Support

Quick question: I changed some settings in htaccess Maker which blocked the site. I have reverted to the standard Joomla htaccess file, so the site is ok, but the problem is that I have forgotten which settings I changed, and I stupidly did not note them down.

Is there someplace where the default settings are listed so that I can regenerate the AdminTools htaccess file with the default settings, rather than go through and try every setting?

Also, the latest Joomla update now recommends a bunch of changes to htaccess (see below). Are they included in the AdminTools-generated htaccess, or do I need to add them manually?

Thanks,

Matt

htaccess Update Concerning Directory Listings

Since version 3.9.22

Before 3.9.22 the default htaccess.txt file contained erroneous code meant for disabling directory listings. The security team recommends to manually apply the necessary changes to any existing .htaccess file, as this file can not be updated automatically.

The old code:

<IfModule autoindex>
  IndexIgnore *
</IfModule>

The new code:

<IfModule mod_autoindex.c>
  IndexIgnore *
</IfModule>

Hide this message Additional XSS protection for the usage of SVG files

Since version 3.9.21

Since 3.9.21 Joomla is shipped with an additional security rule in the default htaccess.txt. This rule will protect users of svg files from potential Cross-Site-Scripting (XSS) vulnerabilities.
The security team recommends to manually apply the necessary changes to any existing .htaccess file, as this file can not be updated automatically.

Changes for .htaccess

<FilesMatch "\.svg$">
  <IfModule mod_headers.c>
    Header always set Content-Security-Policy "script-src 'none'"
  </IfModule>
</FilesMatch>

Currently we are not aware of a method to conditionally configure this on IIS web servers, please contact your hosting provider for further assistance.

Hide this message Updated Text Filter Recommendations

Since version 3.9.19

As part of our security team's review, we have made some changes to the default settings for the global text filters in a new Joomla installation. The default setting for the 'Public', 'Guest' and 'Registered' groups is now 'No HTML'. As these changes are only applied to new installations, we strongly recommend that you review these changes and update your site from: System -> Global Configuration -> Text Filters

Hide this message .htaccess & web.config Security Update

Since version 3.9.3

Joomla is now shipped with additional security hardenings in the default htaccess.txt and web.config.txt files. These hardenings disable the so called MIME-type sniffing feature in web browsers. The sniffing leads to specific attack vectors, where scripts in normally harmless file formats (eg images) will be executed, leading to Cross-Site-Scripting vulnerabilities.

The security team recommends to manually apply the necessary changes to existing .htaccess or web.config files, as those files can not be updated automatically.

Changes for .htaccess
Add the following lines before "## Mod_rewrite in use.":

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</IfModule>

Changes for web.config
Add the following lines right after "</rewrite>":

<httpProtocol>
  <customHeaders>
    <add name="X-Content-Type-Options" value="nosniff" />
  </customHeaders>
</httpProtocol>

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.