Support

Admin Tools

#10203 Issues with secret URL...

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Friday, 06 January 2012 14:50 CST

user50301
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yep
Have I searched the forum before posting? Yep
Have I read the documentation before posting (which pages?)? Yep
Joomla! version: 1.7.3
PHP version: (unknown)
MySQL version: (unknown)
Host: (optional, but it helps us help you)
Admin Tools version: 2.2.a1


Description of my issue:
So after getting my first attempted login with bogus administrator credentials, I decided to implement the secret URL functionality. The issue that I've seen is that that then "breaks" the administrator back-end because Joomla isn't smart enough to append the secret word onto it's own URLs.

For instance before the secret URL, to get to admin tools would be a URL like:

"website.com/administrator/index.php?option=com_admintools"

If you implement the secret URL and you go to:

"website.com/administrator/index.php?secretword"

you can log in just fine, but the back-end URLs remain the same. So any attempts to use links in the back-end, end up sending me to my homepage and I get the email with "Reason: Admin Query String"

It would be really nice to have admin tools automatically "fix" all of the backend URLs so that any link in Joomla has the secret word appended correctly..so the links function properly.

nicholas
Akeeba Staff
Manager
You only get this problem if your session times out while you are in the back-end. This shouldn't normally happen, unless you leave your back-end page open for a very long time (default: over 15 minutes) without doing anything. In this case, you can always increase your session lifetime.

Please note that having Admin Tools add the secret URL parameter in any other page except the back-end login page could have dire consequences, depending on the word you use. For instance, if your secret word is foobar and one of the extensions uses foobar to pass some critical data from one view to the next, this would result in Admin Tools OVERRIDING this data with a null value. The results? At best, a crash. At worse, it could wipe out valuable data from your site. Are you sure you'd like to take your chances? I certainly wouldn't take my chances with that!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!