Hey, I have a couple of questions which became more important now there is the first update to automad (for me at least): On my local installation the updater ran successfully (through the Automad admin interface) - or so I thought, since the GUI told me so. When I look at the folders on my harddrive and the log, I see something strange though: instead of actually updating the files in .../wamp64/www/2019/ where Automad is located, the updater created a new folder "www19" on the same level as "www" (the webfolder of my local server) - which in my understanding it shouldn't even be able to (?) - and put the new files there. Now I'm confused and reluctant to update my actual server on the web. I'll probably better do it manually... I wonder: wouldn't it make sense to not have the "standard" and "tutorial" folders in "packages" installed, when those were removed from the installation? I prefer to only have the things on my server that I actually use... I can of course install updates manually. On my local installation where I originally installed Automad manually, there are several files in the root folder that I find irritating and that I did not upload to my actual server: version.sh, release.sh, phpunit.xml, composer.json, .hg_archival.txt, .hgtags, .hgignore What are those and are any of them needed? My server seems to work without them, but I didn't find them mentioned in the docs and would like to know if removing them does any harm? Finally, I seem to be no longer able to reliably serve images to outside sources (like posting a link to an image in a forum) from my webserver since I put Automad there in the root folder. I'm not that good with .htaccess files - does the one that comes with Automad somehow restrict access to folders that aren't part of the Automad installation? If that is the case: Could you point me in a direction what to look for and what to change to make it work again? With this last question I'm not fully sure if it's Automad at all, just want to make sure I don't hunt ghosts ;-) I can provide more information when needed. Cheers, Tom

Hi, that are a lot of questions. To help others to find topics easier, please split your questions across multiple threads in the future. However, I will try to answer them as good as possible: The updater normally doesn't create any folders outside the cache directory. But did the update work now? Do you have the latest version? No. It would not make sense at all. All packages - default or custom ones - need to be in that folder. You can always remove them or even exclude them from updates (which is not recommended). Those are files related to the development and are not required for production. It is pretty much standard to have those files in projects. That only depends on your server's configuration. And the last point: As written in the docs, PHP needs full write access to the whole installation directory. It is a file based CMS without a database. Therefore it needs to write to files.

No, the update did not work, as I wrote, the updater created a directory OUTSIDE of the www folder of my local server. Pretty scary that... I disagree, but I'll probably update manually anyway since the autoupdate does weird stuff. I disagree again, since it's not clear what belongs to Automad and what not - I'm not a developer - So it would be good to have a clear documentation on what should go to the production server and what not. Or have a dedicated folder for stuff that's related to development. Your documentation is very vague in many places. That answer is not helpful at all. Does or does not the Automad .htaccess file limit access to folders other than those of Automad itself when it's installed in the root of a hosted webspace? Can you bring that answer into a form I can digest please as I asked for in my initial question? What does that mean in 744-language? What settings do I need to make on a hosted webspace server running Apache? I read the docs (as I wrote above) and simply did not understand it. It would really help people who are not as web-savy as you are to be more specific and precise with your docs and answers, otherwise it creates more questions as it answers... Thanks, Tom

Several questions regarding the update and .htaccess...

ThomasHelzle

Hey,

I have a couple of questions which became more important now there is the first update to automad (for me at least):

On my local installation the updater ran successfully (through the Automad admin interface) - or so I thought, since the GUI told me so. When I look at the folders on my harddrive and the log, I see something strange though: instead of actually updating the files in .../wamp64/www/2019/ where Automad is located, the updater created a new folder "www19" on the same level as "www" (the webfolder of my local server) - which in my understanding it shouldn't even be able to (?) - and put the new files there. Now I'm confused and reluctant to update my actual server on the web.
I'll probably better do it manually...
I wonder: wouldn't it make sense to not have the "standard" and "tutorial" folders in "packages" installed, when those were removed from the installation? I prefer to only have the things on my server that I actually use...
I can of course install updates manually.
On my local installation where I originally installed Automad manually, there are several files in the root folder that I find irritating and that I did not upload to my actual server:
version.sh, release.sh, phpunit.xml, composer.json, .hg_archival.txt, .hgtags, .hgignore
What are those and are any of them needed? My server seems to work without them, but I didn't find them mentioned in the docs and would like to know if removing them does any harm?
Finally, I seem to be no longer able to reliably serve images to outside sources (like posting a link to an image in a forum) from my webserver since I put Automad there in the root folder. I'm not that good with .htaccess files - does the one that comes with Automad somehow restrict access to folders that aren't part of the Automad installation?
If that is the case: Could you point me in a direction what to look for and what to change to make it work again?
With this last question I'm not fully sure if it's Automad at all, just want to make sure I don't hunt ghosts ;-)

I can provide more information when needed.

Cheers,

Tom

ThomasHelzle

Oh, and one more questions that is very blurry in the documentation:

Could you give a clear description what folders need to be set to what file permission level?

In GetSimpleCMS there was a page in the admin area that checked if everything was setup correctly.
With Automad, I'm unsure what level of permissions each folder/file needs.
If you could list the xxx (for instance "755") settings for each folder that would be very helpful!

Thank you very much!

Cheers,

Tom

mad

Hi, that are a lot of questions. To help others to find topics easier, please split your questions across multiple threads in the future. However, I will try to answer them as good as possible:

The updater normally doesn't create any folders outside the cache directory. But did the update work now? Do you have the latest version?
No. It would not make sense at all. All packages - default or custom ones - need to be in that folder. You can always remove them or even exclude them from updates (which is not recommended).
Those are files related to the development and are not required for production. It is pretty much standard to have those files in projects.
That only depends on your server's configuration.

And the last point: As written in the docs, PHP needs full write access to the whole installation directory. It is a file based CMS without a database. Therefore it needs to write to files.

ThomasHelzle

No, the update did not work, as I wrote, the updater created a directory OUTSIDE of the www folder of my local server. Pretty scary that...
I disagree, but I'll probably update manually anyway since the autoupdate does weird stuff.
I disagree again, since it's not clear what belongs to Automad and what not - I'm not a developer - So it would be good to have a clear documentation on what should go to the production server and what not. Or have a dedicated folder for stuff that's related to development. Your documentation is very vague in many places.
That answer is not helpful at all. Does or does not the Automad .htaccess file limit access to folders other than those of Automad itself when it's installed in the root of a hosted webspace?
Can you bring that answer into a form I can digest please as I asked for in my initial question? What does that mean in 744-language? What settings do I need to make on a hosted webspace server running Apache?
I read the docs (as I wrote above) and simply did not understand it.

It would really help people who are not as web-savy as you are to be more specific and precise with your docs and answers, otherwise it creates more questions as it answers...

Thanks,

Tom

ThomasHelzle

I looked at it again and now I can no longer access the locally installed Automad anymore at all.
I get an Error 403 - access forbidden when I try to open the local webpages with the browser and an error 500 - internal server error when I try to access the admin GUI.
I don't know what the updater was doing and why, but it definitely broke my installation.

I'll have to debug this another day.
Not exactly confidence inspiring though...

Cheers,

Tom

mad

I am very sorry to learn that I have not been able to help you with my answers. Please understand though that many of your questions contain incomplete and imprecise information which makes it impossible for me to identify the issue. For instance server environments my vary from case to case tremendously. Therefore there is no general answer.

Also keep in mind that Automad is open source and free of any charge. Nobody should therefore be compelled to use it.

ThomasHelzle

Yes, it's awesome that you created Automad and yes it's free and yes I do not have to use it...

But in the time it takes you to write those things above, I'm sure you could have written something like:

Can you provide me with the following information.............. (I do not know what information you need, I only know that the updater did totally wrong stuff and in the process destroyed my local installation - I had assumed you would like to fix that?).
2 Let's agree to disagree then.
Good idea, I'll mention it in the readme.
4 Automad does X, Y, Z in the .htaccess and if you want to exclude a certain directory from that, set it to .........
Set all directories to 744, that should do the trick. (?)

See it from the other side too: For me it was a major gamble to use Automad, since it's new and only used by a handful of people. Since I'm not a major developer, I am dependent on the community or you to help me when Automad does not work as expected or the documentation is unclear. I guess you want Automad to flourish, otherwise, why release it and provide a forum at all?

ATM I'm left with a CMS that does not work reliable and messes up my server.

You make it look as if Automad is very easy to use, and in wide parts it is. But there are also major issues and I invested a lot of time in making it work and transfer my content to it. I am fine with reporting and working through issues and if you tell me what information you need, I will try to provide it.
But making empty statements won't get us anywhere - if you don't want to help, it's better you don't answer at all.

Cheers,

Tom

mad

Hi, I really have the feeling this is going nowhere. You say, that the answers and the docs are unclear but the reality looks as follows:

You don’t provide reproducable test cases
You don’t enable debugging
You don’t provide information about the operating system
You don’t provide the type of webserver you use
You don’t separate clearly the issues to make it accessible for others

All this is required to help you. There are people who create open source software free of charge in their spare time and help other people like you even on sundays. In my opinion they at least deserve the respect to get asked the right questions.

In this thread you didn’t provide any of the above mentioned information but instead only complained about the cms and its creator. The way you asked is demanding, blaming and aggressive and nobody will invest time to help you under those circumstances.

Using a cms requires a basic knowledge about webservers and you obviously don’t have that. A documentation can not compensate that lack of knowledge.

Writing in public that a software destroys your server without actually saying what you really did is a very serious and hard statement and you should be very careful with this.

For instance the docs are very clear on the installation - PHP needs full write access. A person with basic knowledge understands that easily. There is even a local installation guide for inexperienced people which you obviously didn’t read. Telling you to set permissions to whatever without knowing your setup would not only be unprofessional but also very dangerous! Please also note that in most cases you don’t have to touch permissions at all - as written in the docs you only have to set them, in case the cms asks you to do it.

However I would love to help but I simply don’t know how. You should better use another system.

ThomasHelzle

Yeah, you seem to live in a different reality from mine.

I did my best and when reading my initial post again I find it rather clear, and would have been happy to clarify things further. I would need your help there though, since I do not know what exactly you need to fix the problem.

I try once more for the broken update function.
If you prefer to no longer deal with me, please let me know and I'll try to find another CMS.

My operating system is Windows 8.1 x64 with all latest updates.
I have Wampserver 3.1.4 64bit installed from http://www.wampserver.com/en/
The path is C:\Web\wamp64
Automad 1.1 was installed in C:\Web\wamp64\www\2019 and was working fine.

When I read that there is an update, I started the Wampserver, opened the admin interface of Automad and clicked on the Update button. The GUI then told me that the update was running and then that it was successful, but didn't show the version number.
I then got an Error 403 - access forbidden when I tried to open the local webpages with the browser (localhost/2019) and an error 500 - internal server error when I tried to refresh the admin GUI.

I was of course unable to enable debugging then since the whole installation was broken.

Then I looked at the file system.
Instead of updating the files in C:\Web\wamp64\www\2019, the updater created a folder C:\Web\wamp64\www19
and put the updated files there. It must have changed something in the original folder though, since that installation was then broken. I don't know what though.

So the update function of Automad wrote to a folder outside the www folder of the local webserver, which in itself I find disturbing. Since it created a folder "www19" it looks to me, that it somehow created a wrong path from the parent folder "www" and part of the installation folder "2019".

I will now try to update manually by placing the "automad" and "lib" folders and the index.php in my original installation and see if that fixes it.

But yes, Automad, by using the update function did kill my installation and wrote to a folder it has no business writing to. If that is harsh, you can maybe understand why I am not too happy about it myself.

AND PHP HAS FULL WRITE ACCESS. The installation was running and I already deployed a working website to my life server online as you know. I was simply asking if I need to set any other specific permissions... My previous CMS - also text file based - needed that.

Cheers,

Tom

mad

There is a fine line between „messing up a server“ and a failed update with a broken installation. You should never cross that line!

However it looks like PHP doesn’t like \20 as a string and removes it from the path. I am pretty sure that changing the directory name from 2019 to something else starting with a letter would temporary resolve the issue and would give others the time to investigate more. For now I would propose that you merge both directories by moving all updated folders to your broken installation.

Regarding the permission I have to say that I really don’t understand all the trouble here! Again, the docs are really clear on that! Both - on the getting started page as well as in the local installation guide is clearly written that you ONLY have to set permissions on Linux an macOS. And only in case the cms complains. Since you are running Windows, there is simply nothing to do. All fine here!

And regarding the .htaccess file: if you take a look at it you will notice that every single line is described with comments to explain what it does. It doesn’t block access to files because the cms itself also serves files.

I hope that helps you to get it running again.

ThomasHelzle

Thanks Eric!

It seems Automad/PHP choked on the local foldername "2019" - I don't know PHP in-depth enough to know how that could be prevented, maybe some kind of filter option or specific handling instruction for the paths?
Otherwise this seems like one of those things that could do mayhem to peoples systems in certain situations.

I would also think that on my online server (where like on yours it's installed on the root) this should not happen, but I probably still will do a manual update and just upload "automad", "lib" and index.php.
I was able to fix my broken local installation that way now.
My online server is still running 1.1. ATM.

I use Filezilla for upload to my online server and didn't have a problem with the .htaccess getting broken thankfully, my only problem is, that the code .htaccess uses - even with all the annotations - gives me a headache. Unscrambling what it does exactly and if it could be the cause of my current problems with serving images from folders unrelated to Automad to forums will take me a long time, therefore my question about that. My hope was, that there would be a simple answer how to take out certain folders from the redirections or whatever it does.
Seems not, so I'll probably have to spend some weekends on unscrambling that stuff...

mad As for file and folder permissions: I'm not concerned about the permissions on my local system, that's not connected to the web and Windows doesn't have permissions the way Linux has them.
But my online server is running Apache on Linux (shared hosting, no direct system access, running PHP 7.2, but I do not know if as fast CGI or as a module) and I am still not sure if I need to set the permissions to a specific value.
With my last, textfile-based CMS that was quite important for security, so that is why I try to find out if Automad needs any specific settings there too.
The link to stack overflow in the docs is not helping any, since it isn't specific to Automad, refers mostly to OSX and is a convoluted mess with people fighting over how to set up things instead of providing a clear answer.
I know how to change/set permissions on my online server, I just haven't found out yet, what to set them to for Automad to both work and be as secure as possible at the same time.
Seems like a simple question to me, but obviously I'm wrong.

Cheers and thanks,

Tom

Eric

A little personnal experiment which are not answers but …
in local with XAMPP I had troubles with some regexp and some minor things didn't seem to work. I then choose to install Apache and PHP with homebrew (on Mac) and all runs well. Now I'm not confident with Lamp like XAMPP
I then put my site online , made some tests with the SSL options and the .htaccess has been crushed by the process (still present but size 0 byte). So I've got some errors like yours (document not found or internal error). Copying again the original .htaccess makes it run well again
my local installation is in a sub directory and online at the web doc root, it runs well without any trouble or modification
I had no trouble with several updates in local with the dashboard I mean just had to click the update button and go. I'll try these days a first upadate online and will see.

mad

I think you have to accept that things are just not that easy. I asked you about the server info and you answered with Windows with WAMP. Again, permissions are related to the OS, the type of server and how PHP is used (fast cgi or module) and nobody can give you a correct and secure answer without that info. But as I wrote many times now, if the cms doesn’t ask you to change permissions, don’t do it. And I tell you this, just because it is always more secure to leave the standard permissions of your hosting company untouched in case you don’t know what you are doing. So to be clear: do not change the permissions if the system runs fine!

And the update issue you experienced is only related to Windows. You can run updates on the Linux server.

ThomasHelzle

Mad, all is good. I'll try to not bother you anymore, since we seem to be unable to have a meaningful conversation, but I want to say this:

I do webdesign since the days when people had to use something like CompuServe to access the web and most didn't know what "WWW" stands for, lived through all of the browser wars, the Flash craze etc. and then after some years started to lose interest when the web became more and more obscure. Nowadays, I only maintain my own website and help with that of my partner.
With that said, to me it's obvious that people will normally run two installations, one local for development and one online, where the local one isn't much of a security concern and the online one also usually doesn't run a desktop OS.
In 99% of all discussions I had with developers or other web people I did not have to spell that out by the individual letter or got a quick note on how to find out the things that were needed.

Part of evaluating a CMS is also to find out how good of a community it has and how the developer(s) communicate and handle problems. I know now that I won't recommend Automad to others anymore, I also removed my Twitter post where I did that.

You seem to be more concerned with brick-walling and defending your own insecurity (?) instead of being actually helpful and clarifying. Your choice of course.

So feel free to remove this thread if you think it's offensive or shedding a bad light on your work, I won't mind.

Cheers, over and out for good,

Tom

mad

Sorry, it is impossible for me to help you. In my opinion a community is about helping each other in a friendly way. It is not a customer service. Over the last weeks I tried to help you with all your questions. In this thread I even answered the same question three times.

You have to ask yourself what you have contributed to the community yourself. Offending others and making people resposible for your personal issues is nothing I will miss in a community of people with kind of the same interests.

I actually don’t plan to remove this thread. I think it is obvious enough what’s going on here.