security bug?

[itvienna]

Hi,

I have created a menu item which points to my gallery made with your component. If I click the gallery everything is ok so long as I do not protect my administration section with a .htaccess file.
If my administration section (website/administrator/) is protected with a .htaccess file, my gallery on the frontend also requires to be authenticated to see the gallery. It requires the same login data that I am using to get access to my backend section.

I used public as access level for the gallery.

did someone experience the same problems?

I checked some websites that use the admiror gallery component, unfortunately non of them protect the administration section.

I need to fix this before I get my website online.

Can you please help me?

thanks in advance

[Admiror Joomla! Sponsor]

[Vasiljevski]

Never considered this case before, but I understand your concern.
This is probably because of this part in components\com_admirorgallery\admirorgallery.php

Code: Select all

$doc->addScript(JURI::root().'administrator/components/com_admirorgallery/scripts/jquery.hotkeys-0.7.9.min.js');
$doc->addStyleSheet(JURI::root().'administrator/components/com_admirorgallery/templates/'.$AG_template.'/css/template.css');
$doc->addStyleSheet(JURI::root().'administrator/components/com_admirorgallery/templates/'.$AG_template.'/css/toolbar.css');

This is the only place where we reference any file from administrator folder.
You could copy these scripts and template from administrator\components\com_admirorgallery to components\com_admirorgallery folder, and change the path in admirorgallery.php, like:

Code: Select all

$doc->addScript(JURI::root().'components/com_admirorgallery/scripts/jquery.hotkeys-0.7.9.min.js');
$doc->addStyleSheet(JURI::root().'components/com_admirorgallery/templates/'.$AG_template.'/css/template.css');
$doc->addStyleSheet(JURI::root().'components/com_admirorgallery/templates/'.$AG_template.'/css/toolbar.css');

My guess is that this should solve the problem, but I cannot be 100% sure, no way to test it myself

Is it possible to send me, by mail, or here, how do you use .htaccess to protect your administrator folder? Or if you have some link I could check. It would be appreciated