# \[Mobilizon\] re-enable protect\_against\_basic\_auth\_spoofing in package? **URL:** \ **Category:** Support apps\ **Tags:** mobilizon, english\ **Created:** [September 23, 2026, 5:17pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059 "2026-09-23T17:17:59Z")\ **Posts on this page:** 8\ **Page:** 6
**Author:** ![tmb](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/t/7c8e57/32.png) [@tmb](https://forum.yunohost.org/u/tmb)\ **Post date:** [October 23, 2026, 3:45pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/101 "2026-10-23T15:45:19Z")
Hello @otm33, I had also looked at your package admidio\_ynh, when looking for good examples before looking how the mobilizon\_ynh configs could be migrated. And I might have noticed something, at least when installing to the domain (root\_path): Seeing double slashes appearing in the URL (e.g. redirections to `sub.domain.tld//route/within/app`), I could manually work around that by removing the trailing slash from $g\_root\_path in `/var/www/admidio/adm_my_files/config.php`. However, that would seem not to work with ` __PATH__ ` in that template, so instead maybe add something like `#root_path_only rewrite ^/(.*)$ $1` to the nginx template, next to the `#sub_path_only` line? (if that works) ---
**Author:** ![otm33](https://forum.yunohost.org/user_avatar/forum.yunohost.org/otm33/32/11941_2.png) [@otm33](https://forum.yunohost.org/u/otm33)\ **Post date:** [October 23, 2026, 5:51pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/102 "2026-10-23T17:51:57Z")
> [@tmb](#): > > #root\_path\_only rewrite ^/(.\*)$ $1 Mmh… not sure it would act as expected : have you tested it ? ---
**Author:** ![otm33](https://forum.yunohost.org/user_avatar/forum.yunohost.org/otm33/32/11941_2.png) [@otm33](https://forum.yunohost.org/u/otm33)\ **Post date:** [October 23, 2026, 5:52pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/103 "2026-10-23T17:52:34Z")
A fix would be to remove the trailing slash from `$g_root_path` creating another var with `${domain}${path%/}` as value or using a condition but is it worth it since, afaik, there is no issue with the double slash in admidio and nginx merge\_slash setting? ---
**Author:** ![tmb](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/t/7c8e57/32.png) [@tmb](https://forum.yunohost.org/u/tmb)\ **Post date:** [October 23, 2026, 6:25pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/104 "2026-10-23T18:25:25Z")
Hm, I think your right, my quick rewrite idea may mangle correct URLs (but not tested). I can’t say for sure if it was the real cause, because it was one thing among others like altering the install order etc. and I also switched to a subdir install in the course of testing plugin installs, on the way to get rid of some access denied errors. Independent from that, I saw translations failing during plugin “install” (their first direct call from the browser, rather than later executions from within the app.) That, I imagined might be due to the “o-r” permissions on files like /var/www/admidio/src/Infrastructure/Language.php? If you agree that could be the reason, then I could re-check, that seems specific enough to test. ---
**Author:** ![tmb](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/t/7c8e57/32.png) [@tmb](https://forum.yunohost.org/u/tmb)\ **Post date:** [October 24, 2026, 11:23am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/105 "2026-10-24T11:23:47Z")
I think a doubled slash in the visual URL always gives a bad impression. Tested this now: The admidio plugin install translation file error does not happen after `chmod -R o+r /var/www/admidio`, and it’s dependent on the full path, i.e. the error still occurs with just: `chmod -R o+r /var/www/admidio/*` (Guess, with o+r permission, special care (permission) has to be used for confidential config files etc., never applying it as global as in this example. Maybe `ynh_config_add` does or should handle that.) For mobilizon I think the admidio package holds some interesting points: - The explicit permission setting can be removed from the package scripts (now handled by [\_ynh\_apply\_default\_permissions](https://github.com/YunoHost/yunohost/blob/28d691669c537a6616ca9c9b117672b72467341b/helpers/helpers.v2.1.d/0-utils#L252)). The “other users” permission problem does not apply to mobilizon, because it’s a standalone app behind reverse proxy. - The config file is managed by the package (config.exs) directly (written by ynh\_config\_add). So it should be possible to ship a templated mobilizon package file that does an `import_config` of a local admin file (which is not templated, and never overwritten, merely initialized once if not existing). - It uses `[resources.system_user] allow_email = true` which can be used to test emails with that user. (@rodinux do you remember particular problems with the old system user?) ---
**Author:** ![tmb](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/t/7c8e57/32.png) [@tmb](https://forum.yunohost.org/u/tmb)\ **Post date:** [October 24, 2026, 12:47pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/106 "2026-10-24T12:47:15Z")
> [@tmb](#): > > error does not happen after `chmod -R o+r /var/www/admidio` @otm33 Second thought: I think that is an upstream admidio issue: They should support plugin installs by calling them internally. No app should require hosting with public read/php-file execution rights for every file, correct? ---
**Author:** ![otm33](https://forum.yunohost.org/user_avatar/forum.yunohost.org/otm33/32/11941_2.png) [@otm33](https://forum.yunohost.org/u/otm33)\ **Post date:** [October 24, 2026, 1:04pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/107 "2026-10-24T13:04:58Z")
> [@tmb](#): > > Independent from that, I saw translations failing during plugin “install” (their first direct call from the browser, rather than later executions from within the app.) That, I imagined might be due to the “o-r” permissions on files like /var/www/admidio/src/Infrastructure/Language.php? What specific error are you referring to (context, logs) ? ---
**Author:** ![tmb](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/t/7c8e57/32.png) [@tmb](https://forum.yunohost.org/u/tmb)\ **Post date:** [November 4, 2026, 11:20pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/108 "2026-11-04T23:20:43Z")
> [@rodinux](#): > > needs a user `mobilizon\_notifs called “Mobilizon Notifications”, there was a reason I think to do this step to create the user or the mail did not match… I have not found yet a reason why the newer `[resources.system_user] allow_email = true` would not work. + It does not interfere with (list as) regular user accounts. + It’s a configurable app setting: [Customizing an app's email-address with new "resources" app-install-system? - #10 by tmb](https://forum.yunohost.org/t/customizing-an-apps-email-address-with-new-resources-app-install-system/43046/10) Sending is authenticated with username and its auto-generated password, and gets dkim signed. It seems to be set up only for sending by default (‘noreply’ bounce), but users can set it as alias and then mails are accepted (they can send and will receive). Or do you really know about a still current, or future (e.g. trixie) blocker? Doesn’t seem like mobiizon actually needs an own inbox imap account. [Previous page](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059.md?page=5)