How to prevent access to component/users/?view=registration in Joomla 2.5?

Question

How can access to component/users/?view=registration be restricted or disabled? Someone attempted to hack a client's website by going directly to domain.com/component/users/?view=registration and register as a user. The only reason this why caught was their e-mail address bounced back cause their mailbox was full. This specific Joomla 2.5 website doesn't have a login module displayed on the screen. Also, /administrator is already .htaccess password protected.

Is there a way to shutdown somewhere within Joomla to disable users from registration so component/users/?view=registration don't work? Or should component/users/?view=registration itself be password protected with .htaccess? Thanks!

Answer 1

Yes, there is. In the back-end, navigate to Users > User Manager. When loaded, click the options button from the sub-menu. The first option in the Component tab is a radio to allow or not allow user registration.

Now, when someone (or some bot) attempts to navigate directly to user registration they are automatically redirected to a dedicated log in page. Which, without an account is pretty much useless.

You could also inset 301 redirects into your root .htaccess for any URL paths and route them back to the home page.

Redirect 301 /index.php?option=com_users&view=registration http://www.mywebsite.com/

Answer 2

Add to .htaccess file rows:

RewriteEngine On
## Redirect from LOGIN PAGE to INDEX page:
RewriteCond %{REQUEST_URI} /component/users [NC]
RewriteCond %{QUERY_STRING} view=login [NC]
RewriteRule .* https://yoursite.ru/? [R=301,L]

RewriteCond %{REQUEST_URI} /component/users [NC]
RewriteRule .* https://yoursite.ru/? [R=301,L]

RewriteCond %{REQUEST_URI} / [NC]
RewriteCond %{QUERY_STRING} option=com_users&view=login [NC]
RewriteRule .* https://yoursite.ru/? [R=301,L]

Source: https://skalolaskovy.ru/joomla/500-htaccess-301-redirect-with-parametr

Answer 3

In my register view I wrote this line

if ( $_GET['option']=='com_users' && $_GET['view']=='register'){
    $app = JFactory::getApplication(); 
    $link = JRoute::_('index.php?option=com_users&view=login'); 
    $msg = JText::_('Registration not allowed'); 
    $app->redirect($link, $msg, 'warning');
}

Although it works but not correct way to do this as I think.