CiviCRM Community Forums (archive)

Hi,

Playing for the first time with extension, a few questions/comments/issues

1) it wants to have the extension folder writable, so it can do the automatic download and upgrade directly.
I understand how it makes it easy, but I consider it a major security risk, and I will not let my admin users download extensions and install them. and in general, the less www-data can write php files, the happier I am.

I'm fine with the error message about being not writable, but trying to bypass and download/install manually leads to weird state
- as a test, I downloaded the zip for the extension and unzipped it manually. I did click on the install button, it wrote a couple of error messages about not being able to write (and perfectly normal) and now, it says that the installed version is outdated, and the upgrade page doesn't have any url/author, so I'm assuming the manual install didn't work

How can install manually an extension? In WP, it's fairly easy to do so, I would like to have the same option to download/unzip/enable

2) the extension expects to have cache and tmp files directly under the extension folder. Any reason not to use the normal cache/tmp folder from civicrm install?

Rationale: I don't want www-data to have too many places to write to, and if I start sharing the extension directory between civicrm instances, I can imagine problem arising

In 4.2, you can mitigate the concerns about downloading untrusted code by setting your own repository URL. Also, Jamie is working on a patch that would allow one to disable downloading entirely -- http://issues.civicrm.org/jira/browse/CRM-10575

For issues involving a read-only, shared extension directory, we should probably make a JIRA issue.