Can attacker circumvent a htaccess 'deny from all' command

StackOverflow https://stackoverflow.com/questions/22275222

  •  11-06-2023
  •  | 
  •  

Question

I applied an htaccess file to the /administrator directory of a joomla website that is supposed to whitelist only my local ip address and my public ip address .

However, it appears that a new user account was created within that joomla account a couple of months after I applied the white list.

Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from 77.##.##.###

Can someone offer a theory on how this is possible?

Was it helpful?

Solution

Users can be created via front-end, even if you don't have a registration link or form there. Registration might be accessed by going to: index.php?option=com_users&view=registration

You can disable this option in Joomla back-end. To do so go to: System -> Global Configuration -> Users Manager and turn Allow User Registration to NO.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top