[Skip to main content](#vessel-content) # Display view files with extra param ## - **[oxido](/forum/user/29793-oxido "View oxido's Profile")** - [![oxido's Avatar](https://www.hikashop.com/media/kunena/core/svg/person.svg)](/forum/user/29793-oxido "View oxido's Profile") Topic Author - [ Offline](/forum/user/29793-oxido) Less More - Posts: 285 - Thank you received: 42 - - 1 month 1 week ago [\#100000044](#100000044) by [oxido](/forum/user/29793-oxido "View oxido's Profile") *[Display view files with extra param](/forum/2-general-talk-about-hikashop/100000012-display-view-files-with-extra-param#100000044 "-- HikaShop version -- : 6.6.0 -- Joomla version -- : 5.4.8 -- PHP version -- : 8.3.33 -- Browser(s) name and version -- : Chrome 154.0 Hi there, Regarding that HikaShop setting that allows you to see view blocks on the front-end: even though the setting can be disabled, I believe that front-end view editing should only be possible if you are logged in as an Administrator. As it stands, if the option is enabled, anyone with access to the site who adds the relevant parameter to the URL can access and modify the code. I know the setting isn't meant to stay on all the time, but things happen, and it is possible to accidentally leave that option enabled. It's just my concern. B)")* was created by *[oxido](/forum/user/29793-oxido "View oxido's Profile")* -- HikaShop version -- : 6.6.0 -- Joomla version -- : 5.4.8 -- PHP version -- : 8.3.33 -- Browser(s) name and version -- : Chrome 154.0 Hi there, Regarding that HikaShop setting that allows you to see view blocks on the front-end: even though the setting can be disabled, I believe that front-end view editing should only be possible if you are logged in as an Administrator. As it stands, if the option is enabled, anyone with access to the site who adds the relevant parameter to the URL can access and modify the code. I know the setting isn't meant to stay on all the time, but things happen, and it is possible to accidentally leave that option enabled. It's just my concern. ![B)](/media/kunena/emoticons/9.png "B)") Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzItZ2VuZXJhbC10YWxrLWFib3V0LWhpa2FzaG9wLzEwMDAwMDAxMi1kaXNwbGF5LXZpZXctZmlsZXMtd2l0aC1leHRyYS1wYXJhbT90bXBsPW1hcmtkb3du) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. - **[nicolas](/forum/user/63-nicolas "View nicolas's Profile")** - [![nicolas's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar63.png?1793428657)](/forum/user/63-nicolas "View nicolas's Profile") - [ Away](/forum/user/63-nicolas) Less More - Posts: 86540 - Thank you received: 14299 - - 1 month 1 week ago [\#100000046](#100000046) by [nicolas](/forum/user/63-nicolas "View nicolas's Profile") Replied by *[nicolas](/forum/user/63-nicolas "View nicolas's Profile")* on topic *[Display view files with extra param](/forum/2-general-talk-about-hikashop/100000012-display-view-files-with-extra-param#100000046 "-- HikaShop version -- : 6.6.0 -- Joomla version -- : 5.4.8 -- PHP version -- : 8.3.33 -- Browser(s) name and version -- : Chrome 154.0 Hi there, Regarding that HikaShop setting that allows you to see view blocks on the front-end: even though the setting can be disabled, I believe that front-end view editing should only be possible if you are logged in as an Administrator. As it stands, if the option is enabled, anyone with access to the site who adds the relevant parameter to the URL can access and modify the code. I know the setting isn't meant to stay on all the time, but things happen, and it is possible to accidentally leave that option enabled. It's just my concern. B)")* Hi, The setting only prints, on the page, the name of the template file used for each block, together with a small edit icon; it does not make editing possible from the front-end. That icon points to a backend (administrator) URL, and opening the Joomla backend always requires being logged in there, independently of this HikaShop setting. Without a valid backend login, clicking the icon only opens the Joomla administrator login screen, never the file's content, so a visitor who is not logged into the backend cannot read or change the code through it, even with the option left enabled and the extra URL parameter added. It is still good practice to turn the option off once you are done debugging, and the 'with extra parameter in the URL' mode you are likely thinking of is already the least exposed of the available choices, since it only shows this information when that specific parameter is added to the URL. The following user(s) said Thank You: [oxido](/forum/user/29793-oxido "View oxido's Profile") Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzItZ2VuZXJhbC10YWxrLWFib3V0LWhpa2FzaG9wLzEwMDAwMDAxMi1kaXNwbGF5LXZpZXctZmlsZXMtd2l0aC1leHRyYS1wYXJhbT90bXBsPW1hcmtkb3du) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. Board Categories HikaShop Install & Update Product & Category Display Content Creation Sales and Orders Orders management Reports & Statistics Customers Checkout Payment Methods Shipping Methods Import & Export (CSV, XLS…) Specific Features Affilation Taxes Wishlist Vote Carousel & Slider Mass Actions Filters & Search Discount & Coupon Feature Request Integrations Showcase General Talk about HikaShop Development HikaShop 3.0 Beta Translation Commercial Jobs HikaShop Components HikaMarket Market: Feature requests Market: How to? Market: Bug Report HikaSerial General talk about HikaSerial Serial: Bug Report Serial: How to? Support en Français de HikaSerial (French Support) HikaSubscription HikaAuction Auction: Feature requests Auction: How to? Auction: Bug report Hikashop around the world Support en Français (French Support) Russian FAQ. Курс выживания с Hikashop. Частые вопросы и о Расширения Hikashop Наши сайты на Hikashop 日本語版サポート(Japanese Support) Thai German Archives Bug Report How to? [](/forum/topics/feed/mode-topics?format=feed&type=rss) Time to create page: 0.042 seconds [Powered by](/forum/credits) [Kunena Forum](https://www.kunena.org)