<?php
/**
 * @version $Id$
 * @package    Contact_Enhanced
 * @subpackage Views
 * @author     Douglas Machado {@link http://ideal.fok.com.br}
* @author     Created on 15-Dec-09
 * @license		GNU/GPL, see license.txt
 * Contact Enhanced  is free software. This version may have been modified pursuant
 * to the GNU General Public License, and as distributed it includes or
 * is derivative of works licensed under the GNU General Public License or
 * other free or open source software licenses.
 */

defined( '_JEXEC' ) or die( 'Restricted access' ); ?>
<fieldset class="adminform">
		<legend><?php echo JText::_( 'Securing Uploaded files' ); ?></legend>
		<table class="admintable" cellspacing="1">
	
			<tbody>
				<tr>
					<td valign="top" class="key">
						<span class="editlinktip hasTip" title="<?php echo JText::_( 'Path to Uploaded files' ); ?>::<?php echo JText::_( 'For security purposes, it is CRITICAL that this directory is NOT accessible directly via the web. The easiest way to do this is to simply locate it OUTSIDE the web site root directory' ); ?>">
							<?php echo JText::_( 'Path to uploaded files' ); ?>
						</span>
					</td>
					<td>
						<input class="text_area" type="text" size="80" name="uploaded_files_path" 
							value="<?php echo ($this->item->uploaded_files_path ? $this->item->uploaded_files_path : JPATH_COMPONENT.DS.'uploadedfiles'.DS); ?>" />
							<?php 
								if($this->item->uploaded_files_path != JPATH_COMPONENT.DS.'uploadedfiles'.DS ){
									echo '<br />'.JText::_('Default value').': '.JPATH_COMPONENT.DS.'uploadedfiles'.DS ;
								}
								
							?>
								
					</td>
				</tr>
				<tr>
				<td colspan="2">
				<p><b>Security warning</b>: A lot of security measures have been taken to avoid malicious users to execute uploaded files, 
				however to increase security it is <b>CRITICAL</b> that this directory is <b>NOT</b> 
				 accessible directly via the web. The easiest way to do this is to simply locate it OUTSIDE the web site root directory 
				 (it is the folder that the main part of your URL -that is, the part up to the first single / - points to; for example, 
				 in http://your.domain.com/administrator/components/com_contact_enhanced/uploadedfiles, it is http://your.domain.com/). </p>
				 <p>But if you must have it in the web directory (and you are using Apache AND the web server configuration allows 
				 .htaccess files to restrict access to directories) then protect it by creating a file in the <em>uploadedfiles</em>
				 directory called <b>.htaccess</b>, containing these lines bellow or just renaming the htaccess.txt file located in that folder: </p>
<pre style="border-left:5px solid #7AC047; background-color:#F0F0F0;padding:5px 10px">order deny,allow 
deny from all </pre> 
				 <p>If you are using IIS, you need to edit the properties of the data directory 
				 (from the Internet Information Services Manager console) and deny access to that folder to everybody 
				 from the web (i.e., to the user IUSR_computername, where computername is the network name of the computer Joomla, 
				 and the data directory, are on). </p> 
				 <table style="background-color:#C3D2E5;border:3px solid #84A7DB" cellpadding="5" cellspacing="0">
				 	<tbody>
				 		<tr>
				 			<td> <p><strong>If you don't protect the data directory from direct web access, anybody can access
				 			and execute files uploaded by Contact Enhanced forms. If you do not allow your users to upload 
				 			executable files or scripts (exe,php,dll,...), you should not have any problem, however it is always good to be safe! :-)
				 			</strong> </p>
				 			</td>
				 		</tr>
				 	</tbody>
				 	</table>
				</td>
				</tr>
			</tbody>
		</table>
	</fieldset>