Support

Admin Tools

#10104 Admin Tools Pro advice please

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Saturday, 26 November 2011 02:27 CST

thierry.seal
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the forum before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: (1.5.25)
PHP version: (unknown)
MySQL version: (unknown)
Host: (optional, but it helps us help you)
Admin Tools version: (2.1.11)


Description of my issue: I do not have an issue but would be grateful for some advise to make sure of my understanding of the document. I have recently installed Admin Tools Pro and what a treat it is. I came across two issues when I created the .htaccess from the Admin Tools section. One module (google weather) and one plugin (gallery - sigplus) would not load. After some trial and error (as advised in docs) I set Server Protection - Front End Protection to No. This resolved my issues as both plugin and module now work. Not content with this I set Front End Protection back to Yes and have added two lines in the Exceptions - Allow direct access, including .php files, to these directories. Each line is the folder that conatins the php files of the module and/or plugin. This worked. So my question is, have I done this correctly in relation to not compromising my website. Hope the above makes sense and thank you in advance for you advice.

nicholas
Akeeba Staff
Manager
Hi!

Even though what you tried works, I think it's a bit too broad of an exception. Let me explain this.

Assume that you have a module called mod_foobar which requires direct access to the file modules/mod_foobar/baz.php. You can directly allow that specific file and it's more or less fine. Or, you can allow access to the entire modules/mod_foobar directory. The latter approach means that if an attacker uploads a file in that directory, he'll be able to access it through the web, essentially circumventing the front-end protection. With the former approach, even if he does upload a malicious file, it won't be accessible over the web, so the attacker will leave empty handed.

Therefore, if you see that only specific files are required to be excluded, only exclude the specific files. If you see files with random names or dynamically generated files, first consider using a software which doesn't require direct access to such files or, only if that's not possible, allow direct access to an entire directory. You can never be too cautious!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

thierry.seal
That has helped - many thanks for your time to respond.

nicholas
Akeeba Staff
Manager
You're welcome!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!