4.5.7 upgrade /administrator/components/com_civicrm a security risk.

[bryancn]

After upgrading from Joomla2.5.25/4.5.4 to 4.5.7 I get a warning when I access civicrm:

Security Warning File ".../administrator/components/com_civicrm" presents a security risk and should be deleted.

Is this for real?

[Hershel]

No, that appears to be a mistake. Can you upgrade to 4.5.8 and see if that goes away?

[planetwebb]

I get the message as well on 4.5.8 but the error is truncated, this is the full message:

/home/myhomedir/public_html/administrator/components/com_civicrm/civicrm/packages/dompdf/dompdf.php presents a security risk and should be deleted.

[anorthite]

4.5.6 to 4.5.8.

Security Warning
File '/drupal/sites/all/modules/civicrm/packages/dompdf/dompdf.php' presents a security risk and should be deleted.

[Hershel]

That file does not exist in CiviCRM 4.5.8. You must:

1. Delete your old CiviCRM code
2. Unpack a fresh copy of the 4.5.8 codebase

to insure a proper, secure upgrade.

[planetwebb]

For Drupal, deleting the code base is part of the upgrade process.

For Joomla!, there is no instruction to delete any part of the code base before upgrading.  In checking my packages subdirectory, I see a lot of directories that were not touched by the upgrade so I guess there may be many orphans.

Should the instructions for Joomla! upgrade be changed?

Keith

[lcdweb]

for Joomla, you can uninstall the extension and then reinstall.
generally it's fine to just install over the existing installation. but if you've been using civicrm for a while, it may mean you have a lot of old files from previous versions that are not cleaned up. so there's benefit in uninstalling/reinstalling.

note that if you do that, you may need to rebuild any menu links to civicrm pages that you created. Joomla doesn't always retain them very well through an uninstall/reinstall.

[mark0514]

What if you have already installed 4.5.8 over the previous version and are getting the message?

[lcdweb]

uninstalling should completely remove the administrator/components/com_civicrm directory, which is where the old files exist. you then reinstall 4.5.8, which will install a clean set of files.

of course... you'll want to run backups before you do anything.

[mark0514]

Considering that my Joomla installation has over 150 menu links to contribution pages, I may need to do something different. I found and deleted the one file and the message went away..

[planetwebb]

Similar situation for me...I decided to delete the one offending directory and the message is gone. At some point I may compare and trim but I'm more likely to move my site to Drupal.

[bmw]

I got this error message just after updating from 4.5.6 > 4.5.8.
Make sure you clear CiviCRM cache, your browser cache and both Joomla caches. Goes away.
(I use Cache Status add-on for Firefox)

[diegov]

Looking at files of package 4.5.8 I see that there's no "dompdf" directory anymore. So, maybe it's nice to register that the full folder should be deleted, not only the file "dompdf.php".