Skip to main content

Questions tagged [security]

This tag is for Joomla-related security questions, and extension/template coding in order to prevent intrusion.

Filter by
Sorted by
Tagged with
2 votes
1 answer
30 views

Factory::getApplication()->input->getFloat('name') returns 5 for ".5"

Factory::getApplication()->input->getFloat('name') doesn't like decimal numbers that start with a period. For example, ".5" returns the number 5 instead of .5. Looking at the docs, it'...
Jimmy's user avatar
  • 327
1 vote
1 answer
95 views

What is the variable live_site in configuration.php for?

The advice for the value of $live_site in configuration.php is often in Joomla forum an empty string represented by two single quotation marks. For example here: https://forum.joomla.org/viewtopic.php?...
astridx's user avatar
  • 449
1 vote
1 answer
50 views

Which line should PHP files in Joomla start with?

I know, that the first line in PHP Files is because of security reasons. I read it here: https://docs.joomla.org/Why_do_most_of_the_Joomla!_PHP_files_start_with_defined(%27_JEXEC%27)%3F But in the ...
agi's user avatar
  • 313
2 votes
2 answers
109 views

Is insertObject sanitizing the inputs?

Let's suppose I want to insert a new record into a table. Let's suppose that the table is of the structure of mytable(id, my_text); So, for example, we are to insert a new record, I would like to ...
Lajos Arpad's user avatar
1 vote
1 answer
29 views

Joomla 4 Security: Is it worth tracking attacks for the Joomla team?

Shortly after I (finally) managed to upgrade to Joomla 4 my development site was taken down by an attack. (I dont' know how exactly yet). Is it worth my time to work out how this happened? How would ...
Huw Evans's user avatar
  • 371
4 votes
0 answers
37 views

How to make "Two Factor Authentication" mandatory for all admin users

I had enabled "two factor authentication" on a site with the Google Authentication Plugin, but discovered that an old administrator was still logging in to the admin. It turns out that if ...
Piero Marsilio's user avatar
1 vote
2 answers
3k views

Joomla 3.10.x SQL Injection XSS Vulnerability

I have a website setup on my infrastructure that is running Joomla 3.10.8. During a security audit, certain SQL injection vulnerabilities / XSS have been identified. The setup includes a bunch of ...
onlinejava's user avatar
0 votes
0 answers
131 views

How to encrypt and decrypt User data in joomla

I am new to joomla, and working on joomla application which is currently running on production environment. Application contains 1000+ registered users. As per GDPR Policy, I have requirement for ...
Akoli's user avatar
  • 1
1 vote
0 answers
369 views

Joomla 3.9 CORS error

I'm trying to allow CORS on my website but I can't get it to work. I've seen many posts about this, from updating .htacces, httpd.conf, meta tags, and php headers, but nothing worked. I always get a ...
Brian's user avatar
  • 11
1 vote
2 answers
237 views

Security concern in Joomla .php: is define('_JEXEC', 1) safe to use?

I came across this on joomla.stackechange which has me concerned: "define('_JEXEC', 1) is a bad for security in the module. It allows people to use this file as an alternative entry point for ...
Bold's user avatar
  • 123
2 votes
1 answer
570 views

How to prevent spam registration?

Every month there are hundreds of malicious users (most of the registering emails are from some Russian domain) registering my site. This is mixed with scores of authentic users. I have already turned ...
shenkwen's user avatar
  • 1,389
0 votes
2 answers
73 views

Every time a user logins in they are automatically blocked

Every time a user logs in they are automatically blocked. When I enable them again they login once and it disables them again. It's making it impossible for my staff to get any work done. It's ...
Eoin's user avatar
  • 1,909
1 vote
2 answers
54 views

JED Checker - Rule Jamss - JAMSS - Joomla! Anti-Malware Scan Script

I am receiving an alert in JED Checker, the line of code that generates the alert contains str_replace which is used to replace of spaces with hyphens. Here the code: $uniqueFilter = array_unique($...
Leoalv's user avatar
  • 167
1 vote
1 answer
45 views

Are Super User rights required to update Joomla?

We are trying to lock down the SuperUser in our application, and only assign it to 2 people. I have created a new group TIQAdmin that isn't a Super User, but has extensive rights in the back end. ...
paljoomla's user avatar
0 votes
0 answers
19 views

Joomla CHMOD index.php changed from outside

For some time I have had the issue that the file permissions for index.php in the root directory (and sometimes within /administrator folder as well) is automatically changed from 644 and so page ...
MadDorris's user avatar
1 vote
1 answer
39 views

Mixed content, no http:// in html

I'm not sure when this started happening, but I noticed today in Google Chrome (and subsequently in Firefox & IE) that my Joomla 3.9.20 site is causing a "Mixed content" warning. I ...
Jimmy's user avatar
  • 327
1 vote
0 answers
24 views

Fabrik security issue: input tag attributes expose database table prefix

In the generated HTML for the input field, the id and name attributes shows the Joomla database table prefix. Exposing the database prefix is a security concern. Is there a way to prevent this? <...
Kailash Singh's user avatar
2 votes
2 answers
30 views

Is there a way to disable "silent" Joomla pages?

For example: index.php?option=com_contact&view=categories&lang=en Perhaps you have never used this contact component and there is no menu item created for it, yet for most Joomla websites ...
shenkwen's user avatar
  • 1,389
1 vote
0 answers
52 views

Upload and attachement for phpmailer

hello i starting an code to allow sending file via a form i create an input file field <input type="file" name="'.$field_name.'[]" accept="'.$values_field[0].'" id="'.$field_id.'" '.$placeholder.' ...
user2822359's user avatar
4 votes
1 answer
3k views

Is it possible to load a newer jQuery version?

Is it possible to override the native JHtml::_('jquery.framework') loaded by Joomla, using some line of php? I understand I could replace this line in my template. But since I am using a template ...
TVBZ's user avatar
  • 213
0 votes
1 answer
40 views

How to prevent "unvalidated redirects"?

I'm trying to harden a Joomla site (v3.9.13). The security team have raised an issue regarding redirects. They require that there should be a whitelist of addresses to which the website can redirect. ...
Rachel's user avatar
  • 101
1 vote
1 answer
103 views

Spam Emails and Web Host Security

Joomla 3.9.13 The past while i've been receiving a lot of emails with the subject line similar to; Subject: Warning: message 1iTQ2k-00083X-8c delayed 24 hours The email body contains the following, ...
jonboy's user avatar
  • 3,603
0 votes
1 answer
39 views

Is it secure to work with JCE?

I read https://blog.sucuri.net/2019/10/throwback-threat-thursday-jce-vulnerability.html We use JCE and it is so WYSIWIG, i.e., easy for a user that have access to frontend. I am from the "light side"...
kokbira's user avatar
  • 153
3 votes
1 answer
65 views

What are the code changes for the Security patch vulnerability in 3.9.9

I am a total beginner in Joomla. I found that the security patch for the following vulnerability was fixed in 3.9.9: Filter attribute in subform fields allows remote code execution But I am not ...
IBrito's user avatar
  • 33
5 votes
5 answers
2k views

How to find the version of extensions used on a Joomla website without access to the backend?

First of all, I would like to check myself: An extension is an aggregate of modules, plugins and components, right? If that is right, then modules, plugins and components have the same versions. Is ...
Elvin's user avatar
  • 153
0 votes
2 answers
443 views

Unable to log in to Joomla! front-end

When attempting to log in using the standard Joomla! login page, the following message is displayed: Warning The security token did not match. The request was aborted to prevent any security ...
Michael Yaeger's user avatar
2 votes
2 answers
1k views

Using external PHP library and defined('_JEXEC') or die;

I want to use hatemile-for-php library (https://github.com/hatemile/hatemile-for-php) in my plugin. As I am only ever using this library within this one plugin, I included it in the plugin folder ...
astridx's user avatar
  • 449
4 votes
1 answer
608 views

Site keeps browsing itself all the time

I run the server where this Joomla! site is hosted, so I have root access to it. There is something in the configuration, or somewhere in its code, that keeps browsing the site itself. If I run # ...
Lucio Crusca's user avatar
0 votes
1 answer
113 views

Joomla 3 temporary accounts [closed]

Developing a testing system as a diploma. Got a question. registration for users who will take the test should be avoided. I thought to create temporary accounts, which after the passage will be ...
Илья Балабуев's user avatar
3 votes
2 answers
133 views

How to prevent Joomla's hidden links from being visited?

Some of Joomla's page can be visited even though there isn't any link to it on the site. One of the infamous examples is when some hacker visits the user registration link even though there isn't any ...
shenkwen's user avatar
  • 1,389
3 votes
1 answer
38 views

How to prevent directory access by a third party component?

In the Akeeba Backup docs, in the section "Securing the backup output directory" the following security recommendation is provided Using a well known location would allow an attacker exploiting a ...
NivF007's user avatar
  • 2,097
3 votes
1 answer
681 views

Fake users created without using site registration form but still using overrides?

I am working with a Joomla 3.7.5 site. The registration scheme has always been admin activation from the start. Right now there is a constant deluge of fake Russian user accounts. They aren't getting ...
claywhipkey's user avatar
5 votes
2 answers
587 views

Bypass password reset 'confirm' page

The standard Joomla password reset process takes three steps: Enter email address and request reset token Complete the 'confirm' page with username and reset token (either by copying the token from ...
John Rix's user avatar
  • 551
2 votes
4 answers
438 views

What to do with hacker attempts to guess my Admin Password and login in backend?

In all my Joomla sites, I find too many errors on the Logs/error.log like below: Joomla FAILURE: Username and password do not match or you do not have an account yet. I think this indicates ...
shenkwen's user avatar
  • 1,389
1 vote
1 answer
232 views

How can I use Joomla's 'Escape' method if I'm using an abstract class to construct data?

Consider this code for instance: <?php echo MyLib::getSection($row);?> where MyLib: abstract class MyLib { public static function getSection($row) { return '<span title="$...
Glitch's user avatar
  • 287
1 vote
2 answers
645 views

Is it possible to encrypt the database password in the Joomla configuration file?

Is it possible to encrypt the database password in the Joomla configuration file? Example : change public $password = 'xxxxxx'; by : $password = hash;
Adil houssam's user avatar
2 votes
2 answers
2k views

Occasional 403 errors when saving articles

I have a strange error in Joomla backend. I get a forbidden error when trying to save article from certain custom component in Joomla it doesn't happen for all articles which baffles me a lot. I get ...
user2293554's user avatar
2 votes
2 answers
308 views

Custom Component load data

I'm fairly new to Joomla and I'm taking over a project from a previous developer. In a custom component we are capturing user data in a form. Before the name and address is entered into the database ...
chavab_1's user avatar
  • 195
-1 votes
2 answers
102 views

Joomla Website affected with Malware [duplicate]

My website has been blocked by google because it thinks it's been affected by malware. When I run scans they don't show anything. How can I detect what's wrong? My sites always get affected with ...
Faheem Rasheed's user avatar
3 votes
1 answer
1k views

ModSecurity returns 403 forbidden in administrator article manager

I am getting 403 Forbidden messages in the Joomla 3.6.5 admin panel when I (as Super User) attempt to: Select any page from 2 to end Change the articles per page from the default 20 Search for an ...
Gillian Steedman's user avatar
2 votes
1 answer
66 views

Joomla's default server-side validation

I want to know that if the Joomla's (3.6.5) default server-side validation (for forms' fields) is secure enough to rely on it only? In other words, is it necessary to make changes to Joomla's server-...
user avatar
5 votes
2 answers
748 views

How to avoid fake users to register my Joomla site [duplicate]

I have a Joomla site that allows users registration. Form registration uses captcha plugin that comes with Joomla. The problem is that I am constantly receiving fake registrations. Most of them, ...
jstuardo's user avatar
  • 171
1 vote
3 answers
248 views

Recurring MOD_SECURITY upon logging into the site admin page

My website has migrated from one hosting server to another. Since then, for the reason I am unsure about, when I try to log into my admin page the following error occurs. After getting stuck with it ...
Will Kim's user avatar
  • 203
4 votes
2 answers
1k views

You must provide at least one recipient email address (when saving Global Configuration)

This is somehow started happening recently on some Joomla 3.6.5 sites. Each time I save anything in the com_config - either on the global configuration, or a component's configuration, I am getting ...
FFrewin's user avatar
  • 19.7k
3 votes
5 answers
587 views

Manual update to Joomla 2.5.999 for 3.6.5 update

Joomla 3.6.5 is released today that includes a High Priority security fix that is affecting Joomla! 1.6.0 through 3.6.4. How can I apply the fix manually to Joomla 2.5.999 (PhilETaylor's unofficial ...
webchun's user avatar
  • 2,418
2 votes
2 answers
94 views

Finding a clean version of extensions during Joomla! migration?

I'm working with a set of Joomla! installations that has been infected by malware and have to clean them up as soon as possible. I'm not used to working with Joomla!. The sites have been badly managed,...
Thomas Doyle's user avatar
0 votes
1 answer
115 views

Do I need to worry about unauthorized users with registered accounts?

I just updated my site to 3.6.4 and in doing some maintenance noticed that there were unauthorized users added to the site to the registered users group. I was able to delete the users without a ...
nizz0k's user avatar
  • 537
5 votes
2 answers
2k views

How did hackers manage to create a new user while "allow user registration" is set to "NO"?

Recently I find a new user is created on my 3.6.0 site and put into "administrator" group, but the "Allow User Registration" option is set to "NO", though the "enabled" and "Activated" status are both ...
shenkwen's user avatar
  • 1,389
0 votes
1 answer
114 views

Security Alternative to updating to 3.6.4

I cannot update to Joomla version 3.6.4 because core files have been changed. I am stuck at 3.4.6 I still want to protect against the vulnerabilities mentioned in https://www.joomla.org/announcements/...
Kater89's user avatar
0 votes
3 answers
236 views

Joomla 3 and Google Security Issues - Security Issues

I have site on Joomla 3.6.2 Stable. In this week I get mail from google about "Security Issues". When I login to webmaster tools there was this message Hacked with spam A hacker may have ...
user19291's user avatar
  • 101