Support

Admin Tools

#30920 Joomla post installation message about .htaccess

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by jjst135 on Wednesday, 13 February 2019 07:08 CST

jjst135
Hi! After updating to Joomla 3.0.3 we see this post installation message:

++++++++++++++++++

Since Joomla 3.9.3, Joomla is shipped with additional security hardenings in the default htaccess.txt and web.config.txt files. These hardenings disable the so called MIME-type sniffing feature in webbrowsers. The sniffing leads to specific attack vectors, where scripts in normally harmless file formats (i.e. images) will be executed, leading to Cross-Site-Scripting vulnerabilities.

The security teams recommends to manually apply the necessary changes to existing .htaccess or web.config files, as those files can not be updated automatically.

Changes for .htaccess
Add the following lines before "## Mod_rewrite in use.":

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</IfModule>

++++++++++++++++++++++

Is this 'nosniff' option also added when we use the .htaccess maker in AdminTools?
Should we resave the .htaccess file using AdminTools after this Joomla update?
Or should we do something else? Or just ignore this?

Kind regards,
Jip

nicholas
Akeeba Staff
Manager
Admin Tools is way ahead of Joomla! :) This is what our "Reduce MIME type security risks" feature has been doing since Admin Tools 3.6.0, release on June 22nd, 2015.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

jjst135
Excellent! I would have been disappointed if this was not the case haha!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!