Problem securing files (Vendor, Storage, Composer)

whisperwow

I too have installed my Flarum forum into > mydomain.com/forum. I changed Flarum's "public" folder to /forum and everything seems to be working fine but when I test the forum on https://lab.migratetoflarum.com/ I get the following error:

I have already modified my .htaccess files in the root and the /forum folders to include the following but I'm still getting the Vendor, Storage and Composer security errors when running the migratetoflarum tool.

RewriteRule /\.git / [F,L] RewriteRule ^auth\.json$ / [F,L] RewriteRule ^composer\.(lock|json)$ / [F,L] RewriteRule ^config.php$ / [F,L] RewriteRule ^flarum$ / [F,L] RewriteRule ^storage/(.*)?$ / [F,L] RewriteRule ^vendor/(.*)?$ / [F,L]

Here is my Flarum info from the dashboard:

Flarum 1.8.1
PHP 8.2.6
MySQL 5.7.23-23S|
Scheduler: Never run
Queue Driver: sync
Session Driver: file

Any thoughts?

luceos

whisperwow

RewriteRule /\.git / [F,L]
RewriteRule ^forum/auth\.json$ / [F,L]
RewriteRule ^forum/composer\.(lock|json)$ / [F,L]
RewriteRule ^forum/config.php$ / [F,L]
RewriteRule ^forum/flarum$ / [F,L]
RewriteRule ^forum/storage/(.*)?$ / [F,L]
RewriteRule ^forum/vendor/(.*)?$ / [F,L]

Try these in your root.

whisperwow

luceos Just tried it but am still getting the same errors in the migratetoflarum tool.

To be clear, my forum is in the mydomain.com/forum subdirectory.

I am using Hostgator shared hosting and my domain is an add-on domain so there is no public_html folder within the addon domain's structure within cPanel's File Manager.

The forum is working fine, but I still keep getting the security errors within the migratetoflarum tool.

jslirola

whisperwow I am using the same hosting and my website has directory structure as your, let me explain what you are missing since I had the same problem a few months ago.

Go to your cPanel and Addon Domains, you will see your Document Root is pointing to /.

The second one is the domain I have for Flarum, so I refactored the website to store the files in the right place. In the following screenshot you can see my File Structure:

domain.com
- flarum (Flarum files as vendor/, storage/, etc...)
- public/ (Main website)
  - foro/ (Forum)

So basically you should update the document root to avoid exposing sensitive data and after that you'll get the expected report in https://lab.migratetoflarum.com

Let me know if you have any other question 🙂

luceos

jslirola if you can cange the document root, why not point it to the Flarum subfolder public? That is how all this is intended and for cpanel to support it means you should use it...

jslirola

luceos well, it depends on your environment. In my case I have my website and the forum is not in the root.

If another user wants to show the forum once they open the domain, then that's the best way.

I'm not sure if I answered your question or misunderstood.

whisperwow

jslirola I think I understand what you did and will give it a try. However, after doing this, does composer accurately know where all of your files are to make the appropriate updates to the files once I've done these changes or do I need to change the configuration in other places as well like (site.php, index.php, config.php, etc.)?

Thanks.

luceos

whisperwow does composer accurately know where all of your files are to make the appropriate updates to the files once I've done these changes or do I need to change the configuration in other places as well like (site.php, index.php, config.php, etc.)?

Composer only works with the composer.json, composer.lock files and the vendor folder. It does not care about the rest.

jslirola

whisperwow yep, as luceos said, composer just wants to stay together with the composer.json file.

Let me add more details about the setup. Considering the following file structure:

- domain.com
    - flarum
        - storage
        - vendor
        - workbench
        - ...
        - site.php (1)
   - public
        - forum
             - index.php (2)
        - ...
        - index.php (Load your main page)

We need to update two paths:

Relate flarum files with your forum site.php

return Flarum\Foundation\Site::fromPaths([
    'base' => __DIR__,
    'public' => __DIR__.'/../public/forum',
    'storage' => __DIR__.'/storage',
]);

The opposite: index.php withinforum/

$site = require '../../flarum/site.php';

I hope that now the whole process is clear.

whisperwow

luceos Thank you for the clarification.