3

Changes for security patches are normally hidden further down in the commit history or sometimes in the actual release commit to throw people off. In this case, the security patch is in the release commit, which you can see here: https://github.com/joomla/joomla-cms/commit/d34a3ecd2d00a3a5119ac0fadadab7f7211e145b?fbclid=IwAR2nh9DBeoMd_DHS-aL-...


3

As @Sharky said, you can check the extension versions by accessing their manifest files. Here are the path of those files for each type of extension : Component : ../administrator/components/com_extension_name/extension_name.xml Module : ../modules/mod_extension_name/mod_extension_name.xml Plugin : ../plugins/plugin_type/extension_name/extension_name....


3

I do not see this as a Joomla issue (except the .htaccess file in Joomla root). From the small part of the log you provided in your question we can clearly read that the requests are made by mod_pagespeed and Serf as client. There is not really a question about it. The log identifies this user-agent info (Serf used by pagespeed). You cannot just simply avoid ...


3

If you're not an administrator of the site, you can't have this information in full. If you know which extensions are installed, you can check their versions by accessing their manifest files. For example, you can find out Joomla! version by accessing administrator/manifests/files/joomla.xml file. The closest you can get to finding out which extensions are ...


3

Your first line of defense is your hosting service Lease a dedicated server from a reliable hosting service Ensure that you activate 2FA on your server and use a 'VERY STRONG' password Install a reliable firewall on your server - I use ConfigServer Install / Configure an anti-virus program, I use ClamAV Ensure that each website username does NOT use the 1st ...


2

It’s a good question and a bad question at the same time. Why? Good, because the question sounds ‘exotic’ for many many Joomla users/superusers. Why this small line of code is there everywhere like the coca-cola of Joomla. :) 'Nobody' understands why it works that much. defined('_JEXEC') or die('gooo to hell!'); The question is bad because in the Joomla ...


2

the extension is an aggregate of modules, plugins and components? A extension, is not the combination of a component, module and plugin. This is what a package is Plugins, Modules, Components, Templates are all types of extensions. So if I'm right, than modules, plugins and components have the same versions. Is it also true? No. They're all separate, ...


1

As Sharky says, if you don't have administrator access to the database, the best way to find out this information is from the publicly accessible files on the website such as the xml manifest files. The security on some websites does not permit you to view these files so this method is not always reliable. Even when you do have access to the manifest files, ...


1

* Update * I posted this answer and then later checked the answers by Sharky and later, Neil Roberts, saying the .xml files are available. I tested this on one of my sites, so I was very surprised that this information is available and I will have to do something about that. I have left my original answer here for general reference and voted up the Answers ...


1

There is a good video from Joomla World Conference 2016 on a presentation of Namespaces by Jisse Reitsma that around the 23 minute mark goes into an example that eventually describes a situation where you would not use Jexec in your code so that it can be shared with other platforms like Wordpress/Magento, https://www.youtube.com/watch?v=Dyx05GR4Bms With a ...


1

If you are creating a test questionnaire page where visitors fill out test questions as guests and submit their answers, then the whole process is usually handled by secure session/user/csrf tokens which is (created and) submitted together with their filled out tests Forms. The questionnaire Form should include fields like name, email address and CSRF form ...


1

Sometimes it helps (as a troubleshooting step at least) to disable mod_security. With many hosts, this can be done by adding the following code to your .htaccess file: <IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule> See https://stackoverflow.com/a/12928404/1983389 for more details.


1

As at Joomla 3.9.0, there is a new "User Actions Log" included in the Joomla core which tracks logins, extension updates and extension configuration updates, for example. Remember to enable the appropriate user actions plugins for this to work.


Only top voted, non community-wiki answers of a minimum length are eligible