Need to circumvent - "Dataroot location is not secure" issue

Need to circumvent - "Dataroot location is not secure" issue

by Rick Morice -
Number of replies: 5

Hi,

I'm a web developer who's been tasked with looking into Moodle.

Ultimately my problem is as follows: I have a local machine that we have a "work in progress" folder ../wip/ which has all my projects within it.

For ease of use XAMPP's apache serves the whole folder.

For backup purposes, all data should be stored there.

 

So - for testing and mooching about I have set up a core folder wip/moodle-mooching/moodle and tried to install there. When it asks for a data folder I have set up a wip/moodle-mooching/moodle-data.

Obviously this is "insecure" as it is being served by Apache. However, in a local example I understand this etc, and simply want it to do as it's told.

1) How do I circumvent this problem?

2) Surely whether someone does this is their choice, and thus shouldn't it be an option? I fully understand "complaining loudly at someone" for this, but it's still a valid choice.

 

If anyone has a fix for this it'd be appreciated.

Cheers

Rick

Average of ratings: -
In reply to Rick Morice

Re: Need to circumvent - "Dataroot location is not secure" issue

by Rick Morice -

For reference:

http://docs.moodle.org/en/Creating_Moodle_site_data_directory

I have changed my apache httpd.conf to include:

<Directory "C:\wip\moodle-mooching\moodle-data">

Order allow,deny

Deny from all

</Directory>

This correctly serves a 403 forbidden, but still fails to work with the Moodle installer.

Average of ratings: -
In reply to Rick Morice

Re: Need to circumvent - "Dataroot location is not secure" issue

by Rick Morice -

Ok - for reference if anyone is interested.

 

The way to escape the install security validator is to install, allowing the folder to be in a separate location - I used a usb pen drive.

I then simply copied the generated folders in the datastore to the new "insecure" location and changed the "$CFG->dataroot" path in config.php.

There's still a few bugs i'm ironing out, such as a few missing images, but that seems to have solved it.

Average of ratings: -
In reply to Rick Morice

Re: Need to circumvent - "Dataroot location is not secure" issue

by Tim Hunt -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

For development, I just create the config.php file by hand when I install Moodle (you can start by copying config-dist.php and then editing it). That will let you install Moodle. Then I just ignore the insecure dataroot warning on the admin page.

Average of ratings: Useful (2)
In reply to Rick Morice

Re: Need to circumvent - "Dataroot location is not secure" issue

by Paul Lovatt -

Quick way out of the moodledata security impasse! 

This has taken up the past EIGHT hours of my day and below is how I quickly solved the problem, with the help of my hosts 1and1.  Hopefully this will save others the sheer torment of an installation that will not proceed!!  I am on a linux shared server and do not have access to levels above my webroot (i.e. I can get into, but cannot see above, my htdocs/public_html folder).  I am not alone because I've been reading all the posts!

Skippable-rant: The web is full of people frustrated with Moodle and with their hosts because of this particular installation impasse.  It is utterly ridiculous that Moodle is configured to install in a way that will be defeated by most of the cheaper web hosts where access beyond the webroot is disallowed. Especially when the solution below is so simple.  Why on Earth is it not mentioned in the installation instructions!  

First, I had tried all the other offered solutions which have worked for some people but not for me: changing moodledata permissions to 750, 755, 700 etc; creating a .htaccess file etc.  No good.

My hosts 1and1 responded quickly (less than one hour) with the following suggestion which I am certain would also work on other hosts:

Regarding your Moodle installation, please change the destination of your [mydomain.co.uk] domain to "/moodle" to resolve the problem in the moodledata folder section. After changing the destination of the domain, please give it about 3-5 minutes for the server to refresh and after that, proceed with the installation. To change the destination of the domain, please follow the steps provided in the link below.

http://faq.1and1.co.uk/domains/domain_admin/domain_dest/2.html

As I say, this worked, and would work similarly for other hosts I am sure.  I chose to point my domain at moodle, as they suggested.  Obviously, this will not be the solution everybody wants.  But there is the option to create another folder for the domain to point at, and put moodledata alongside it and moodle itself (and any other sites using the same domain) inside it.  This creates a level of invisibility above the moodle folder that satisfies the installer!

This would work (with your domain configured to point here *) if you want to run your moodle as http://yourdomain.com/moodle:

  1. /htdocs (no access above this point)
    1. /magicfolder1*
      1. /moodle
      2. /otherwebsite1
      3. /otherwebsite2
    2. /moodledata

In my case, my moodle is now to be found at http://mydomain.co.uk/ which works fine for me:

  1. /htdocs (no access above this point)
    1. /moodle*
    2. /moodledata

Kind of obvious when we think about it!  So somebody with the permissions please add it to the installation instructions!

Paul

Average of ratings: -