Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

This tag is for Joomla-related security questions, and extension/template coding in order to prevent intrusion.

33
votes
9answers
1k views

How to secure a new Joomla installation?

What are the actions that one should take after a new Joomla installation in order to keep it secure? Both on shared hosting servers and dedicated ones.
9
votes
5answers
5k views

What to do if my Joomla website got hacked?

I have a Joomla 2.5 website. Yesterday I was not able to login administrator panel. I checked out users table. I was shocked when I saw that all the users' username field were 'admin' and passwords ...
9
votes
2answers
13k views

How to stop (fake) users from registering on my website?

I administer a website which does not require users to register. The only user that is needed is the Super User. The problem is that I found a large number of new registered users. First I want to ...
25
votes
8answers
15k views

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

In the past I’ve often run into trouble with permissions and ownership of Joomla files/directories on linux systems. Problems included Not being able to transfer files to the server using programs ...
7
votes
2answers
13k views

How (re)set password for admin after migration from 1.5?

I migrated an old Joomla 1.5 site to a shiny new Joomla 3.3 version using the tool SP UPGRADE. Now I can't seem to login and I fear its because all the user passwords in the DB look like 'MD5':'Salt'...
19
votes
6answers
16k views

How to detect if user is Super User?

To determine whether the visitor is a guest, we use something like this : if ($user->guest) { echo 'Hello, guest!'; } Now, if i want to determine whether the visitor is a registered SuperUser (...
6
votes
3answers
609 views

Input filtering an array of integers, words

This is one that has bugged me for several years now - Joomla provided JRequest, and then JInput to access filtered data from the incoming request. You can ask for filtered strings, integers, words ...
17
votes
3answers
11k views

Joomla tmp directory - What is it for and can I delete its content?

My Joomla website currently uses about 100 MB of storage. I checked my folders and found out that the tmp folder is about 30MB and contains a number of files and folders named like "...
9
votes
3answers
9k views

Renaming of administrator directory

Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/...
5
votes
3answers
3k views

Change http to https in source code when using SSL

I recently enabled Force_SSL on one of my Joomla sites (by enabling "Force SSL" in Global Configuration), but I run into problems with blocked content (non-SSL content) from both Google fonts and ...
6
votes
2answers
544 views

Site Vulnerability Check

With the recent security announcement regarding SQL injection, I was wondering what I could do in order to 'review' my current Joomla sites, and ensure none of them have been compromised. Apart from ...
4
votes
4answers
841 views

Akeeba BackUp: Is it safe to be used?

Following Artur Stępień's answer here: How to transfer a joomla content to another server?. Artur warned: Be aware that using components like Akeba Backup you open your website for potential ...
4
votes
2answers
210 views

Joolma site Hacking suspected

Noticed in webmaster tools that my site may have been hacked. What is the best way to check if this is the case. I can see that there are some strange URL injections on my site? How do I find where ...
4
votes
3answers
922 views

Trying to Fix Hacked Site

My Joomla 3 site was recently hacked. Browsing to it with a common web browser works fine, but when you switch the user agent to a web crawler, it displays a spam page. How do I track down where the ...
9
votes
3answers
629 views

Forbid direct access to INI and XML files

Some site owners don't want people, especially their competitors, know what features they have on their sites. Because some sensitive information in language or configuration files can be accessed ...
6
votes
1answer
369 views

Implement CSRF anti-spoofing using the Joomla Framework

I have used the methods described on this page in Joomla many times before: http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms Now I want to implement the same mechanism using the Joomla ...
4
votes
1answer
3k views

Generating static pages out of Joomla?

recently a friends company website that is using Joomla was hacked. Since keeping the website always up to date is not of any priority, it ran an outdated version and I'd assume it could happen again ...
1
vote
0answers
47 views

Joomla search filter tool bar - attempt to assign property of non-object line 428 [duplicate]

In my view.html.php I set UserState Variables. One of this variables will be set like this: $app->setUserState('com_mycomponent.modelname'.'.filter.status', 1); In the layout default.php I have ...
16
votes
3answers
807 views

How can I tell if a free template contains malware

I recently came across a site giving away good quality themes for free - but once downloaded it turned out that all the themes contained poorly concealed malware. Thankfully on this occasion my anti-...
1
vote
1answer
914 views

Site gets hacked and everytime a new user is created with Admin rights

We are facing a weird problem. We have a site set-up in Joomla. The site is getting hacked on a regular basis and specifically during the weekends. The strange thing is, we see that a new user is ...
1
vote
3answers
593 views

Conditional CHMOD values

I have been having troubles with the attackers attacking to my Joomla sites. They create some php files which are encoded with base64 algorithm in the directories of which chmod values are 774 or ...