Forbid direct access to INI and XML files

Question

Some site owners don't want people, especially their competitors, know what features they have on their sites.

Because some sensitive information in language or configuration files can be accessed directly from browser, eg.

administrator/components/com_bank/language/en-GB/en-GB.com_bank.ini
administrator/components/com_bank/config.xml
components/com_bank/models/forms/transaction.xml

Although only technical people know about Joomla can figure out these links, access them and find out (or guess) what the features the site has, however the site owners want everything to be secret.

So is there any server side solution or any Joomla extension to forbid direct access to these INI and XML files?

Answer 1

Put this directive inside your .htaccess file:

<FilesMatch ".(ini|xml)$">
  order allow,deny
  deny from all
</FilesMatch>

Answer 2

You can extend the .htaccess file of Joomla with a RewriteRule for there file types.

A simple one could be

RewriteRule \.xml$ index.php [L]
RewriteRule \.ini$ index.php [L]

these rules checks if the end of the request is ".xml" or ".ini" and rewrites the request to index.php. the [L] means last rule.

You should put this in the section

## Begin - Custom redirects

Answer 3

A Joomla extension would be the wrong approach since Joomla isn't involved when you directly access files on the server.

You can achieve what you want easily with .htaccess or in your server config. Something like this should do the trick:

<Files  ~ "\.xml$">
  Order allow,deny
  Deny from all
</Files>

Taken from http://www.ducea.com/2006/07/21/apache-tips-tricks-deny-access-to-certain-file-types/