Access to the public folder via File Browser

Hello all,

Still OJS has no means for the journal manager to add public files to the system for public access, such as article models, manuals, and other documents or media that may be used for journal customization (logos, images, etc…).

Question 1:
Would creating a symbolic link to the submission folder allow access to the public folder? Would that always work or are there server/apache settings that need to be enabled (not by default)? Follow symlinks is one that comes to mind…

Question 2:
WHEN will there be an option for this…?? This is definitely a must-have… at least for us…


Ramón Martins Sodoma da Fonseca
Coordenador de Editoração
Portaria N 46, de 30 de Abril de 2014
Analista em Ciência e Tecnologia


Instituto Brasileiro de Informação em Ciência e Tecnologia/IBICT
Ministério da Ciência, Tecnologia e Inovação/MCTi
SAUS - Setor de Autarquias Sul
Quadra 05 Lote 06 Bloco H - Sala 500
70070-912
Brasília/DF

1 Like

Hi @ramon,

  1. Yes, creating a symlink is a good work-around. In my (limited) experience, no further Apache configuration has been required.

  2. Solving this problem without needing a work-around is dependent on a fundamental change: “public” files would need to be inaccessible directly through the web server, and currently that’s not possible. Consider what happens if a malicious user uploads a .php script. If it’s accessible directly via the server, then the script will be executed server-side when it’s requested. This is a huge security risk. The solution (which I expect will be included in OJS 3.0) will be to remove the public files directory and provide an alternative to which access is mediated via PHP.

Regards,
Alec Smecher
Public Knowledge Project Team

I’d like to be able to upload a few public files to our journal site, especially a .doc template for authors to use. Can anyone advise how to do this?

Ramon says “OJS has no means for the journal manager to add public files” but Alec refers to a “public files directory”. I see on the old forum that there was a public folder plugin, but I can’t find this in OJS and it seems to have needed a lot of tweaking to work (I’m journal manager but not familiar with coding).

Thanks for any advice you can offer,
David

Hi @davidp,

In my opinion the symbolic link approach is the best. See e.g. this thread for more discussion and instructions:
http://pkp.sfu.ca/support/forum/viewtopic.php?f=8&t=3980

Regards,
Alec Smecher
Public Knowledge Project Team

Hello all,

I have successfully managed to use the symlink approach on a Development Server. Once its deployed, remind me of posting here if it keeps working…

Just add a symbolic link to your ojs/public folder within the submissions’s folder (which should be outside of direct web server access, such as /home/username/ojs-submissions-folder…), with that basic ln -s /path/to/ojs/public/folder…

Hello all,

We are working on migrating the data from our busted install to a new 2.4.7-1. I noticed that in the public folder there is access to articles and issues folders. Are these specific to the public folder or are they from the files submission folder?

There are no folders withing the public folder, but there is a ton of new folders listed inside the files folder, which was created by whoever installed it, I suppose, as I don’t think the installation has changed that step.

Hi @ramon,

Can you move your question to a new thread? It’s not the same as the original question here.

Regards,
Alec Smecher
Public Knowledge Project Team

Created a new topic with the same content, but different title…

Hi - I believe one can have a public folder that is read only. i.e. public users can only download.files. I am not sure symbolic links on hosted solutions would be feasible.
i have used file download options without any security issues with various CMSes.
having the ability to download documents would be highly desirable.
The Files folder can have .htaccess.dest flle:

Inhibit directory listing

Options -Indexes

Inhibit direct file downloads

RedirectMatch 403 .*

Hello.
I am looking exactly for this:

Could you, please, advise me if I should use the same approach:

Or has any new functionality appeared?
Excuse me if I’m missing something obvious.
Thank you in advance.
Regards

Hello @SkiT,

We are still on version 2.x, so there’s no other solution. Apparently, on OJS 3.x that would also be the most secure approach!

Hi all,

In OJS 3.x, you can now use the Journal Library feature as Journal Manager to upload files that can optionally be made available to all users.

Regards,
Alec Smecher
Public Knowledge Project Team

Hi @asmecher,

By journal library do you mean “Publisher Library”? Would you please explain how to make the uploaded files in the publisher library available to all uses?
I tried the href link (from the elements source code) of the files uploaded when I was logged out of the system, but the file was not downloadable saying:
The current role does not have access to this operation

We want to avoid creating symlinks in the server in order to provide access to files.

Thanks
Ghazal

Hi @salehig,

What version of OJS are you using?

Regards,
Alec Smecher
Public Knowledge Project Team

Hi,

It is 3.1.0.1.

Regards
Ghazal

Hi @salehig,

Starting with OJS 3.1.1, it’s possible to designate files in the publisher library as being public. You’ll need to upgrade to the latest release. (See Improve Submission Library utility · Issue #520 · pkp/pkp-lib · GitHub for details.)

Regards,
Alec Smecher
Public Knowledge Project Team

Thanks for the update.