Support

Admin Tools

#9792 .htaccess blocks access for FireFox

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Wednesday, 16 March 2011 12:58 CDT

user33181
Hi,

I have used .htaccess Generator of Admin Tools to activate Server Protection (i.e. creating .htaccess file in root folder). I suppose that following lines of the .htaccess file:

##### Advanced server protection -- BEGIN



## Referrer filtering for common media files

RewriteRule ^(images/stories/.*\.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|html))$ $1 [L]

RewriteCond %{REQUEST_FILENAME} -f

RewriteCond %{HTTP_REFERER} !^(http://www\.mydomain\.sk|https://www\.mydomain\.sk) [NC]

RewriteRule \.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|html)$ - [F,L]

...

## Allow limited access for certain Joomla! system directories with client-accessible content

RewriteRule ^((components|modules|templates|images|plugins|media)/.*\.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|mpg|mp3|mpeg|mp4|avi|wav|ogg|ogv|xls|xlsx|doc|docx|ppt|pptx|zip|rar|pdf|xps|txt|7z|svg|odt|ods|odp|flv|mov|ico|htm))$ $1 [L]


allows (besides another things) access to .swf files in any subdirectory in "/components" directory. However, as FireFox does not provide HTTP_REFERER parameter to web server, .swf files are inaccessible (i.e. they are not displayed on the web page) while using FireFox, but they are accessible (i.e. displayed on the page) while using IE8. My point is to have the .swf files correctly displayed on the web pages regardless which browser is used.

I have found workaround of this issue by adding line "RewriteCond %{HTTP_REFERER} !^$" into .htaccess file, i.e.:

##### Advanced server protection -- BEGIN



## Referrer filtering for common media files

RewriteRule ^(images/stories/.*\.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|html))$ $1 [L]

RewriteCond %{REQUEST_FILENAME} -f

RewriteCond %{HTTP_REFERER} !^$

RewriteCond %{HTTP_REFERER} !^(http://www\.mydomain\.sk|https://www\.mydomain\.sk) [NC]

RewriteRule \.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|html)$ - [F,L]

...

## Allow limited access for certain Joomla! system directories with client-accessible content

RewriteRule ^((components|modules|templates|images|plugins|media)/.*\.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|mpg|mp3|mpeg|mp4|avi|wav|ogg|ogv|xls|xlsx|doc|docx|ppt|pptx|zip|rar|pdf|xps|txt|7z|svg|odt|ods|odp|flv|mov|ico|htm))$ $1 [L]


My question is whether this is the safe workaround or if there exists any other way how to solve this issue with FireFox and HTTP_REFERER parameter.

Thank you,

nicholas
Akeeba Staff
Manager
You can simply disable the HTTP referer filtering option in .htaccess maker. In the "Server Protection" slider set the "Anti-leech protection for static resources outside images/stories" to No. The idea is that if you're going to disable HTTP referer validation, be consistent and do it site-wide to avoid hard-to-trace problems. Besides, this feature only offers limited protection against fingerprinting attacks (i.e. attempts of hackers to fly under the radar in order to figure out which Joomla! release you're using). The rest of the security features of Admin Tools do a very good job at actively protecting your site, so the extra risk arising from fingerprinting attempts is minimal, if any.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!