Site preventing asset loading

The CMS Questions
1

I have this line in my htaccess which is default (nightly built).

RewriteRule ^(site|kirby|panel/app|panel/test)/.*$ - [NC,R=404]

Blocking site prevents me from loading plugin assets into the template (plugins folder is in the site folder). Let’s say I have a plugin that does this:

function my_plugin_function() {
    $root_js = kirby()->urls()->index() . '/site/plugins/my-plugin/assets' . DS . 'js' . DS;
    $html = '<script src="' . $root_js . 'my-plugin.js?time=' . time() . '"></script> ';
    return $html;
}

echo my_plugin();

That does not work for me. Are we not supposed to have assets in plugins? If so how?

Note

I don’t want to change my htaccess file. The plugin I’m about to make should work on more installations than mine.

2

No. :smiley:
The reason is that this could be a security risk because some plugin files might contain sensitive information and whitelisting is better than blacklisting in this case.

You can however use a route in your plugin that serves the file. Instead of using the real URL in your plugin function, you can use something like url('my-plugin/assets/my-plugin.js').

3

So the htaccess can be tricked by routes? I will probably try it out in a few days. Thanks!

4

It’s more of a controlled whitelisting. Your routes can contain custom logic and check for authorization for example. :wink: