Log is public readable

[volschin]

Normally Joomla seem to write logs as php to restrict access to them. The plugin generates a log with .log extension meaning not being parsed as php.
So the log can be read by anyone with direct input of the URL.

I think this should be changed to httpbl.php to be secure.

[michiel_1981]

Thank you for reporting this, i will release a new version asap.

kind regards,
Michiel

[michiel_1981]

released version 1.9, fixes this issue.

kind regards,
Michiel

[volschin]

Thanks for the fast fix. It works fine.

[orasis]

Hi I use the plg_httpbl_latest which is version 1.10 for Joomla! 1.5.15 Native, and when accessing www.mydomain.com/logs/httpbl.php I can see it from public without any restriction on any browser..

how about that ?

[divesport]

... when accessing www.mydomain.com/logs/httpbl.php I can see it from public without any restriction on any browser..

If you're running Apache, you can block access to the entire logs directory. Put a .htaccess file in this logs directory with the following contents:

order deny,allow
deny from all

How about that?

[orasis]

I've just password protected the dir already
thanks for the reply

[allengreg512]

Log is public readable
you can hide/unhide it from administrator control panel of the niche.
it is found under settings..


Regards & Thanks
tuinhuis

[mallanna142]

Hi

Thank you for reporting this, i will release a new version asap.

kind regards,


phe9oxis