Unpublished Login Module generates login & reminder pgs - Joomla! Forum - community, help and support


during risk assessment outside agency, discovered our joomla 3.x website generate login , reminder pages on these urls of

https://. . ./index.php?option=com_users&view=login"
http://. . ./index.php?option=com_users&view=login"
https://. . ./index.php/component/users/?view=login"
http://. . ./index.php/component/users/?view=login"

it happens when view=reset or view=remind
example reset
- /index.php?option=com_users&view=reset"
- /index.php/component/users/?view=reset"
example remind
- /index.php?option=com_users&view=remind"
- /index.php/component/users/?view=remind"

i checked extension manager, , login module unpublished because site not have login abilities included.

is there way or setting prevent these urls working?

so far have come redirecting these urls page (like home page).

those pages can blocked renaming or removing view folders in /components/com_users/views:
    login
    registration
    remind
    reset
your template(s) may have overrides these views in html folder, example:
/templates/mytemplate/html/com_users/login/default.php , should make unavailable.

keep in mind if next joomla update includes 1 or more of folders in /components/com_users, views may restored because part of joomla core.





Comments

Popular posts from this blog

Joomla 3.3 Installation Error message - Joomla! Forum - community, help and support

Multilanguage infinite redirect loop error. - Joomla! Forum - community, help and support

trim media limit reached