{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/19955","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19955/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19955/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19955/events","html_url":"https://github.com/joomla/joomla-cms/issues/19955","id":307083189,"number":19955,"title":"Question: Why doesn't Joomla have a standard feature to make te admin url secret?","user":{"login":"JSWebdesign","id":8665392,"avatar_url":"https://avatars2.githubusercontent.com/u/8665392?v=4","gravatar_id":"","url":"https://api.github.com/users/JSWebdesign","html_url":"https://github.com/JSWebdesign","followers_url":"https://api.github.com/users/JSWebdesign/followers","following_url":"https://api.github.com/users/JSWebdesign/following{/other_user}","gists_url":"https://api.github.com/users/JSWebdesign/gists{/gist_id}","starred_url":"https://api.github.com/users/JSWebdesign/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JSWebdesign/subscriptions","organizations_url":"https://api.github.com/users/JSWebdesign/orgs","repos_url":"https://api.github.com/users/JSWebdesign/repos","events_url":"https://api.github.com/users/JSWebdesign/events{/privacy}","received_events_url":"https://api.github.com/users/JSWebdesign/received_events","type":"User","site_admin":false},"labels":[{"id":138443932,"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-03-21T00:14:16Z","updated_at":"2018-03-21T00:46:57Z","closed_at":null,"author_association":"NONE","body":"### Steps to reproduce the issue\r\nAll Joomla cms installations have /administrator as login url for the admin part.\r\n\r\n\r\n### Expected result\r\nCreates a security risk. The administrator url should be configurable by the superuser at installation.\r\n\r\n\r\n### Actual result\r\ncsm system is open for hacker attacks\r\n\r\n\r\n### System information (as much as possible)\r\nAll versions\r\n\r\n\r\n### Additional comments\r\nsee the discussion here\r\nhttps://www.linkedin.com/groups/52867/52867-6381740900460167169 \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/374805351","html_url":"https://github.com/joomla/joomla-cms/issues/19955#issuecomment-374805351","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19955","id":374805351,"user":{"login":"mbabker","id":368545,"avatar_url":"https://avatars2.githubusercontent.com/u/368545?v=4","gravatar_id":"","url":"https://api.github.com/users/mbabker","html_url":"https://github.com/mbabker","followers_url":"https://api.github.com/users/mbabker/followers","following_url":"https://api.github.com/users/mbabker/following{/other_user}","gists_url":"https://api.github.com/users/mbabker/gists{/gist_id}","starred_url":"https://api.github.com/users/mbabker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbabker/subscriptions","organizations_url":"https://api.github.com/users/mbabker/orgs","repos_url":"https://api.github.com/users/mbabker/repos","events_url":"https://api.github.com/users/mbabker/events{/privacy}","received_events_url":"https://api.github.com/users/mbabker/received_events","type":"User","site_admin":false},"created_at":"2018-03-21T00:46:57Z","updated_at":"2018-03-21T00:46:57Z","author_association":"OWNER","body":"There is a difference in obscuring the URL (which looking at the plugin code `/administrator` is still accessible but redirects to the frontend unless you're authenticated, there is a 404 configuration in the plugin it seems but this is also pretty easily identifiable based on the code, so it's really not as effective as it might appear) and moving the directory in full so that `/administrator` creates what most users would expect in this case, a 404."}}
{"actor":{"display_login":"mbabker"}}