Questions tagged [security]

This tag is for Joomla-related security questions, and extension/template coding in order to prevent intrusion.

Filter by
Sorted by
Tagged with
33
votes
9answers
1k views

How to secure a new Joomla installation?

What are the actions that one should take after a new Joomla installation in order to keep it secure? Both on shared hosting servers and dedicated ones.
25
votes
8answers
16k views

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

In the past I’ve often run into trouble with permissions and ownership of Joomla files/directories on linux systems. Problems included Not being able to transfer files to the server using programs ...
19
votes
6answers
17k views

How to detect if user is Super User?

To determine whether the visitor is a guest, we use something like this : if ($user->guest) { echo 'Hello, guest!'; } Now, if i want to determine whether the visitor is a registered SuperUser (...
17
votes
3answers
11k views

Joomla tmp directory - What is it for and can I delete its content?

My Joomla website currently uses about 100 MB of storage. I checked my folders and found out that the tmp folder is about 30MB and contains a number of files and folders named like "...
16
votes
3answers
813 views

How can I tell if a free template contains malware

I recently came across a site giving away good quality themes for free - but once downloaded it turned out that all the themes contained poorly concealed malware. Thankfully on this occasion my anti-...
12
votes
7answers
2k views

Getting too many (flood) request, how can I block/reduce bot requests to my site?

We are using J3.2.3 on one of our client's website, which is an online casino website. The website is not live yet, as it is in development mode. Today we noticed that the server is too slow, though ...
9
votes
5answers
5k views

What to do if my Joomla website got hacked?

I have a Joomla 2.5 website. Yesterday I was not able to login administrator panel. I checked out users table. I was shocked when I saw that all the users' username field were 'admin' and passwords ...
9
votes
2answers
13k views

How to stop (fake) users from registering on my website?

I administer a website which does not require users to register. The only user that is needed is the Super User. The problem is that I found a large number of new registered users. First I want to ...
9
votes
3answers
651 views

Forbid direct access to INI and XML files

Some site owners don't want people, especially their competitors, know what features they have on their sites. Because some sensitive information in language or configuration files can be accessed ...
9
votes
3answers
9k views

Renaming of administrator directory

Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/...
7
votes
3answers
234 views

How to develop safe Joomla extension?

Before I'm going to write my first extension, I would like to understand how to design it as invulnerable as possible. Is there a set of rules to write safe Joomla extension? I can imagine only SQL ...
7
votes
2answers
14k views

How (re)set password for admin after migration from 1.5?

I migrated an old Joomla 1.5 site to a shiny new Joomla 3.3 version using the tool SP UPGRADE. Now I can't seem to login and I fear its because all the user passwords in the DB look like 'MD5':'Salt'...
7
votes
2answers
213 views

Is there any secure version of Joomla! 1.6 or 1.7 available?

Is there any secure version of the old Joomla! 1.6.x, or the 1.7.x series available?
6
votes
3answers
616 views

Input filtering an array of integers, words

This is one that has bugged me for several years now - Joomla provided JRequest, and then JInput to access filtered data from the incoming request. You can ask for filtered strings, integers, words ...
6
votes
3answers
6k views

User Login History

This may have ben asked elsewhere however I couldn't see it on JSE. Is it possible to view the user login history anywhere? I had a look through the database however couldn't find anything. Joomla 3....
6
votes
2answers
558 views

Site Vulnerability Check

With the recent security announcement regarding SQL injection, I was wondering what I could do in order to 'review' my current Joomla sites, and ensure none of them have been compromised. Apart from ...
6
votes
2answers
612 views

How to generate a pseudo random one time use code for request token

To avoid CSRF attacks we use a security token and validate the request against the token. This could be achieved through, the below code to generate a token $link = JRoute::_('index.php?option=...
6
votes
3answers
1k views

How can index.html be placed on my Joomla root folder?

My website was hacked. After investigation I found that it was because a hacked index.html was placed on my Joomla folder ( at the same level with index.php and configuration.php). I wonder how did ...
6
votes
1answer
3k views

Reverse SSL Proxy support

I would like to use nginx as a reverse proxy in front of a Joomla site running on Apache. I would like nginx to handle the SSL connections and relay decrypted traffic through localhost to Apache. ...
6
votes
1answer
378 views

Implement CSRF anti-spoofing using the Joomla Framework

I have used the methods described on this page in Joomla many times before: http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms Now I want to implement the same mechanism using the Joomla ...
6
votes
2answers
107 views

Unable to post SQL code as part of the article text

I've created a new Joomla site and trying to post a new article that contains SQL code. When ever I enter the text Declare @allowance decimal(18,2) and save the article I get the following error. ...
6
votes
1answer
979 views

Using checkToken() to secure form posts

I am building a web app using the Jooma Framework and the Framework App as a template. I have getFormToken() working as described in this post and am now submitting the token with my form but I cannot ...
5
votes
2answers
2k views

How did hackers manage to create a new user while “allow user registration” is set to “NO”?

Recently I find a new user is created on my 3.6.0 site and put into "administrator" group, but the "Allow User Registration" option is set to "NO", though the "enabled" and "Activated" status are both ...
5
votes
5answers
446 views

How to find the version of extensions used on a Joomla website without access to the backend?

First of all, I would like to check myself: An extension is an aggregate of modules, plugins and components, right? If that is right, then modules, plugins and components have the same versions. Is ...
5
votes
3answers
129 views

Stop robots from getting site/article content

This is not a question about indexers, most of them obey robots.txt file. But maybe you noticed publicized cases where Facebook or Skype followed URL's posted by users or which were sent via private ...
5
votes
2answers
132 views

It is safe to allow access to Joomla default Administrator user-group?

I need to allow access to an untrusted person to a site. I understand that the "Administrator" user-group is not allowed to upload or edit php files, install extensions, or any other stuff that ...
5
votes
1answer
165 views

Is there a good component to prevent dos attack or hacking for 3.X branch of Joomla?

I wonder if there is a good component to inspect my Joomla websites made on the 3.x branche. On dedicated servers Joomla directory structure is frequently attacked by eval code or file SQL injection. ...
5
votes
1answer
222 views

Code Inserted into Site

We received an e-mail notification from our web site last night telling us that a core Joomla file had been modified. Upon inspection, I found this code in our root/index.php file: if (isset($...
5
votes
2answers
62 views

Is my “hidden” page secured?

I want to create a page which someone can view only if he is registered and granted access to. For granting access to a user for i use a row in the #__users table named activated2. So i created a ...
5
votes
3answers
2k views

Force SSL on parts of my Joomla site

In Joomla 2.5 and/or 3, is it possible to enable SSL on certain pages? I am aware of the "Force SSL" option in global configuration, but I have a site with an e-store, and I would like to redirect ...
5
votes
2answers
606 views

How to avoid fake users to register my Joomla site [duplicate]

I have a Joomla site that allows users registration. Form registration uses captcha plugin that comes with Joomla. The problem is that I am constantly receiving fake registrations. Most of them, ...
5
votes
3answers
3k views

Change http to https in source code when using SSL

I recently enabled Force_SSL on one of my Joomla sites (by enabling "Force SSL" in Global Configuration), but I run into problems with blocked content (non-SSL content) from both Google fonts and ...
5
votes
2answers
273 views

Bypass password reset 'confirm' page

The standard Joomla password reset process takes three steps: Enter email address and request reset token Complete the 'confirm' page with username and reset token (either by copying the token from ...
4
votes
4answers
843 views

Akeeba BackUp: Is it safe to be used?

Following Artur Stępień's answer here: How to transfer a joomla content to another server?. Artur warned: Be aware that using components like Akeba Backup you open your website for potential ...
4
votes
3answers
932 views

Trying to Fix Hacked Site

My Joomla 3 site was recently hacked. Browsing to it with a common web browser works fine, but when you switch the user agent to a web crawler, it displays a spam page. How do I track down where the ...
4
votes
2answers
210 views

Joolma site Hacking suspected

Noticed in webmaster tools that my site may have been hacked. What is the best way to check if this is the case. I can see that there are some strange URL injections on my site? How do I find where ...
4
votes
2answers
37 views

Google Search's Nature Towards Joomla's Adminstrator Folder (and sub-folders)?

The files which are contained in Joomla's Admin Folder (and sub-folder)! Do they get listed in Google Search results ? or do we need to unlist them somehow (manually)? What about the Admin login page ?...
4
votes
1answer
790 views

Why doesn't the admin page for Joomla have https:// ssl encryption?

Is Joomla backend without https:// secure from hackers grabbing the password and login details? Can you get away without having an ssl certificate for a very basic site with no e-commerce or data ...
4
votes
2answers
790 views

You must provide at least one recipient email address (when saving Global Configuration)

This is somehow started happening recently on some Joomla 3.6.5 sites. Each time I save anything in the com_config - either on the global configuration, or a component's configuration, I am getting ...
4
votes
1answer
3k views

Generating static pages out of Joomla?

recently a friends company website that is using Joomla was hacked. Since keeping the website always up to date is not of any priority, it ran an outdated version and I'd assume it could happen again ...
4
votes
2answers
403 views

Can Joomla be brute-force attacked?

Just out of curiosity: Could a hacker write a script to brute-force the Joomla admin login by trying random usernames/passwords, or is there a limit as to how many times a user can try to log in? I'...
4
votes
1answer
175 views

Site keeps browsing itself all the time

I run the server where this Joomla! site is hosted, so I have root access to it. There is something in the configuration, or somewhere in its code, that keeps browsing the site itself. If I run # ...
4
votes
1answer
100 views

Are core extensions with old dates or version 3.0.0 obsolete?

I'm working on a current-version site that was original built with J!1.5.x (or even 1.0.x). There are many extensions with dates in the 2004-2007 range. I'm wondering if they're obsolete and can be ...
4
votes
1answer
394 views

How do you encrypt configuration data?

I am building a Joomla! 3.x component that connects to an API. The API settings are currently established in the component configuration. The configuration details are stored in plain text in the ...
3
votes
1answer
1k views

Index.html files – must these be present in every directory?

In addition to question about blank index.html files I would like to know: if the webserver is not configured properly, is it still a must to have index.html (empty or not) in every directory? For ...
3
votes
2answers
136 views

What do I need to do to be notified of any urgent security issues with Joomla?

Is there a mailing list somewhere specifically for this? None of the mailing lists on the official Joomla site seem to mention that. In my case, I just have one Joomla site to look after, so I'm only ...
3
votes
2answers
945 views

Filter strings before saving them in the database

I just created a script witch fetches mails from IMAP and stores the title and content in the database. Of course I don't want to save these information without a check; I'm a bit paranoid but I ...
3
votes
5answers
479 views

Manual update to Joomla 2.5.999 for 3.6.5 update

Joomla 3.6.5 is released today that includes a High Priority security fix that is affecting Joomla! 1.6.0 through 3.6.4. How can I apply the fix manually to Joomla 2.5.999 (PhilETaylor's unofficial ...
3
votes
3answers
1k views

Insert into database with ajax from a joomla 3 module

I have seen a lot of inquiries about ajax, but normally there are about retrieving data from database. I was wondering about how to insert data directly interacting inside a module. I have a module ...
3
votes
1answer
5k views

Permissions and Ownership

So everyone and there cat is on about permissions in the web folder structure. Popular question is the one about Recommended Practices. Great post and I understand the importance of setting 755 for ...