Answers.Body: <p>You can (and should) resolve this by removing that <code>dompdf.php</code> file from your system. It sounds like the previous version codebase was not removed during your most recent upgrade.</p>
  
  <p><a href="https://civicrm.org/advisory/civi-sa-2015-001-arbitrary-file-read">CIVI-SA-2015-001</a> was a security release which removed <code>dompdf.php</code> from the CiviCRM installation, as it permitted attackers to read arbitrary files from your webserver. This permits an attacker to retrieve the contents of files they would not normally be permitted to view - even system configuration files.</p>
  
  <p>CiviCRM upgrade instructions advise to <a href="http://wiki.civicrm.org/confluence/display/CRMDOC/Upgrade+Drupal+Sites+to+4.5+-+Drupal+7#UpgradeDrupalSitesto4.5-Drupal7-7.Backupandthendeleteallpreviousversioncodefiles">back up and then delete previous version code files</a> before installing the new CiviCRM codebase, since leaving old code files in place may affect the behaviour of CiviCRM (and in cases like this, the <em>removal</em> of a file is the fix required).</p>
  
  <p>A full list of recent CiviCRM security advisories is available at <a href="https://civicrm.org/advisory">https://civicrm.org/advisory</a>, and CiviCRM site administrators should <a href="https://civicrm.org/advisory/subscribe">sign up for security upgrade notifications</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-07T08:00:00.600Z
Answers.Text: I see the [Joomla instructions](http://wiki.civicrm.org/confluence/display/CRMDOC/Upgrade+Joomla+Sites+to+4.5) don't include this advice, but they probably should.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-07T09:39:51.173Z
Answers.Text: There might be a problem with Joomla upgrade workflow. In Drupal, it's easy enough to just move out the old code and untar the new code. But Joomla's process for loading code feels convoluted/mysterious to me, and there are some local-only files that need to be preserved (eg civicrm.settings.php). It may be that an alert is the best way to handle important deletions.
Answers.UserDisplayName: Tim Otten
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-07T10:14:39.250Z
Answers.Text: This is because Joomla's extensions have files in multiple locations, thus requiring deployment that is not required in Drupal. Using the installer script will allow us to make those changes to the files at the appropriate point in the process.  Additionally, we need to get down to one civicrm.settings.file that both the frontend and admin components refer to. If that, along with all other local-only files are stored in the /media/civicrm directory structure, that should simplify the installation.
Answers.UserDisplayName: Jeremy Proffitt
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-07T07:59:47.370Z
Answers.LastActivityDate: 2015-04-07T07:59:47.370Z
Answers.UserDisplayName: Chris Burgess
Body: <p>Upgraded to 4.5 a few weeks back on Joomla 3.3.6 and everything is working fine, except for a warning that I see when I first access CiviCRM. Reads:</p>
  
  <blockquote>
    <p>Security Warning File
    <code>/home/[directory]/public_html/administrator/components/com_civicrm/civicrm/packages/dompdf/dompdf.php</code>
    presents a security risk and should be deleted.</p>
  </blockquote>
  
  <p>Any idea what's causing this and what the proper way to address it might be (short of deleting the file)?</p>
  
Tags: <security>
Title: Since upgrade, dompdf.php is presenting a security risk?
ThreadText: # Since upgrade, dompdf.php is presenting a security risk?
  
  (Asked by: username_0 on 2015-04-07)
  
  Upgraded to 4.5 a few weeks back on Joomla 3.3.6 and everything is working fine, except for a warning that I see when I first access CiviCRM. Reads:
  
  > Security Warning File
  > `/home/[directory]/public_html/administrator/components/com_civicrm/civicrm/packages/dompdf/dompdf.php`
  > presents a security risk and should be deleted.
  
  Any idea what's causing this and what the proper way to address it might be (short of deleting the file)?
  
  **Tags:** security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-04-07. Score: 5 | Accepted answer
  
  You can (and should) resolve this by removing that `dompdf.php` file from your system. It sounds like the previous version codebase was not removed during your most recent upgrade.
  
  [CIVI-SA-2015-001](https://civicrm.org/advisory/civi-sa-2015-001-arbitrary-file-read) was a security release which removed `dompdf.php` from the CiviCRM installation, as it permitted attackers to read arbitrary files from your webserver. This permits an attacker to retrieve the contents of files they would not normally be permitted to view - even system configuration files.
  
  CiviCRM upgrade instructions advise to [back up and then delete previous version code files](http://wiki.civicrm.org/confluence/display/CRMDOC/Upgrade+Drupal+Sites+to+4.5+-+Drupal+7#UpgradeDrupalSitesto4.5-Drupal7-7.Backupandthendeleteallpreviousversioncodefiles) before installing the new CiviCRM codebase, since leaving old code files in place may affect the behaviour of CiviCRM (and in cases like this, the *removal* of a file is the fix required).
  
  A full list of recent CiviCRM security advisories is available at <https://civicrm.org/advisory>, and CiviCRM site administrators should [sign up for security upgrade notifications](https://civicrm.org/advisory/subscribe)
  
  > **Comments:**
  > **username_1**: I see the [Joomla instructions](http://wiki.civicrm.org/confluence/display/CRMDOC/Upgrade+Joomla+Sites+to+4.5) don't include this advice, but they probably should.  
  > **username_2**: There might be a problem with Joomla upgrade workflow. In Drupal, it's easy enough to just move out the old code and untar the new code. But Joomla's process for loading code feels convoluted/mysterious to me, and there are some local-only files that need to be preserved (eg civicrm.settings.php). It may be that an alert is the best way to handle important deletions.  
  > **username_3**: This is because Joomla's extensions have files in multiple locations, thus requiring deployment that is not required in Drupal. Using the installer script will allow us to make those changes to the files at the appropriate point in the process.  Additionally, we need to get down to one civicrm.settings.file that both the frontend and admin components refer to. If that, along with all other local-only files are stored in the /media/civicrm directory structure, that should simplify the installation.  
  
  ---
  
  