Search code examples
.htaccessjoomlawhitelist

Can attacker circumvent a htaccess 'deny from all' command

I applied an htaccess file to the /administrator directory of a joomla website that is supposed to whitelist only my local ip address and my public ip address .

However, it appears that a new user account was created within that joomla account a couple of months after I applied the white list.

Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from 77.##.##.###

Can someone offer a theory on how this is possible?

Solution

  • Users can be created via front-end, even if you don't have a registration link or form there. Registration might be accessed by going to: index.php?option=com_users&view=registration

    You can disable this option in Joomla back-end. To do so go to: System -> Global Configuration -> Users Manager and turn Allow User Registration to NO.