Hardening access to your files

Joomla! is a CMS with a powerful framework, and developing extensions for Joomla! is fun and easy thanks to all the code contributed by all the volunteers. But we should not forget that our web application in Joomla! is a collection of single PHP files working together as a whole.

Joomla! usually runs on a web server (commonly Apache or Nginx) that can execute PHP code. If you upload a custom .php file with some valid code to your Joomla! website and you try to access it, you will see that it works with no issues.

This also happens with the files of our extensions when you try to access them directly. Right now, if you have followed all the examples in this book, your files can be executed without Joomla!. As we are using lots of classes and libraries from Joomla!, it’s very likely that, when accessed directly, you will get errors. However, these errors might offer clues to attackers, so we need to secure our files to prevent direct access...