I have developed a site on joomla 2.5 and according to the audit report there are some issues with the website.I couldn't figure out some of them.
here are the issues.
Session does not expire - Make sure when you clicked on back button after logout, it should be redirect to home page instead of previous authenticated pages.
I have tried to set the login module to navigate the page to the homepage after a logout from the user.Now if the user clicks back he still sees the " edit " button for the article there but it won't work for him.Now the problem is that the audit wants me to stop the user from being able to use back button.
HTML Injection ( guest book) - unable to check because link goes to email id with html tag so please stop this html tag also before sending to anywhere.
There is a guest book for comments and the audit says the HTML Injection he does must be stopped.How do i strip the special characters from these textboxes so the HTML Injection is prevented ?
No Captcha Implementation – Please implement captcha on login page - - -
i have literally tried all of the things to get the CAPTCHA on the login page.Nothing works.The audit wants to stop the brute force attack.How do i stop the brute force attack on the login page ? The CAPTCHA is implemented on all other pages except for login.Don't know why Joomla doesn't provide the captcha facility for login.
Use encryption technique ( password ) - - -
isn't the password in the joomla encrypted before being sent over network ? if it is why isn't it being encoded for me ? if it is how do i encode it ?
Click jacking - Use X-Frame Option.Now what is this exactly ?
Improper Input Validation ( contact-us )
accepting special characters .How do i stop the special characters being added to the fields ? and stop HTML Injection ?
Again - doesn't joomla by default use a autocomplete=off for all the password fields ? how do i set autocomplete off for all of my password fields ?