Answers.Body: <p>I have found the same thing. I think there is a misalignment in the configuration, as the components settings file:</p>
  
  <p><code>
   * CIVICRM_UF_BASEURL - home URL for your site:
   * Administration site:
   *      define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/administrator/');
   * Front-end site:
   *      define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/');
   *
   */
  if (!defined('CIVICRM_UF_BASEURL')) {
    define( 'CIVICRM_UF_BASEURL'      , 'http://www.xyc.com');
  </code></p>
  
  <p>For the front end forms to work, it needs to be /administrator to load the resources, however the form then posts to this URL, which is not correct for unauthenticated users.</p>
  
  <p>I am going to copy the relevant resources for now.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-02T01:27:51.360Z
Answers.LastActivityDate: 2017-09-05T14:38:51.150Z
Answers.LastEditDate: 2017-09-05T14:38:51.150Z
Answers.UserDisplayName: Adam
Answers.Body: <p>I've done this for now. You could update to lock down further if the file doesn't match.</p>
  
  <pre><code>            # if file exists, ignore
              RewriteCond %{REQUEST_FILENAME} !-f
              # rewrite css, js, images &amp; other public
              RewriteCond %{REQUEST_URI} \.(?:css|js|jpe?g|gif|png|tiff|woff|woff2)$ [NC]
              RewriteRule ^components/com_civicrm/civicrm(/.*|)$ /administrator/components/com_civicrm/civicrm/$1 [L,NC]
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-02T01:53:02.063Z
Answers.LastActivityDate: 2017-03-02T01:53:02.063Z
Answers.UserDisplayName: Adam
Body: <p>I was attempting to lock down our Joomla admin folder with an additional Apache-level password, and discovered that there are some Civi resources under the admin folder that need public access (css, js, etc.). On the face of it, it seems to me this would be a bad practice (other public joomla resources do not seem to be under admin), but there are vast oceans of information that I don't know! Could someone explain (as briefly and simply as possible!) why these files are under www/administrator/components/com_civicrm/civicrm/ rather than under www/components/com_civicrm/ or such?</p>
  
  <p>I suppose I should also say that I haven't knowingly put these resources under admin, so I am assuming they were placed there as standard Civi installation. If I've improperly configured Civi, then my question becomes: What did I do/not do to cause this?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-02T18:08:01.837Z
Comments.Text: My hosting support gave me this fix:
  
  _We just created www/administrator/components/com_civicrm/civicrm/.htaccess and added the following lines to the file:
  
  `satisfy any
  allow from all`_
  
  Which then allows for Control Panel v2 "Protection" settings of the /Administrator directory to not affect the civicrm directory.
  
  This fixes my immediate concern, but doesn't answer the question about why certain Civi admin components need to be public.
Comments.UserDisplayName: Phil Morice Brubaker
Tags: <joomla><core>
Title: Why are public files in Joomla admin directory?
ThreadText: # Why are public files in Joomla admin directory?
  
  (Asked by: username_0 on 2017-02-27)
  
  I was attempting to lock down our Joomla admin folder with an additional Apache-level password, and discovered that there are some Civi resources under the admin folder that need public access (css, js, etc.). On the face of it, it seems to me this would be a bad practice (other public joomla resources do not seem to be under admin), but there are vast oceans of information that I don't know! Could someone explain (as briefly and simply as possible!) why these files are under www/administrator/components/com\_civicrm/civicrm/ rather than under www/components/com\_civicrm/ or such?
  
  I suppose I should also say that I haven't knowingly put these resources under admin, so I am assuming they were placed there as standard Civi installation. If I've improperly configured Civi, then my question becomes: What did I do/not do to cause this?
  
  **Tags:** joomla, core
  
  > **Comments:**
  > **username_0**: My hosting support gave me this fix:  _We just created www/administrator/components/com_civicrm/civicrm/.htaccess and added the following lines to the file:  `satisfy any allow from all`_  Which then allows for Control Panel v2 "Protection" settings of the /Administrator directory to not affect the civicrm directory.  This fixes my immediate concern, but doesn't answer the question about why certain Civi admin components need to be public.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-03-02. Score: 1
  
  I have found the same thing. I think there is a misalignment in the configuration, as the components settings file:
  
  `* CIVICRM_UF_BASEURL - home URL for your site:
  * Administration site:
  * define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/administrator/');
  * Front-end site:
  * define( 'CIVICRM_UF_BASEURL' , 'http://www.example.com/joomla/');
  *
  */
  if (!defined('CIVICRM_UF_BASEURL')) {
  define( 'CIVICRM_UF_BASEURL' , 'http://www.xyc.com');`
  
  For the front end forms to work, it needs to be /administrator to load the resources, however the form then posts to this URL, which is not correct for unauthenticated users.
  
  I am going to copy the relevant resources for now.
  
  
  ---
  
  ### Answer by username_1 on 2017-03-02. Score: 0
  
  I've done this for now. You could update to lock down further if the file doesn't match.
  
  ```
              # if file exists, ignore
              RewriteCond %{REQUEST_FILENAME} !-f
              # rewrite css, js, images & other public
              RewriteCond %{REQUEST_URI} \.(?:css|js|jpe?g|gif|png|tiff|woff|woff2)$ [NC]
              RewriteRule ^components/com_civicrm/civicrm(/.*|)$ /administrator/components/com_civicrm/civicrm/$1 [L,NC]
  
  ```
  
  
  ---
  
  