3

Some of Joomla's page can be visited even though there isn't any link to it on the site. One of the infamous examples is when some hacker visits the user registration link even though there isn't any login form on the site. For this we can turn off user registration, but what about other pages?

Some components may have some pages that anyone can visit if they are familiar with the component and know the URL.

This feels like a potential backdoor for malicious users. Is there a common way to prevent this or does this have to be dealt with on a case by case basis?

  • You should be checking for a non-guest user, right? or checking that the script is being called from the intended parent file, right? defined('_JEXEC') or die; – mickmackusa Sep 9 '18 at 22:57
  • It's not clear what exactly you want to prevent. You just don't want anyone to be able to reach at content using non-sef URLs, you are worried about security if someone using non-sef URLs, or you want to not allow direct access to php files? – FFrewin Sep 10 '18 at 12:34
  • I guess it's information disclosure. So that could be a security problem. – Eoin Sep 10 '18 at 23:42
1

defined('_JEXEC') or die; can be found at many, many php scripts in the Joomla framework to restrict the number and location of via entry points into your site/application.

https://docs.joomla.org/JEXEC

This is a very deliberate form of security for what you are describing. If you aren't baking this into your new scripts, then you should.

1

You can check your logs for the pages that you don't want visited, and then develop some .htaccess rules to block access to these pages (or redirect access to the pages to the homepage). The beauty of the .htaccess file is that you will have all this "blocking" logic in one place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.