How to update ExpressionEngine when your system folder is outside the web root
- Categories:
- ExpressionEngine
- Tags:
- expressionengine, security, update
- Published:
- 9:14am on Saturday 22nd August, 2009
While they make it possible for you to move your main ExpressionEngine installation folder outside of the web root, EllisLab have neglected to allow for that possibility in their update scripts. This article shows you how to fix it with a couple of simple edits.
Given that there is even a blog entry on the EE site on the topic, you might have thought it would be accounted for in the version update script packaged with each new version. Unfortunately though the update instructions and the script itself ignore the possibility that you have moved your /system/ folder outside of the web root.
How to update EE, revised
First, ignore the instruction to copy system/update.php into your existing /system/ folder; instead, copy it into your web root folder (where your admin.php and path.php files are). It is now reachable at www.example.com/update.php - but it doesn’t work because the paths are wrong.
Editing update.php
Open update.php in your text editor. We are going to import the path information used by the rest of the site and update the paths needed for the update to run.
Add this line to the start of the file (beneath the copyright message):
require_once(’./path.php’);
Next, at the top of the file there are a series of definitions:
define(‘EXT’, ’.’.$path[‘extension’]); define(‘PATH’, ’./’); define(‘PATH_DB’, ’./db/’); define(‘PATH_CORE’, ’./core/’); define(‘PATH_LANG’, ’./language/’); define(‘PATH_MOD’, ’./modules/’); define(‘PATH_EXT’, ’./extensions/’); define(‘PATH_PI’, ’./plugins/’); define(‘CONFIG_FILE’, ‘config’.EXT);
Let’s update them to use the correct path information:
define(‘EXT’, ’.’.$path[‘extension’]); define(‘PATH’, $system_path); define(‘PATH_DB’, $system_path . ‘db/’); define(‘PATH_CORE’, $system_path . ‘core/’); define(‘PATH_LANG’, $system_path . ‘language/’); define(‘PATH_MOD’, $system_path . ‘modules/’); define(‘PATH_EXT’, $system_path . ‘extensions/’); define(‘PATH_PI’, $system_path . ‘plugins/’); define(‘CONFIG_FILE’, $system_path . ‘config’.EXT);
We’re almost done, but there’s just one more place where the path is hardcoded and needs to be fixed. In the Update() class method update_manager(), we need to use the path information one more time. Change these lines:
function update_manager()
{
global $DB;
Here's the revised version:
function update_manager()
{
global $DB, $system_path;
$this->update_dir = $system_path . ‘updates/’;
We’re just overriding the path to the update directory with the correct path.
Now load the update script at www.example.com/update.php to run the update with no problems, despite your /system/ root not being where it ‘should’ be.
This should be in the EE trunk
Hopefully EllisLab will eventually make this hacking unnecessary and incorporate these changes into the official release, but in the meantime if you’re a security-conscious developer I hope this was useful.
I'd love to hear what you think - please use the form below to leave your comments. Some HTML is permitted:
b,i,em,del,ins,strong,pre,code,blockquote,abbr. URLs or email addresses will be automatically converted into links.Phil at 6:37am on 3rd October, 2009 #
Andy Marshall at 3:34pm on 11th May, 2010 #
Matthew Pennell at 7:52pm on 13th May, 2010 #
Stephen Lewis at 1:19am on 15th May, 2010 #