Questions tagged [security]

This tag is for Joomla-related security questions, and extension/template coding in order to prevent intrusion.

Filter by
Sorted by
Tagged with
1
vote
1answer
43 views

Security concern in Joomla .php: is define('_JEXEC', 1) safe to use?

I came across this on joomla.stackechange which has me concerned: "define('_JEXEC', 1) is a bad for security in the module. It allows people to use this file as an alternative entry point for ...
1
vote
1answer
63 views

Spam Emails and Web Host Security

Joomla 3.9.13 The past while i've been receiving a lot of emails with the subject line similar to; Subject: Warning: message 1iTQ2k-00083X-8c delayed 24 hours The email body contains the following, ...
1
vote
1answer
38 views

How to prevent spam registration?

Every month there are hundreds of malicious users (most of the registering emails are from some Russian domain) registering my site. This is mixed with scores of authentic users. I have already turned ...
0
votes
1answer
268 views

Unable to log in to Joomla! front-end

When attempting to log in using the standard Joomla! login page, the following message is displayed: Warning The security token did not match. The request was aborted to prevent any security ...
0
votes
1answer
25 views

Every time a user logins in they are automatically blocked

Every time a user logs in they are automatically blocked. When I enable them again they login once and it disables them again. It's making it impossible for my staff to get any work done. It's ...
4
votes
3answers
951 views

Akeeba BackUp: Is it safe to be used?

Following Artur Stępień's answer here: How to transfer a joomla content to another server?. Artur warned: Be aware that using components like Akeba Backup you open your website for potential ...
4
votes
1answer
1k views

Is it possible to load a newer jQuery version?

Is it possible to override the native JHtml::_('jquery.framework') loaded by Joomla, using some line of php? I understand I could replace this line in my template. But since I am using a template ...
1
vote
2answers
42 views

JED Checker - Rule Jamss - JAMSS - Joomla! Anti-Malware Scan Script

I am receiving an alert in JED Checker, the line of code that generates the alert contains str_replace which is used to replace of spaces with hyphens. Here the code: $uniqueFilter = array_unique($...
1
vote
1answer
16 views

Are Super User rights required to update Joomla?

We are trying to lock down the SuperUser in our application, and only assign it to 2 people. I have created a new group TIQAdmin that isn't a Super User, but has extensive rights in the back end. ...
0
votes
0answers
18 views

Joomla CHMOD index.php changed from outside

For some time I have had the issue that the file permissions for index.php in the root directory (and sometimes within /administrator folder as well) is automatically changed from 644 and so page ...
0
votes
0answers
34 views

Can I use JCE as frontend editor?

I am building a online forum using Stackidea's Easydiscuss. The build-in BBCode editor is quite outdated so I am thinking to use JCE as front-end editor for my users. I find it quite handy when doing ...
1
vote
1answer
29 views

Mixed content, no http:// in html

I'm not sure when this started happening, but I noticed today in Google Chrome (and subsequently in Firefox & IE) that my Joomla 3.9.20 site is causing a "Mixed content" warning. I ...
1
vote
0answers
16 views

Fabrik security issue: input tag attributes expose database table prefix

In the generated HTML for the input field, the id and name attributes shows the Joomla database table prefix. Exposing the database prefix is a security concern. Is there a way to prevent this? <...
5
votes
2answers
5k views

Generating static pages out of Joomla?

recently a friends company website that is using Joomla was hacked. Since keeping the website always up to date is not of any priority, it ran an outdated version and I'd assume it could happen again ...
2
votes
2answers
28 views

Is there a way to disable "silent" Joomla pages?

For example: index.php?option=com_contact&view=categories&lang=en Perhaps you have never used this contact component and there is no menu item created for it, yet for most Joomla websites ...
1
vote
0answers
21 views

Upload and attachement for phpmailer

hello i starting an code to allow sending file via a form i create an input file field <input type="file" name="'.$field_name.'[]" accept="'.$values_field[0].'" id="'.$field_id.'" '.$placeholder.' ...
0
votes
1answer
35 views

How to prevent "unvalidated redirects"?

I'm trying to harden a Joomla site (v3.9.13). The security team have raised an issue regarding redirects. They require that there should be a whitelist of addresses to which the website can redirect. ...
6
votes
1answer
463 views

Implement CSRF anti-spoofing using the Joomla Framework

I have used the methods described on this page in Joomla many times before: http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms Now I want to implement the same mechanism using the Joomla ...
6
votes
1answer
1k views

Using checkToken() to secure form posts

I am building a web app using the Jooma Framework and the Framework App as a template. I have getFormToken() working as described in this post and am now submitting the token with my form but I cannot ...
1
vote
1answer
2k views

Joomla Invalid token / Session timeout issue

I have a site that is implemented in Joomla 3.1.5 on which the following are installed http://www.joomlart.com/joomla/templates/ja-muzic --> This is the theme http://www.jomsocial.com/ --> Used ...
6
votes
2answers
761 views

How to generate a pseudo random one time use code for request token

To avoid CSRF attacks we use a security token and validate the request against the token. This could be achieved through, the below code to generate a token $link = JRoute::_('index.php?option=...
2
votes
1answer
4k views

Token check not working in custom component admin

I've built a custom component and have three forms that executes different tasks in the default.php view on subcontrollers within the administrator. Within my tmpl view default.php, each form has a &...
0
votes
1answer
29 views

Is it secure to work with JCE?

I read https://blog.sucuri.net/2019/10/throwback-threat-thursday-jce-vulnerability.html We use JCE and it is so WYSIWIG, i.e., easy for a user that have access to frontend. I am from the "light side"...
6
votes
2answers
957 views

Site Vulnerability Check

With the recent security announcement regarding SQL injection, I was wondering what I could do in order to 'review' my current Joomla sites, and ensure none of them have been compromised. Apart from ...
5
votes
3answers
1k views

Trying to Fix Hacked Site

My Joomla 3 site was recently hacked. Browsing to it with a common web browser works fine, but when you switch the user agent to a web crawler, it displays a spam page. How do I track down where the ...
4
votes
2answers
219 views

Joolma site Hacking suspected

Noticed in webmaster tools that my site may have been hacked. What is the best way to check if this is the case. I can see that there are some strange URL injections on my site? How do I find where ...
18
votes
3answers
965 views

How can I tell if a free template contains malware

I recently came across a site giving away good quality themes for free - but once downloaded it turned out that all the themes contained poorly concealed malware. Thankfully on this occasion my anti-...
2
votes
1answer
350 views

Email - is this possible

I created a Joomla 2.5 site (needs updated I know) for a client a while back, the site hasn't been maintained in quite a while. They contacted me today concerned about an email which was (thought to ...
1
vote
3answers
199 views

Joomla site hacked. Some visitors see spam content, while others see normally my site's real content

My website address is http://bethelrc.org Google is reporting it may be hacked, when I look at the file system, there are many unauthorized folders and files recently created. I deleted all these ...
10
votes
5answers
5k views

What to do if my Joomla website got hacked?

I have a Joomla 2.5 website. Yesterday I was not able to login administrator panel. I checked out users table. I was shocked when I saw that all the users' username field were 'admin' and passwords ...
0
votes
3answers
227 views

Joomla 3 and Google Security Issues - Security Issues

I have site on Joomla 3.6.2 Stable. In this week I get mail from google about "Security Issues". When I login to webmaster tools there was this message Hacked with spam A hacker may have ...
3
votes
1answer
61 views

What are the code changes for the Security patch vulnerability in 3.9.9

I am a total beginner in Joomla. I found that the security patch for the following vulnerability was fixed in 3.9.9: Filter attribute in subform fields allows remote code execution But I am not ...
5
votes
5answers
1k views

How to find the version of extensions used on a Joomla website without access to the backend?

First of all, I would like to check myself: An extension is an aggregate of modules, plugins and components, right? If that is right, then modules, plugins and components have the same versions. Is ...
0
votes
2answers
88 views

Export/Import from security perspective

Hi have two working scripts, one to backup a db field and the other one to restore that same db field. What i would like to know if from security perspective they are safe or what can be improved. ...
34
votes
9answers
1k views

How to secure a new Joomla installation?

What are the actions that one should take after a new Joomla installation in order to keep it secure? Both on shared hosting servers and dedicated ones.
2
votes
2answers
706 views

Using external PHP library and defined('_JEXEC') or die;

I want to use hatemile-for-php library (https://github.com/hatemile/hatemile-for-php) in my plugin. As I am only ever using this library within this one plugin, I included it in the plugin folder ...
3
votes
1answer
1k views

ModSecurity returns 403 forbidden in administrator article manager

I am getting 403 Forbidden messages in the Joomla 3.6.5 admin panel when I (as Super User) attempt to: Select any page from 2 to end Change the articles per page from the default 20 Search for an ...
4
votes
1answer
490 views

Site keeps browsing itself all the time

I run the server where this Joomla! site is hosted, so I have root access to it. There is something in the configuration, or somewhere in its code, that keeps browsing the site itself. If I run # ...
1
vote
3answers
211 views

Recurring MOD_SECURITY upon logging into the site admin page

My website has migrated from one hosting server to another. Since then, for the reason I am unsure about, when I try to log into my admin page the following error occurs. After getting stuck with it ...
0
votes
2answers
7k views

403 Forbidden Access, when accessing custom html/php files directly

I am trying to open html and php pages directly, but it shows : 403 Forbidden Access to this resource on the server is denied! When I try www.mysite.com/dir/ index page shows up, error ...
2
votes
2answers
2k views

Occasional 403 errors when saving articles

I have a strange error in Joomla backend. I get a forbidden error when trying to save article from certain custom component in Joomla it doesn't happen for all articles which baffles me a lot. I get ...
6
votes
3answers
7k views

User Login History

This may have ben asked elsewhere however I couldn't see it on JSE. Is it possible to view the user login history anywhere? I had a look through the database however couldn't find anything. Joomla 3....
0
votes
1answer
107 views

Joomla 3 temporary accounts [closed]

Developing a testing system as a diploma. Got a question. registration for users who will take the test should be avoided. I thought to create temporary accounts, which after the passage will be ...
3
votes
2answers
102 views

How to prevent Joomla's hidden links from being visited?

Some of Joomla's page can be visited even though there isn't any link to it on the site. One of the infamous examples is when some hacker visits the user registration link even though there isn't any ...
2
votes
2answers
271 views

Custom Component load data

I'm fairly new to Joomla and I'm taking over a project from a previous developer. In a custom component we are capturing user data in a form. Before the name and address is entered into the database ...
3
votes
1answer
569 views

Fake users created without using site registration form but still using overrides?

I am working with a Joomla 3.7.5 site. The registration scheme has always been admin activation from the start. Right now there is a constant deluge of fake Russian user accounts. They aren't getting ...
5
votes
2answers
519 views

Bypass password reset 'confirm' page

The standard Joomla password reset process takes three steps: Enter email address and request reset token Complete the 'confirm' page with username and reset token (either by copying the token from ...
3
votes
1answer
36 views

How to prevent directory access by a third party component?

In the Akeeba Backup docs, in the section "Securing the backup output directory" the following security recommendation is provided Using a well known location would allow an attacker exploiting a ...
2
votes
4answers
347 views

What to do with hacker attempts to guess my Admin Password and login in backend?

In all my Joomla sites, I find too many errors on the Logs/error.log like below: Joomla FAILURE: Username and password do not match or you do not have an account yet. I think this indicates ...
1
vote
1answer
166 views

How can I use Joomla's 'Escape' method if I'm using an abstract class to construct data?

Consider this code for instance: <?php echo MyLib::getSection($row);?> where MyLib: abstract class MyLib { public static function getSection($row) { return '<span title="$...