joomla/joomla-cms/pull/2508 And also to: https://github.com/joomla/joomla-cms/pull/2769

It has been implemented since Joomla! 3.2.2, it basically allows to setup additional parameters in the download URL. It is for updates and not for initial installation, but I think it can work out for you.

So your password protected directory could make a check against params in the URL requested (either 1, 2 or even 3 params).

So you will have: http://example.com/passwordprotecteddirectory/file.zip - requesting this will result in 401 http://example.com/passwordprotecteddirectory/file.zip?user=admin&pass=123456&secretkey=4901 - your server should make the check if these params are allowed to download and return the file if so or again return 401, in case there is no permission.