Support

First, please let me quote our documentation.

---
I enabled this feature and now the front-end of my site asks me for a username and password?!

This is not a bug in Admin Tools, but a problem with one of the extensions (components, modules or plugins) you are using.

More specifically, Joomla! extensions are not supposed to load anything from the administrator area of your site in the front-end. However, some badly written extensions try to access static media files (CSS, Javascript, images) from directories inside the administrator directory. On notorious example is the Zoo CCK extension. Since all of the contents of your administrator directory are protected with a username/password, your browser will prompt you for one as soon as it is instructed to download a file from that protected directory or any of its subdirectories.

There are two workarounds:

1. Disable the administrator password protection. This degrades your site's security but is the easiest and most immediate change.

2. Consult the developer of the offending extension and explain to him that loading files from the administrator area of the component in the front-end of the site is insecure and he has to resolve this issue. Hopefully, developers will realize that this practice is unsafe and fix their software.

---

Now, let's get to your unreasonable claim. You say that it's "our problem" and we should "own it". You are wrong. Your problem originates from RocketTheme's Gantry. They are putting public files in the private administrator directory. If you enable password protection to the administrator directory -as you should for defense against brute force and fingerprinting- their template framework breaks. You do NOT need Admin Tools to trigger this incompatibility. You can delete Admin Tools completely, use your hosting control panel's directory password protection on the "administrator" folder and the issue is triggered.

Akeeba Ltd has not written your hosting control panel, is not your host and most definitely does now own RocketTheme. So how exactly are we supposed to own a problem that's completely unrelated to us?!! Are we "responsible" for this problem because our advice brought this third party issue to your attention? I don't think that shooting the messenger helps. You have a security issue here. We uncovered it but it's not ours to fix. It's RocketTheme's. You can either do something about it or you can sweep it under the rug and hope you don't get hacked (you will), but shouting at us is unproductive and, honestly, barking up the wrong tree.

Now to the technical reasons. You have this problem because RocketTheme IS NOT following Joomla's best practices which were first established in the year two thousand and seven (2007) with Joomla 1.5. These past eleven years Joomla, being aware of the security issues arising from loading files from the private administrator backend into your site's public frontend, has provided the "media" directory as a solution. All front-end, web accessible, static media files -which are not image files that originate from or can be replaced by the end user- are meant to be stored in a subdirectory of the media folder named after the extension they belong to. All image files which have originated by and can be replaced by the user are meant to be stored in the images folder, without any requirements for the organization of its subfolders. We, Akeeba Ltd, did not invent this rule. This was decided by the Joomla Core Team who was responsible for making Joomla 1.5 between 2005 and 2007. RocketTheme should know that because their owner was one of the people in that core team (going by the username "rhuk").

In other words, RocketTheme cannot claim ignorance on this matter. Their owner agreed that this is the best practice and put his name on it. Why he's not following the best practice he helped established is another story and one that's not for me to answer. I will only comment that even though I could also hire cheap Vietnamese labor and make millions every year out of my software without caring about the security and performance of my clients' sites I instead chose to keep the company small, hire expensive but really damn good developers and put my clients' sites' security and performance above profit.

In the end of the day it's your site and your choice: do you want to put security first or do you want to let a badly written template framework mandate that your private administrator folder should be publicly accessible by every miscreant just because its developer hasn't bothered to move files in eleven years? I would put security first and shout at the developer who's violating the Joomla best practices he helped established. Moving these files around is a day's work and that's it. I know this because back when Akeeba Backup was called JoomlaPack (Joomla! 1.0 days) I had my static media files in administrator. By the time I released a Joomla! 1.5-only version of my software I had moved everything to the media folder because that was -and still is- the Joomla! best practice for very real and important security reasons.

So, if you want me to own something it's that I will always put your site's security above anything else, especially third party software which doesn't follow Joomla's best practices (they are called "best practices" because they matter to the security of your site!). This is what you are paying me for and this is what I will deliver. Asking me to do anything else is unacceptable. I will never add a button which does nothing or, worse, has a default backdoor. An illusion of security is worse than no security at all.

Now please go ask RocketTheme why the heck they don't follow the Joomla best practice their owner helped establish 11 years ago.

This ticket will now be closed. We won't accept any further tickets from you about this issue. You are very well aware why it happens and what you need to do to either REALLY solve it or conveniently sweep it under the rug and hope you don't get hacked.