The Joomla! Forum ™

Download

Demo


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  Page 1 of 1
  [ 14 posts ] 
  Print view Previous topic | Next topic 
Author Message
toubkal
PostPosted: Wed Aug 09, 2006 8:04 am 
User avatar
Joomla! Hero
Joomla! Hero
Offline

Joined: Thu Aug 18, 2005 4:35 pm
Posts: 2860
Location: Cheshire, England
I suggest that by default, joomla should not allow the user to change the template. This should be an option to turn on.

2 key reasons:

1) Many people choose to implement features in their template based on if ( $my->id )  etc

If a visitor simply accesses the site with e.g. index.php?jos_change_template=rhuk_solarflare_ii in the url

They will bypass the security implemented in the template.

Mostly people use it for simple things like hiding / showing a welcome message etc. but some may have implemented more significant access control via the template.

2) A malicious user could leave links around the net to someone's joomla site with e.g. jos_change_template=madeyourweb etc

They could do this deliberately to create google links to a person's site with the layout completely messed up, giving the impression of a poor site / unusable site  ( the intended site may use completely different module positions to those in the other templates )


I know that the joomla admin can delete all other templates but I do not think that most joomla admins would think to do this.

I have seen hoards of posts suggesting the use of  if ( $my->id )  etc but never once seen anyone warning that you can overide any such measure a simply as jos_change_template=rhuk_solarflare_ii in the url

_________________
Do you want the answer to be as vague as your question?
Top
 Profile  
 
brian
PostPosted: Wed Aug 09, 2006 8:12 am 
User avatar
Joomla! Exemplar
Joomla! Exemplar
Offline

Joined: Fri Aug 12, 2005 7:19 am
Posts: 8285
Location: Leeds, UK
I guess this is the same issue as unpublished components that could be accessed if you knew the url. I hadnt considered the security aspects of this with templates but you do make valid points

_________________
"Exploited yesterday... Hacked tomorrow"
Blog http://brian.teeman.net/
Joomla Hidden Secrets http://hiddenjoomlasecrets.com/
Top
 Profile  
 
eyezberg
PostPosted: Wed Aug 09, 2006 8:18 am 
User avatar
Joomla! Hero
Joomla! Hero
Offline

Joined: Thu Aug 25, 2005 5:48 pm
Posts: 2860
Location: Geneva mostly
Looks good though.. :)

I agree, it's the same as passing mosmsg via url.. can spoof sites and show things not inteded to be shown..


You do not have the required permissions to view the files attached to this post.

_________________
Sometimes one pays most for the things one gets for nothing.
The important thing is not to stop questioning. Curiosity has its own reason for existing. AE
http://joomla15.blog spot.com for J! 1.5 screenshots
http://www.eyezberg.com
Top
 Profile  
 
mallchin
PostPosted: Sun Dec 31, 2006 4:55 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Wed Mar 29, 2006 6:05 pm
Posts: 3
A couple of key security measures to note are:

Never put logic into templates (this is a real no-no)
Uninstall unused templates, modules, mambots and components

These are really quite important in maintaining a tight ship and would solve the points you mention.
Top
 Profile  
 
nuke2614
PostPosted: Sun Dec 31, 2006 3:01 pm 
I've been banned!
Offline

Joined: Sat Dec 30, 2006 12:54 pm
Posts: 18
toubkal wrote:
I suggest that by default, joomla should not allow the user to change the template. This should be an option to turn on.

2 key reasons:

1) Many people choose to implement features in their template based on if ( $my->id )  etc

If a visitor simply accesses the site with e.g. index.php?jos_change_template=rhuk_solarflare_ii in the url

They will bypass the security implemented in the template.


Mostly people use it for simple things like hiding / showing a welcome message etc. but some may have implemented more significant access control via the template.

2) A malicious user could leave links around the net to someone's joomla site with e.g. jos_change_template=madeyourweb etc

They could do this deliberately to create google links to a person's site with the layout completely messed up, giving the impression of a poor site / unusable site  ( the intended site may use completely different module positions to those in the other templates )


I know that the joomla admin can delete all other templates but I do not think that most joomla admins would think to do this.

I have seen hoards of posts suggesting the use of  if ( $my->id )  etc but never once seen anyone warning that you can overide any such measure a simply as jos_change_template=rhuk_solarflare_ii in the url



This should be a stickied post as it highlights the key part of security - conception. Simply not conceiving of a bad possibility!

I wouldn't doubt that a bad Google link could lead to Google cache poisoning where Google replaces its internal links to garbage, especially if the other site is popular.


Quote:
Posted by: mallchin
Insert Quote
A couple of key security measures to note are:

Never put Access Control/Permissionslogic into templates (this is a real no-no)

Uninstall unused templates, modules, mambots and components

These are really quite important in maintaining a tight ship and would solve the points you mention.


very good
point!


The sneaky thing is its SO EASY to forget about something as trivial as a template!
Top
 Profile  
 
mallchin
PostPosted: Sun Dec 31, 2006 7:05 pm 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Wed Mar 29, 2006 6:05 pm
Posts: 3
I tend to run through the security post to make sure my new sites are nailed down before I unleash them on the unsuspecting public  :laugh:

I got that tip from there.
Top
 Profile  
 
wolphin
PostPosted: Mon Jan 01, 2007 1:34 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Wed Aug 30, 2006 12:26 am
Posts: 12
On that note, it seems that the 1.0.11 to 1.0.12 update adds some files for the madeyourweb template.

If you've removed that template in the past you'll have to go manually remove those files.

They're just some images files and index.html files though, so nothing to worry about much.
Top
 Profile  
 
kiemchong
PostPosted: Thu Feb 22, 2007 12:35 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Thu Feb 22, 2007 12:06 am
Posts: 2
Hi there,

I have tested out my site with the following link http://www.mysite.com/index.php?jos_cha ... arflare_ii

And to my big surprise the whole template was changed. :o

I have read in earlier posts that joomla should not allow the user to change the template.
I also read that there were feature implemented in their template based on if ( $my->id )  etc.
It was also mentioned that you should never put logic into templates (this is a real no-no).

What can I do to solve my problem? I gues :os that I have to change something in my template html so I searched in my template html for ‘if ( $my- >id )’ and I couldn’t find it back.

I’m using the template designed by Dylan Mouratsing, called Bassnote. It is downloadable from
http://www.mamboportal.com/index.php?se ... ch&Itemid=

I hope someone can tell me what to do in order to prevent anyone from changing my template using index.php?jos_change_template=rhuk_solarflare_ii

Thanks in advance,
Top
 Profile  
 
niemothk
PostPosted: Thu Feb 22, 2007 12:54 am 
I've been banned!
Offline

Joined: Thu Jan 18, 2007 4:43 am
Posts: 151
You can try inserting this line below into your HTACCESS redirect rules
Quote:
RewriteCond %{QUERY_STRING} jos_change_template [OR]
*

Note that this will prevent you from changing your template in the front end!

You should still be able to set it as DEFAULT in the admin backend


or, perhaps more simply, just delete all other templates other than the one you are actually using.
Top
 Profile  
 
kiemchong
PostPosted: Thu Feb 22, 2007 1:14 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Thu Feb 22, 2007 12:06 am
Posts: 2
Hi Niemothk,

Thanx for responding my post.

I'm planning to do the first option which is inserting the line.
My question: Is the htaccess redirect rules the same as the .htaccess folder in my root.
If yes, should I insert it like this:
#RewriteCond %{QUERY_STRING} jos_change_template [OR]#

If not, where can I find this htaccess redirect rules folder or file?
Top
 Profile  
 
niemothk
PostPosted: Thu Feb 22, 2007 1:49 am 
I've been banned!
Offline

Joined: Thu Jan 18, 2007 4:43 am
Posts: 151
no.

Since Joomla 1.011, there have been certain rules added to the HTACCESS file that deflects many or most of the hacking attempts.

The following is a snippet of the actual file:
Quote:
########## Begin - Rewrite rules to block out some common exploits
## If you experience problems on your site block out the operations listed below
## This attempts to block the most common type of exploit `attempts` to Joomla!
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a

Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Who is online

Users browsing this forum: No registered users and 5 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group