0

I have developed a site on joomla 2.5 and according to the audit report there are some issues with the website.I couldn't figure out some of them.

here are the issues.

Session does not expire - Make sure when you clicked on back button after logout, it should be redirect to home page instead of previous authenticated pages.

I have tried to set the login module to navigate the page to the homepage after a logout from the user.Now if the user clicks back he still sees the " edit " button for the article there but it won't work for him.Now the problem is that the audit wants me to stop the user from being able to use back button.

HTML Injection ( guest book) - unable to check because link goes to email id with html tag so please stop this html tag also before sending to anywhere.

There is a guest book for comments and the audit says the HTML Injection he does must be stopped.How do i strip the special characters from these textboxes so the HTML Injection is prevented ?

No Captcha Implementation – Please implement captcha on login page - - -

i have literally tried all of the things to get the CAPTCHA on the login page.Nothing works.The audit wants to stop the brute force attack.How do i stop the brute force attack on the login page ? The CAPTCHA is implemented on all other pages except for login.Don't know why Joomla doesn't provide the captcha facility for login.

Use encryption technique ( password ) - - -

isn't the password in the joomla encrypted before being sent over network ? if it is why isn't it being encoded for me ? if it is how do i encode it ?

Click jacking - Use X-Frame Option.Now what is this exactly ?

Improper Input Validation ( contact-us )

accepting special characters .How do i stop the special characters being added to the fields ? and stop HTML Injection ?

Again - doesn't joomla by default use a autocomplete=off for all the password fields ? how do i set autocomplete off for all of my password fields ?

Improve this question
3
  • Please ask your questions one at a time (as separate questions) and also provide the exact formulation from your report / give more context.
    – Valentin Despa
    Jan 21, 2015 at 21:14
  • agreed^^....If you ask each of these as separate questions with more details and possibly giving your own insight to the question, then that would be great. It will also help other users who are searching for similar question in the future
    – Lodder
    Jan 22, 2015 at 8:39
  • i though that would be flooding with different posts and the admin might delete them or something
    – Faheem Rasheed
    Jan 24, 2015 at 22:42

1 Answer 1

Reset to default
1

Suggestions on some of questions...

Subscribe and install Admin Tools Pro

It has a simple firewall that blocks brute force attacks on log in. It also adds extra input validation, but I do not know, if that would satisfy your audit as it only checks inputs for a number of specific issues and I do not understand what exactly your audit means with HTML injection. Check the Admin Tools online documentation, if it blocks the specific issue.

Use HTTPS

Encrypting the password on log in form is useless without HTTPS to protect the page from tampering and redundant if you use HTTPS since everything is encrypted anyway. If you have audits, you should do the bother of setting up the proper certificates and then force use of SSL on the site. In some cases using SSL is only necessary for administration.

autocomplete

The fields do seem to support turning autocomplete off (see /libraries/joomla/form/fields/password.php and the variable $auto), but I am not sure if particular components and forms have that setting available. But if you want it on everywhere and are using a version of Joomla that is no longer updated, you can edit the file I pointed out to have it always add this attribute. No guarantees if it will work. (No Joomla available for testing right now...)

Improve this answer
4
  • firstly , Thank you for taking time to answer me.
    – Faheem Rasheed
    Jan 24, 2015 at 22:43
  • i Have used the admin tools.it doesnt work as i want it to.it should restrict login say after 3 unsuccesful attempts or say load a captcha the forth time
    – Faheem Rasheed
    Jan 24, 2015 at 22:43
  • SSL is not required for the site.actually whenthe user logins in from the front end of the site the password is sent as a simple plain text as the user enters it across the network to the server.The password must be encrypted before being sent over.thats the concern of the auditor.
    – Faheem Rasheed
    Jan 24, 2015 at 22:45
  • i checked the autocomplete variable - its $auto = ((string) $this->element['autocomplete'] == 'off') ? ' autocomplete="off"' : ''; it should be working.but it isn't
    – Faheem Rasheed
    Jan 24, 2015 at 22:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.