9

Some site owners don't want people, especially their competitors, know what features they have on their sites.

Because some sensitive information in language or configuration files can be accessed directly from browser, eg.

administrator/components/com_bank/language/en-GB/en-GB.com_bank.ini
administrator/components/com_bank/config.xml
components/com_bank/models/forms/transaction.xml

Although only technical people know about Joomla can figure out these links, access them and find out (or guess) what the features the site has, however the site owners want everything to be secret.

So is there any server side solution or any Joomla extension to forbid direct access to these INI and XML files?

12

Put this directive inside your .htaccess file:

<FilesMatch ".(ini|xml)$">
  order allow,deny
  deny from all
</FilesMatch>
  • Thank you! The result of this is a 403 forbidden error "Forbidden You don't have permission to access ... on this server." – Hung Tran Apr 23 '14 at 10:40
6

You can extend the .htaccess file of Joomla with a RewriteRule for there file types.

A simple one could be

RewriteRule \.xml$ index.php [L]
RewriteRule \.ini$ index.php [L]

these rules checks if the end of the request is ".xml" or ".ini" and rewrites the request to index.php. the [L] means last rule.

You should put this in the section

## Begin - Custom redirects
  • I tried this and the result was my homepage with no CSS styles loaded. – Hung Tran Apr 23 '14 at 10:38
  • Do your css files ends with xml or ini?! – Harald Leithner Apr 23 '14 at 10:41
  • They are not, Their extension is .css. I tested with a fresh Joomla installation. – Hung Tran Apr 23 '14 at 10:44
3

A Joomla extension would be the wrong approach since Joomla isn't involved when you directly access files on the server.

You can achieve what you want easily with .htaccess or in your server config. Something like this should do the trick:

<Files  ~ "\.xml$">
  Order allow,deny
  Deny from all
</Files>

Taken from http://www.ducea.com/2006/07/21/apache-tips-tricks-deny-access-to-certain-file-types/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.