changing the categories menu alias for security

  • Posts: 2
  • Thank you received: 0
10 years 5 months ago #199025

-- HikaShop version -- : 2.4.0
-- Joomla version -- : 3.3.6
-- PHP version -- : 5.6.3
-- Browser(s) name and version -- : Google Chrome 41
-- Error-message(debug-mod must be tuned on) -- : none

I cannot change the alias for the menu entry for categories from:
hikashop-menu-for-categories-listing

That is a security problem and will not work for me for 2 reasons.

1. Its tells hackers I use hikashop. This is stupid from a security standpoint, and yet I cannot figure out how to change it.
2. Because HikaShop is only for Joomla, It also tells hackers I use joomla. I go through great lengths to make sure that is not obvious for security reasons.

If I can't resolve this, I have to move to another e-commerce solution. Obfuscation is the first and easiest form of security. Is this not possible?

Last edit: 10 years 5 months ago by poetfreak. Reason: missed a word ;)

Please Log in or Create an account to join the conversation.

  • Posts: 26276
  • Thank you received: 4046
  • MODERATOR
10 years 5 months ago #199026

Hi,

We create by default menus for product listing or category listing ; it helps the users to have something ready to test/use.
But these menus are classical Joomla menus and you can edit them like any other menu in Joomla.

In the Joomla menu manager you will see the different menus and you can edit all of them and change their alias.

So, I can assure you that you have the possibility to change the alias for your menus and that's something we recommend to our users ; the goal of these menus are not to be used like that but is to propose something already functional that they can configure and tweak afterwards.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 2
  • Thank you received: 0
10 years 4 months ago #201689

okay - got that fixed but the name hikashop still shows up everywhere.
In the com name, in the outputted source, and at the bottom of anything you do with the store.

As I have played with this and showed the client, they like it, but I can't have that. Even the client knows
that is not good security.

Is there a way to remove it?

Please Log in or Create an account to join the conversation.

  • Posts: 84323
  • Thank you received: 13715
  • MODERATOR
10 years 4 months ago #201693

Hi,

The footer where the HikaShop text is displayed can be removed by turning off the "show footer" option of the HikaShop configuration.
Having the ids and class names in the output HTML/CSS/Javascript is necessary to avoid conflicts with other extensions. With thousands of extensions out there for Joomla which can be used on the same website, that is a necessity.
Yes it tells hackers that you use HikaShop. So what ? There are many ways you can tell which extension/application is used on a website, even without that. Show me a website and I can tell you if it uses Joomla or not, even if you try your best to hide it and even if the id/class names are not prefixed with "joomla". For example, just add /index.php?option=com_users to the domain name of any website like www.joomla.org/index.php?option=com_users and if you get a username/password form, you know it's a Joomla website. Then, if you go to www.joomla.org/index.php?option=com_hikashop , you'll get a 404 error if HikaShop is not installed so if you don't get that 404 error, you know you have HikaShop on the website. That's the same for any Joomla component.
Any hacker worth its salt would be able to do the same and much much more. And similar methods can be used for other ecommerce/CMS out there. Real security is not about obfuscation, it's about designing your application to be secure: en.wikipedia.org/wiki/Secure_by_design
Now, if you want to change the ids and class names to remove HikaShop from them, it's not impossible. HikaShop is completely open source and you can override all the views of HikaShop. But that's a incredible big development, which won't help you be more secure.

Please Log in or Create an account to join the conversation.

Time to create page: 0.055 seconds
Powered by Kunena Forum