Does it mean that I must place some folders or files out of the file httpdocs on my web server ?

Yes :woohoo:

In this case, what are these folders/files ?

Wherever you want :dry:
Just take care that php user have write access to these forlders.

Hello Babynus,
Thank you for your answer.
Excuse my naivety, I just want to be certain that I understand these security issues. For the moment on my server, all files are in a folder named Projeqtor placed in httpdocs. All works well, but if I well understood, this is not among best practices and could also be dangerous...
In the folder named "files" I can see another folder named "attach". Is it this folder that I have to put outside the folder httpdocs (I mean on my server at the same level of httpdocs)?
The security advise mentions also another directory "documents", but I cannot see it in my files. Could you tell me where I can find it and whether I can put it also at the same level than httpdocs?
Thank you for your answers.

Let me explain security leak if you keep your files in htdocs folder :

• Hacker can go and navigate to http://yourserver/projeqtor/files/attach/tryandguessfilename : if hacker tries many values for "tryandguessfilename", he will possibly retrieve an attached file from your server. If this file is confidential, you may be in great trouble.
  This is a real issue as hacker do not have to be connected to try all the urls, and as ProjeQtOr is open source, the hacker can examine source code to guess which names are given (formatting rule).
• If hacker (or some user with bad behavior) connects to your ProjeQtOr instance, he will try and upload some .php file, and then call it from direct url to do whatever he wants on your server (for instance delete all files, or retrieve server password file).
  Fortunately, ProjeQtOr renames php files to avoid this leak, but not all executable files may be protected (recently, a leaked has been fixed for files named .php4 and .php5 that can be interpreted as php files)

If files are out of htdocs folder, they cannot be reached from direct url.

So now to your questions :

Is it this folder that I have to put outside the folder httpdocs (I mean on my server at the same level of httpdocs)

Yes, but not only.
You should put out of web reach :

• files/attach (where attached files are stores)
• /files/config (you must more your parameter.php file out of hacker reach, because it contains your infortation to connect to database)
  Notice that you'll then have to change /tool/parametersLocation.php file
• /files/cron (technical flder for automatic executions)
• /files/documents (where document files are stored)
• /files/logs (where log files are stored)
  A hacker would love to read you log files as they may contain very interesting information on your server

In fact you should only leave :

• /files/reports (where images for reports are stores, and report html pages must have access to them)
• thumbs (where thumb images are stored)
  This folder will be more used in V5 than it is in V4 😉

The security advise mentions also another directory "documents", but I cannot see it in my files

This folder will be created it you store Documnts.
Or maybe you moved it somewhere else on first config.
Check location as described in Global Parameter screen.

I hope that was clear, and maybe these security hints may help others.

Thank you a lot Babynus.
It is limpid 🙂

Hello Babynus,
Just a last question about my ticket. I have made what you told above, all worked well and I was able to connect but I had first an error message which told me that the logs file was invalid and that I have to check the file parameter. As the path was correct, I have changed the loglevel (I put 1 instead of 2). Now the error message disappeared, but I want to be sure that this change will not have some bad consequences I am not aware.
Thank you for your answer.

More likely you're facing write right issue in the log directory.
You must take care that php user (www-data or apache on linux, current user on windows) can write in the log directory.

Hi all,
This looks very beautyfull... but how do we do that? how do we change the folder location? how do we set it up in the first setup screen that appear after a fresh install?

Per example:
Directory to store Attachments : ../files/attach/
any valid directory, set to empty string to disable attachment
Security hint : move it ouside web access

What should I enter it here? is something like c:something that makes sense... or i need to set this on the web server and not the interface. It's the part i do not understand.

Sorry... it's my first deployment of this kind.
Thanks for your help.

Benoit

You should enter any directory location.
Advise it to set it out of web reach, to avoid any direct access to the files.
It will depend on OS.
For instance, under Linux/Ubuntu :
web directory is /var/www
For files, you can create new forlder where you'll set directories. For instance : /opt/projeqtorFiles
then for attachments : /opt/projeqtorFiles/attach
for logs /opt/projeqtorFiles/logs
and so on

under windows, you may use for instance
C:projeqtorFilesattach
/C:projeqtorFileslogs
and so on

OK I manage to make it work with the recomended safety.
But i got an error about the upgrade... this is quite funny. it,s a new installation. But I think it,s a default message upgrade installation... let's not get fussy about the words used. but the thing is that it's a brand new installation and i got error. I joined the log files so it will be easyer to analyse by the competent person.

The database is postgresql version 9.5

Is those error are normal?
Can I use the software without problem or i'll get some bad suprize?

Thanks for any help.

Hi,
This issue is really minor.
It is just an upgrade to allow to enter Quantity over 999 in bill line.
This upgrade will be fixed in V5.4

Hi,

is these tips raccomanded also for a hosting installation of the ProjeQutor?
How can I understand if php user can write in the log directory?

Thank you for your help

recomandations are the same for hosted instances.
If you can, set directories out of web reach as described on config page and reminded on global configuration page. It is what we do on our hosted instances for our customers.
It is the only way to be sure nobody can have access to these files outside the application.
But application is secured so that it may ne quite difficult to write in the log file even if it is kept in degault location.

Thank you babynus, I will try to do it.

Hi

I have update to 6.2.4
If I connect on my hosting (via ftp) I have this structure:

/
>cache
>etc
>logs
>mail
>public_ftp
>public_html
>>projeqtor
>>>files
>>>>attach
and other folders

I have to put these folders outside the public_html folder or only outside the projeqtor folder?

Thank you for your help 😉