Support

Admin Tools

#18635 WAF vs. .htaccess

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by tampe125 on Monday, 30 December 2013 03:15 CST

winner66
 Hi,
This is a very simple question. If I have to allow access to a component, how do I know, in general terms, where to add the exception? Should I do it in the WAF or allow direct access to the particular directory of the component in the .htaccess file?
So far, I've managed to find out that the .htaccess can avoid some troubles -such as getting blank pages- when an extension is given the correct permission to be accessed. And that the WAF stops warning about a 'supposedly' harmless component everytime it is used after I mark it as an exception.
As you can see, this is not a question about security, but about which correct decision is to be made without being desperately wandering through AdminTools functions.
Thank you, and sorry if the answer is out there. I couldn't find it.

tampe125
Akeeba Staff
Hello Damiàn,

I'd suggest you to use WAF: inside the .htaccess maker you can add direct access to files, which is quite risky, since an attacker could run a script previously uploaded on your site.
Instead, inside WAF, you'll just disable all the checks that are performed (remote file inclusion, sql injections etc etc), but the attacker won't be able to directly reach any uploaded file.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!