Error 500 on Submission Page after moving “files” folder

Software Support
1

Describe the issue or problem
Dear PKP support

I followed the deployment manual to secure the submissions “files” folder by moving it out of the web root and pasting the new path in the config file. After moving the folder, the following error message appears when I open the Submissions page when logged in as admin:

“ An unexpected error has occurred. Please reload the page and try again.”

After reloading several times, the same error message persists.

I can access all submissions in the editorial workflow, except incomplete and published submissions. The “Archived” tab in the Submissions page shows “No submissions found”, but three published submissions were visible before we moved the “files” folder.

When I try to open incomplete submissions, the page appears blank with the message “This page isn’t working

journal.example.org is currently unable to handle this request.

HTTP ERROR 500”

Steps I took leading up to the issue
While adding the new folder path in the config.inc.php file we found the old path written as:

files_dir = “/home/www/journal.example.org/public_html/files

I found this confusing as we wrote it in the installation wizard as:

http://journal.example.org/public_html/files

We added the new path in this format:

files_dir = “/www/journal.example.org/files”

Could this be causing the problem?

What application are you using?
OJS version: 3.4.0.8

Operating system: Linux

PHP version: 8.0.30

Server: Apache

Database: MySQL 8.0.30

Browser: Brave 1.77.95 and Mozilla Firefox

Additional information
The following screenshots are for your reference:

Submissions page

Screenshot from 2025-09-22 12-07-53
Screenshot from 2025-09-22 12-07-531849×941 208 KB

Archive Tab

Screenshot from 2025-09-22 13-45-42
Screenshot from 2025-09-22 13-45-421849×941 188 KB

2

Hi @Mk2000,

The 500 error indicates you should check your PHP error log for relevant error messages there. Console logs tend not to be so helpful in these cases.

-Roger
PKP Team

4

Hi @Mk2000,

At a glance, the appropriate setting appears to be

files_dir = "/home/www/journal.example.org/files"

The most important thing is that this lives outside public_html.

For further debugging, Roger’s suggestion is best.

Regards,
Alec Smecher
Public Knowledge Project Team

5

Hi Alec,

I corrected the files_dir path but the problem persists. When I checked the error logs I found:

[Tue Sep 30 00:42:32 2025] [error] mod_fcgid: stderr: Server host "www.journal.example.org" not allowed!
[Tue Sep 30 01:59:31 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.example.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34

I checked the ‘allowed_hosts’ in the config.inc.php file and found: [“journal.example.org”]
I added: “www.journal.example.org”

I cleared all the files in the OJS cache folder through file manager and cleared the browser cache. The problem still persists.

We did not create an API and salt key during deployment of the OJS, but the OJS application Administration/Systems information page shows there is an API and salt key. Could this be causing the problem?

7

Hi @Mk2000,

The “Server host xyz not allowed!” message always derives from a missing or misconfigured entry in allowed_hosts. What do you have for that setting? (Make sure to properly quote the text when you post it here – it’ll help prevent characters from getting converted. There is a difference between " and “, for example.)

Regards,
Alec Smecher
Public Knowledge Project Team

8

Hi Alec,

Here is our journal’s allowed_hosts setting in the config.inc.php file:

allowed_hosts = "["journal.org", "www.journal.org"]"
9

Hi @Mk2000,

I think that syntax is the problem due to the nested quotes. Try:

allowed_hosts = '["journal.org", "www.journal.org"]'

…or…

allowed_hosts = "[\"journal.org\", \"www.journal.org\"]"

Regards,
Alec Smecher
Public Knowledge Project Team

10

Hi Alec,

We tried both of the settings you suggested but still the HTTP 500 error persists. The “server host not allowed” message is resolved.

Attached for your further reference is the new error log.

I can’t attach the config file and the access log.

Summary

Error Log

[Sat Oct 11 03:19:10 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_TemplateCompilerBase::compileTemplate(): Implicitly marking parameter $parent_compiler as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_templatecompilerbase.php on line 386
[Sat Oct 11 04:52:11 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_TemplateCompilerBase::compileTemplate(): Implicitly marking parameter $parent_compiler as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_templatecompilerbase.php on line 386
[Sat Oct 11 07:34:06 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 09:38:12 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:24:09 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:24:12 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:24:29 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:24:35 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:24:37 2025] [error] mod_fcgid: stderr: Slim Application Error:
[Sat Oct 11 10:25:04 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:25:20 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:25:24 2025] [error] mod_fcgid: stderr: Slim Application Error:
[Sat Oct 11 10:25:29 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:25:31 2025] [error] mod_fcgid: stderr: Slim Application Error:
[Sat Oct 11 10:27:47 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:28:00 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:28:04 2025] [error] mod_fcgid: stderr: Slim Application Error:
[Sat Oct 11 10:32:27 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:32:40 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:35:15 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Method_GetTemplateVars::getTemplateVars(): Implicitly marking parameter $_ptr as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_method_gettemplatevars.php on line 34
[Sat Oct 11 10:35:53 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:36:01 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:36:03 2025] [error] mod_fcgid: stderr: Slim Application Error:
[Sat Oct 11 10:36:08 2025] [error] mod_fcgid: stderr: PHP Deprecated: Smarty_Internal_Runtime_Inheritance::process(): Implicitly marking parameter $parent as nullable is deprecated, the explicit nullable type must be used instead in /home/www/journal.collectivescholar.org/public_html/lib/pkp/lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_inheritance.php on line 168
[Sat Oct 11 10:36:10 2025] [error] mod_fcgid: stderr: Slim Application Error:

11

Hi @Mk2000,

If the “server host not allowed” message is resolved, then you’ve corrected the problem with the allowed_hosts setting and can move on to looking for another problem.

It’s hard to see what’s happening based on the error logs you included. The PHP Deprecated warnings are just noise and can be ignored. I see two potential things to investigate:

  • The error you’re encountering is not captured in the the section of log file that you quoted. Try triggering the error message to occur, then immediately looking at the log to see if you can spot a message that appeared at the right time.
  • The [error] mod_fcgid: stderr: Slim Application Error quoted in the log might be relevant. Unfortunately it doesn’t include any details – and usually error messages do. If you have any evidence that your server was hacked as a result of the files directory being placed in the web root, then you might want to use a server-side tool like diff to compare your installation’s contents to a fresh copy from the .tar.gz download of the same version of OJS. This would help identify any code that had been modified – but it’s a little outside the scope of this forum.

Regards,
Alec Smecher
Public Knowledge Project Team

12

Hi Alec,

Since I moved the submissions file, according to the deployment manual, outside the webroot I cannot access and view the submitted files or upload new submissions.

We tried triggering the problem several times until finally we found this message in the error log:

[Wed Oct 15 07:14:05 2025] [error] mod_fcgid: stderr: PHP Warning: mkdir(): Read-only file system in /home/www/journal.example.org/public_html/lib/pkp/classes/file/FileManager.php on line 418

I visited the FileManager.php and found:

 * Create a new directory.
 *
 * @param string $dirPath the full path of the directory to be created
 * @param string $perms the permissions level of the directory (optional)
 *
 * @return bool returns true if successful
 */
public function mkdir($dirPath, $perms = null)
{
    if ($perms !== null) {
        return mkdir($dirPath, $perms);
    } else {
        if (is_dir($dirPath) || mkdir($dirPath)) {
            return $this->setMode($dirPath, static::DIRECTORY_MODE_MASK);
        }
        return false;

We contacted our hosting provider technical support and he replied:

“You can access files by default outside of the domain or subdomain folder and all files should be inside the folder.
This is security option on Jail Host for each domain or subdomain thus if one gets hacked it is less likely other hosts in the account to be affected as it limits basic scripts from accessing other folders in the account.
There is no way to use both options and you need to choose only one - either disable Jail Host or all files needs to be inside your subdomain folder.
We can not suggest more details for your application and you need to contact your website developers for that as we do not use development services. There are no other options in the control panel and it depends on your website configuration only how files are accessed.
Thank you for your understanding on this matter.”

We are following the instructions in the manual and keeping the submissions directory outside the web root. However, the errors described above persist.

If a technical solution to make the external directory work is not available, our alternative is to move the directory back inside the web root. Could you please advise on how we can access our submissions files outside the web root without compromising the security of the server?

13

Hi @Mk2000,

I can’t comment on the host’s configuration in detail – you might test it out with a test script outside of OJS, following instructions similar to what’s described here.

But if it’s really true that the only place your host will allow files to be written is inside public_html, you can move your files directory back there and protect it from direct access using a .htaccess file. This is a web server mechanism and support for these varies from server to server, so I can’t give precise instructions – but your host might have a knowledge base describing how this is done. See for example:

https://kb.hosting.com/docs/using-htaccess-files

The key is to prevent users from constructing a URL and accessing files in that directory directly in order to download .docx files, or worse, invoke .php scripts.

Regards,
Alec Smecher
Public Knowledge Project Team

14

Dear PKP support,

Despite following the deployment manual and the kind advice of the PKP team, the submission files are still inaccessible when they are outside the webroot. I hope the OJS developers will find a solution that keeps the submissions files secure and accessible outside the webroot without compromising server security.

Thank you for your dedication,

Mk2000

15

Hi @Mk2000,

This is not an OJS limitation, and nothing the OJS dev team can correct. It is either a misunderstanding of your provider’s limitations, or a restriction they are imposing on your hosting environment that is preventing the files_dir from being located outside the web root. The work-around I suggested above using .htaccess is a perfectly safe alternative.

Regards,
Alec Smecher
Public Knowledge Project Team

16

This topic was automatically closed after 11 days. New replies are no longer allowed.