Flarum encountered a boot error.

KBExit

boohoo we unfortunately cannot tell what's going on in your infrastructure, what happened on your end, or anything.
You said you installed Flarum and had an extension installed before all of this happened.
As I've mentioned, go to your Flarum root directory and run php flarum migrate and report back if that fixes the issue or not.

boohoo

I went to the folder where the flarum file was in using ssh. From within this folder, I typed "php flarum migrate." No text response, just a new line with the same prompt. Didn't fix anything.
Now I am going to config.php.

boohoo

I went to config.php, saw what the password was, and changed the username's password to that password. It worked, and I had the password for migration. Thanks everybody!

boohoo

Visit my babysite, brainchildforum.com. I'm trying to make it into an intellectual hotspot of original thought. I also need to convince people to go there. Oh me oh my. Desolate now.

Is there any crosspolination here? I'll post on your site if you post on mine?

KBExit

boohoo your Flarum is exposing the /public directory which is exposing vulnerable files. You need this remedied asap.

boohoo

I did chmod 755 public/. How do I know if that helped? I altered config.php to 'url' => 'https://brainchildforum.com' from 'url' => 'https://brainchildforum.com/public' and got the error message "The page you requested could not be found. Return to Brainchild Forum" so I changed it back, but I don't know why this site doesn't have a "public" extension in the url if it default adds it when installing flarum.

KBExit

I can't see your reply @boohoo

clarkwinkelmann

KBExit the message was awaiting moderation because of the links it contains.

boohoo there are 2 options to deal with the "public" path.

Either set the webroot to the public path in your Apache/nginx configuration, as instructed during the installation steps https://docs.flarum.org/install/#installing-using-the-command-line-interface It's best to do it before running the installation wizard, but if you do it now there's just the extra step of editing config.php to change the URL after Apache/nginx has been modified. That's what I call the "Laravel-style" installation.

Or if you want to remove the public folder completely to install "Wordpress-style", the instructions are here https://docs.flarum.org/install/#customizing-paths

KBExit

boohoo alternative to what @clarkwinkelmann mentioned, and I've done it in the past when I first started Flarum.

Change it back to without /public in your Flarum Configurations and point your ROOT Directory to /public.
This should be a simple remedy.

Did you install Flarum via Softaculous?

boohoo

KBExit

Yes. Also, looking at Customizing Paths in FLARUM docs, I have public_html, and this site is off of another site who has the hosting plan. My flarum website is off a cryptic folder of public_html that shows up as my fun url.

However, if you wish to host Flarum in a subdirectory (like yoursite.com/forum), or if your host doesn't give you control over your webroot (you're stuck with something like public_html or htdocs), you can set up Flarum without the public directory.

I guess I can't eliminate /public, or am I missing the point?

Simply move all the files inside the public directory (including .htaccess) into the directory you want to serve Flarum from. Then edit .htaccess and uncomment lines 9-15 in order to protect sensitive resources. For Nginx, uncomment lines 8-11 of .nginx.conf.

Does that make the website folder really messy - disorganized? Also, I would be saving over .htaccess but I will see if it is the same.

KBExit

boohoo that's your first problem right there. I have told the team over at Softaculous several times that their method of installing Flarum is dangerous. They said they would remedy it, but it's clear that they haven't done so at all.
I advise you to install Flarum via the documentation or find a managed host.
It's critical that you do not expose the /public directory at all and I am concerned if you keep using Softaculous, future updates will cause more issues down the line for you.

boohoo

KBExit

This is all above my experience. What do you mean expose the /public directory? I assigned the chmod for it, and I'm trying to remove /public from my url. It seems that it just installed flarum into a folder off my public_html (main url). Do you mean the folders and files are incorrect?

I think the boot problem was I saved over my mySQL password and changed it back, and I needed to update something else with my password. I don't get exactly what exposing /public files is. I also just assigned a ****load of FontAwesome icons to categories, and I don't want to go back unless necessary.

KBExit

boohoo

Insecure public folder

It appears you didn't complete the path customization to use Flarum without a public folder. This leaves all Flarum sensitive files unprotected. Update your webserver root to point to the public folder or complete the instructions to remove the public folder and use the suggested rewrite rules to restrict access to the files instead.

Vendor folder

Your vendor folder is currently being served by your webserver. This could expose untrusted scripts to the world and compromise your security.

Storage folder

Your storage folder is currently being served by your webserver. This could expose private data (including access tokens) and compromise your security.

Composer files

Your Composer files are currently being served by your webserver. This could expose advanced information about your server configuration and installed packages.

Before we move any further. Please confirm: Are you using Softaculous to manage your Flarum Installation?

boohoo

KBExit

Yes, I used it to install and didn't touch Softaculous again because I think that's all it did.

KBExit

boohoo take a backup of the following files:
composer.json
config.php
extend.php
and your assets folder.
Create a backup of your MySQL Database via SQL Dump.
Download these files.

Delete your Softaculous Installation entirely.

SSH Using Terminal and go to your root directory, run the Flarum Installation Command.
composer create-project flarum/flarum:^1.8.0 .
Change the document root from public_html to public_html/public
Go to your website, complete the Installation Wizard.
Upload and override those files in the Flarum Directory, upload your SQL Dump to your database to recover your website details, and run composer update in your Flarum Directory.

It is critical we detach Softaculous Entirely so it doesn't brick your website with future updates.
It is also critical that we fix the exposure of /public directory so your vulnerable files are not accessible to the browser.

If you don't want to take my word for it: https://lab.migratetoflarum.com/scans/06d008ec-0fea-494f-a0dd-92a2b725310b

boohoo

I took it down, but why can't I use one of the path customization options? Some of these things take a lot of time. I'm working on it tomorrow.

I think I can copy it in cpanel, trash it in Softaculous, and move it back to where it was and do the url configuration stuff.

KBExit

boohoo you can customize your path but you didn't have it set properly.
Easiest way to install Flarum is the way I described. You deviate from what I suggested, you can break your install or be back to square one to where you had files exposed that shouldn't be.

Just move your document root to what I suggested and be done with it after you detach Softaculous. It doesn't take that much time.

Tip-toeing and avoiding Composer/SSH is only going to cause you more headaches down the road.

boohoo

When you say all of that, do you basically mean follow the flarum instructions that use composer and copy over the files you mentioned? Does this deviate from the flarum instruction list?

GreXXL

boohoo what you actually just need to do is point your document root to your /public directory instead of /public_html or wherever it's pointed now and you will have a much better installation.

KBExit

boohoo follow the install instructions from Flarum, but prior to doing so, point document root to /public.
After you have everything set up, upload your backups and run composer update and your site will have your old content and you'll have a secure install.