Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

This tag is for Joomla-related security questions, and extension/template coding in order to prevent intrusion.

0
votes
1answer
28 views

Unable to log in to Joomla! front-end

When attempting to log in using the standard Joomla! login page, the following message is displayed: Warning The security token did not match. The request was aborted to prevent any security ...
2
votes
2answers
119 views

Using external PHP library and defined('_JEXEC') or die;

I want to use hatemile-for-php library (https://github.com/hatemile/hatemile-for-php) in my plugin. As I am only ever using this library within this one plugin, I included it in the plugin folder ...
4
votes
1answer
157 views

Site keeps browsing itself all the time

I run the server where this Joomla! site is hosted, so I have root access to it. There is something in the configuration, or somewhere in its code, that keeps browsing the site itself. If I run # ...
-1
votes
1answer
98 views

Joomla 3 temporary accounts [closed]

Developing a testing system as a diploma. Got a question. registration for users who will take the test should be avoided. I thought to create temporary accounts, which after the passage will be ...
3
votes
2answers
34 views

How to prevent Joomla's hidden links from being visited?

Some of Joomla's page can be visited even though there isn't any link to it on the site. One of the infamous examples is when some hacker visits the user registration link even though there isn't any ...
4
votes
1answer
33 views

How to prevent directory access by a third party component?

In the Akeeba Backup docs, in the section "Securing the backup output directory" the following security recommendation is provided Using a well known location would allow an attacker exploiting a ...
3
votes
1answer
269 views

Fake users created without using site registration form but still using overrides?

I am working with a Joomla 3.7.5 site. The registration scheme has always been admin activation from the start. Right now there is a constant deluge of fake Russian user accounts. They aren't getting ...
6
votes
2answers
238 views

Bypass password reset 'confirm' page

The standard Joomla password reset process takes three steps: Enter email address and request reset token Complete the 'confirm' page with username and reset token (either by copying the token from ...
3
votes
4answers
123 views

What to do with hacker attempts to guess my Admin Password and login in backend?

In all my Joomla sites, I find too many errors on the Logs/error.log like below: Joomla FAILURE: Username and password do not match or you do not have an account yet. I think this indicates ...
1
vote
1answer
72 views

How can I use Joomla's 'Escape' method if I'm using an abstract class to construct data?

Consider this code for instance: <?php echo MyLib::getSection($row);?> where MyLib: abstract class MyLib { public static function getSection($row) { return '<span title="$...
1
vote
2answers
347 views

Is it possible to encrypt the database password in the Joomla configuration file?

Is it possible to encrypt the database password in the Joomla configuration file? Example : change public $password = 'xxxxxx'; by : $password = hash;
2
votes
2answers
692 views

Occasional 403 errors when saving articles

I have a strange error in Joomla backend. I get a forbidden error when trying to save article from certain custom component in Joomla it doesn't happen for all articles which baffles me a lot. I get ...
2
votes
2answers
223 views

Custom Component load data

I'm fairly new to Joomla and I'm taking over a project from a previous developer. In a custom component we are capturing user data in a form. Before the name and address is entered into the database ...
-1
votes
2answers
88 views

Joomla Website affected with Malware [duplicate]

My website has been blocked by google because it thinks it's been affected by malware. When I run scans they don't show anything. How can I detect what's wrong? My sites always get affected with ...
3
votes
1answer
826 views

ModSecurity returns 403 forbidden in administrator article manager

I am getting 403 Forbidden messages in the Joomla 3.6.5 admin panel when I (as Super User) attempt to: Select any page from 2 to end Change the articles per page from the default 20 Search for an ...
1
vote
1answer
49 views

Joomla's default server-side validation

I want to know that if the Joomla's (3.6.5) default server-side validation (for forms' fields) is secure enough to rely on it only? In other words, is it necessary to make changes to Joomla's server-...
6
votes
2answers
587 views

How to avoid fake users to register my Joomla site [duplicate]

I have a Joomla site that allows users registration. Form registration uses captcha plugin that comes with Joomla. The problem is that I am constantly receiving fake registrations. Most of them, ...
1
vote
3answers
76 views

Recurring MOD_SECURITY upon logging into the site admin page

My website has migrated from one hosting server to another. Since then, for the reason I am unsure about, when I try to log into my admin page the following error occurs. After getting stuck with it ...
5
votes
2answers
757 views

You must provide at least one recipient email address (when saving Global Configuration)

This is somehow started happening recently on some Joomla 3.6.5 sites. Each time I save anything in the com_config - either on the global configuration, or a component's configuration, I am getting ...
4
votes
5answers
475 views

Manual update to Joomla 2.5.999 for 3.6.5 update

Joomla 3.6.5 is released today that includes a High Priority security fix that is affecting Joomla! 1.6.0 through 3.6.4. How can I apply the fix manually to Joomla 2.5.999 (PhilETaylor's unofficial ...
3
votes
2answers
73 views

Finding a clean version of extensions during Joomla! migration?

I'm working with a set of Joomla! installations that has been infected by malware and have to clean them up as soon as possible. I'm not used to working with Joomla!. The sites have been badly managed,...
0
votes
1answer
102 views

Do I need to worry about unauthorized users with registered accounts?

I just updated my site to 3.6.4 and in doing some maintenance noticed that there were unauthorized users added to the site to the registered users group. I was able to delete the users without a ...
6
votes
2answers
2k views

How did hackers manage to create a new user while “allow user registration” is set to “NO”?

Recently I find a new user is created on my 3.6.0 site and put into "administrator" group, but the "Allow User Registration" option is set to "NO", though the "enabled" and "Activated" status are both ...
0
votes
1answer
110 views

Security Alternative to updating to 3.6.4

I cannot update to Joomla version 3.6.4 because core files have been changed. I am stuck at 3.4.6 I still want to protect against the vulnerabilities mentioned in https://www.joomla.org/announcements/...
0
votes
3answers
203 views

Joomla 3 and Google Security Issues - Security Issues

I have site on Joomla 3.6.2 Stable. In this week I get mail from google about "Security Issues". When I login to webmaster tools there was this message Hacked with spam A hacker may have ...
1
vote
3answers
152 views

Joomla site hacked. Some visitors see spam content, while others see normally my site's real content

My website address is http://bethelrc.org Google is reporting it may be hacked, when I look at the file system, there are many unauthorized folders and files recently created. I deleted all these ...
1
vote
1answer
217 views

Why is Norton blocking access to my site?

A client is on my case because Norton won't let him (and apparently a few of his customers) see the site. The following report is produced: I'm familiar with Joomla expoits and have cleaned up many ...
0
votes
2answers
240 views

Sitelock Found High Priority Security Issue Joomla 3.5.1

My server is running Sitelock Pro which has identified a high priority security vulnerability. I am using Joomla 3.5.1. They have reported the following as a potential CGI Generic SQL Injection Issue. ...
0
votes
2answers
3k views

403 Forbidden Access, when accessing custom html/php files directly

I am trying to open html and php pages directly, but it shows : 403 Forbidden Access to this resource on the server is denied! When I try www.mysite.com/dir/ index page shows up, error ...
5
votes
1answer
3k views

Generating static pages out of Joomla?

recently a friends company website that is using Joomla was hacked. Since keeping the website always up to date is not of any priority, it ran an outdated version and I'd assume it could happen again ...
1
vote
2answers
248 views

Access Denied, what am I overlooking?

Working with Joomla 3.5.1 and having an issue with pages that I've restricted to a certain permission. I send out a Newsletter that has roughly 15 stories. The first 5 are always public, but the ...
1
vote
1answer
246 views

Unable to Access Backend - Masked for frontend

It has been awhile since I went in and updated one of the sites I manage. The problem: When I go to the backend of my site (/administrator), it is simply a mask for the front-end. So when I go to ...
1
vote
1answer
211 views

Did my site get hacked?

I am seeing this error on front page of one of my website Parse error: syntax error, unexpected '< Some code has been hidden for security* but the source of that error is index.php. On ...
1
vote
1answer
914 views

Site gets hacked and everytime a new user is created with Admin rights

We are facing a weird problem. We have a site set-up in Joomla. The site is getting hacked on a regular basis and specifically during the weekends. The strange thing is, we see that a new user is ...
1
vote
1answer
360 views

Joomla - Upgrade Version 3.2.3 to 3.4.7

Recently, we have done Penetration testing for our Joomla site and came across below Vulnerabilities Joomla Core Remote Code Execution Vulnerability Solution : Upgrade to version 3.4.6 Reference: ...
1
vote
0answers
27 views

How can I make the Botscout feature work in the EasyCalcCheck+ security plugin?

I'm using EasyCalcCheck+ to beef up security on a Joomla site. In general it works well, adding a random math question to contact forms and registration. ECC+ also has options that enable ...
5
votes
1answer
100 views

Are core extensions with old dates or version 3.0.0 obsolete?

I'm working on a current-version site that was original built with J!1.5.x (or even 1.0.x). There are many extensions with dates in the 2004-2007 range. I'm wondering if they're obsolete and can be ...
3
votes
2answers
136 views

What do I need to do to be notified of any urgent security issues with Joomla?

Is there a mailing list somewhere specifically for this? None of the mailing lists on the official Joomla site seem to mention that. In my case, I just have one Joomla site to look after, so I'm only ...
1
vote
1answer
564 views

Media component reporting 'Possible IE XSS Attack'

I'm trying to upload two images to Joomla using the Media component, but one of the images will not upload and generates a notice - Possible IE XSS Attack found. The notice is generated in Firefox,...
6
votes
2answers
128 views

It is safe to allow access to Joomla default Administrator user-group?

I need to allow access to an untrusted person to a site. I understand that the "Administrator" user-group is not allowed to upload or edit php files, install extensions, or any other stuff that ...
4
votes
3answers
921 views

Trying to Fix Hacked Site

My Joomla 3 site was recently hacked. Browsing to it with a common web browser works fine, but when you switch the user agent to a web crawler, it displays a spam page. How do I track down where the ...
6
votes
1answer
165 views

Is there a good component to prevent dos attack or hacking for 3.X branch of Joomla?

I wonder if there is a good component to inspect my Joomla websites made on the 3.x branche. On dedicated servers Joomla directory structure is frequently attacked by eval code or file SQL injection. ...
0
votes
1answer
3k views

Sucuri detect 404javascript.js It's really a security issue?

Sucuri reports an alert about a suspect malicious code on 3 different Joomla sites. One of them is now blacklisted only by Mcafee and not by Google, Norton, Bitdefender and so on. On Virustotal ...
6
votes
2answers
544 views

Site Vulnerability Check

With the recent security announcement regarding SQL injection, I was wondering what I could do in order to 'review' my current Joomla sites, and ensure none of them have been compromised. Apart from ...
5
votes
1answer
220 views

Code Inserted into Site

We received an e-mail notification from our web site last night telling us that a core Joomla file had been modified. Upon inspection, I found this code in our root/index.php file: if (isset($...
4
votes
4answers
841 views

Akeeba BackUp: Is it safe to be used?

Following Artur Stępień's answer here: How to transfer a joomla content to another server?. Artur warned: Be aware that using components like Akeba Backup you open your website for potential ...
1
vote
1answer
451 views

Cannot log into Joomla Admin backend

One of my site was on Joomla 3.4.4. Certainly i can not log into the administrator. Despite using the correct credentials, the page just refreshes and does nothing. I checked my File manager and i ...
9
votes
2answers
13k views

How to stop (fake) users from registering on my website?

I administer a website which does not require users to register. The only user that is needed is the Super User. The problem is that I found a large number of new registered users. First I want to ...
1
vote
2answers
371 views

Email notifications when users logging in to the administrator site

I would like to be notified via email when someone is logging-in to Joomla Administration interface as Superuser, and also know his ip address. Is it possible?
0
votes
1answer
181 views

Joomla and security: detect vulnerability after infection [closed]

After several infections on Joomla we have decided to change to static content (it will require less administration time, and we just change one page per day). However, we would like to know how ...