0

I have a Joomla 3 site. It works fine, but I found out that it can display contents for invalid links for example i tried something like this:

http://mysite/1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16

and I did not get "The requested page can't be found.", instead I got one of the pages in the website. Also i tried writing words instead of numbers and it worked.

so I was wondering how can i force checking the urls.

PS: my joomla version is 3.4.3

Any help is highly appreciated.

  • Are you using any SEF extensions, plugins or modules? If yes, which ones? – TryHarder Sep 2 '15 at 23:04
  • Do you get the same page every time you enter an invalid URL, or does the content vary? – johanpw Sep 2 '15 at 23:52
  • I enabled SEF urls in SEO settings in global configuration, I did not add any extension at all. – user5844 Sep 3 '15 at 17:15
  • Also the contents vary based on what you enter. I noticed that the last number is actually the ID of the page being displayed. – user5844 Sep 3 '15 at 17:16
  • www.my-stie.com/12, www.my-stie.com/12abcdefgh, www.my-stie.com/12-abcdefgh all point to article with ID:12. Which is weird. – pl71 Nov 13 '16 at 17:34
0

According to the enabled SEF mode, Joomla router translates the Url in different ways.

If the router can get a valid route, it shows a page and the rest of the url is discarded or converted to parameters to a components. In practice, these extra parameters could not be used.

If an Url cannot be routed to a component, then it is an invalid Url and an error is shown. Otherwise, there is no way to know what parameters are valid or not for each extension.

In fact, there is no need of this extra processing overhead. Joomla shows valid Urls (generated via Joomla router). If there are invalid Urls, they have been generated by mistake or by an external actor, like spammers redirecting traffic. In any case, the router can only show the right content or discard the rest of the Url (for safety).

  • Thanks for the reply. Do you know of a way to force valid URLs only? The reason is that it seems some spammers used links containing words like: mobile, www, etc which targeted my site. Because of that google webmaster tools reported that some pages might be performing a fishing attack on users so that site started getting blocked. I spent all yesterday checking the website for any changes or abnormal access, or the fishing pages, and could not find anything that is unusual except for the fact that joomla is accepting these links. – user5844 Sep 3 '15 at 17:18
  • Joomla has nothing to do with invalid Urls published in third-party sites. It cannot prevent spammers creating forged links around Internet. However, if your site is compromised, it could be having a part in a fishing attack. In that case, Google blocks your site. – Anibal Sep 3 '15 at 17:47
  • Hi there Anibal... It seems most likely a false positive due to some bot trying to use different urls on the site. Regardless of that, I changed all the passwords in cpanel, made sure no email forwards are there, checked the accounts to make sure no account was added or modified, checked the website using VirusTotal which returned 1/63. Apparently only BitDefender out of the 63 thinks the site is for malware, while google thinks it is a fishing site. Regardless of that I modified .htaccess to prevent links with ~ symbol although they don't show fishing pages. What other checks should i do? – user5844 Sep 3 '15 at 22:20
  • Beyond malware and virus detection, you can compare core and extensions files to detect changes. – Anibal Sep 4 '15 at 6:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.