.htaccess on admin directory help

[DamnSkippy]

When I require a user/pass for the administrator directory using .htaccess the login dialog pops up when loading the home page. So just going to domain.xxx gets the login dialog as well as domain.xxx/administrator.

Is this because a module or something on the front page is needing to access the admin directory for some reason you think?

This is the kind of question I would normaly post in a security topic but I figured this was the closest thing to it

[mamboguy.com]

The .htaccess file must be put in the administrator folder. It sounds like it is in the root folder at the moment.

[DamnSkippy]

Nope, thats what I thought at first also so I checked to be sure I had not messed up the "mambo" .htaccess file in the root. It is in the administrator folder and works fine except for the small problem of asking everyone to login who comes to the site LOL. I can rename it to .htaccess.bak and all is back to normal.

Thanks for the reply though.

[SvenErik]

I received the same problem when I tried to add a .htaccess file in the /administration/ folder. And since the .htaccess only works for the folder it is in and its subfolders, it means that something on the frontside is trying to access the /administrator/ folder.

[mamboguy.com]

Originally Posted by SvenErik

I received the same problem when I tried to add a .htaccess file in the /administration/ folder. And since the .htaccess only works for the folder it is in and its subfolders, it means that something on the frontside is trying to access the /administrator/ folder.

Spot on.. so off you go hunting for that....

[SvenErik]

Located the culprit! It is the mod_visitors_by_country 1.0-RC1 module for TFSforMambo. It wants to display the flag images from the /administrator/components/com_tfsformambo/flags/ folder.

I have mailed the author about it, and changed the code in the module. For others with this same problem, open /modules/mod_visitors_by_country.php and on line 61-65 change:

PHP Code:

    $content .= "<td align=\"left\"><img src=\"/administrator/components/com_tfsformambo/flags/unknown.png\"></td>";
}
else
{
    $content .= "<td align=\"left\"><img src=\"/administrator/components/com_tfsformambo/flags/".$row[1].".png\"></td>"; 


to:

PHP Code:

    $content .= "<td align=\"left\"><img src=\"/components/com_tfsformambo/flags/unknown.png\"></td>";
}
else
{
    $content .= "<td align=\"left\"><img src=\"/components/com_tfsformambo/flags/".$row[1].".png\"></td>"; 


You also have the same problem in the mod_visitors_detail module for TFSforMambo.
But there is at least one more...

[DamnSkippy]

Originally Posted by badbaker.com

Spot on.. so off you go hunting for that....

LOL Yippie! A hunting I will go, A hunting I will go .......

[keliix06]

Many components call info from the backend. Mostly for config files.

[SvenErik]

True. They have access to a database, why don't they use it?

Other modules I located that I have but don't use with this problem:

mod_randompic v0.1

PHP Code:

require_once($mainframe->getCfg( 'absolute_path' )."/administrator/components/com_akogallery/config.akogallery.php"); 


mod_events_latest v1.11

PHP Code:

include_once("administrator/components/com_events/events_config.php"); 


mod_events_cal v1.4

PHP Code:

include_once("components/com_events/language/".$mosConfig_lang.".php"); 


and several other calls...

mod_remositoryupdatemod.php v1.00

PHP Code:

$dhtmlfile = "administrator/js/dhtml.js"; 


[keliix06]

Originally Posted by SvenErik

True. They have access to a database, why don't they use it?

Since the config file won't be very long, it is less strain on the server to run it from a flat file.