🌍
English
Announcement
- [2024-09-05] Piwigo 15.0.0beta3
- [2024-08-23] The rebirth of Piwigo documentation
- [2024-07-31] Piwigo 15.0.0beta2
- [2024-07-15] Piwigo 14.5.0
- [2024-07-02] Piwigo 15.0.0beta1
#1 2021-09-09 17:31:44
- beepro
- Member
- 2021-09-05
- 59
Simple way to hide login from hackers
Hello/Hi/Greetings,
I googled and found some complicated settings to hide the login prompt.
Today, I just renamed the identification.php to something I know (e.g. xyz.php), then inside the actual file, you need to rename it too
Line 103:
'F_LOGIN_ACTION' => get_root_url().'xyz.php',
now the login link is still there but it will give an error.
To actually log in, you type: 'yourpage.com/xyz.php' and it will work fine!
someone please tell me if this is a bad idea or not. I am new to piwigo.
Zack
Piwigo 11.5.0
Operating system: Linux
PHP: 7.3.30
MySQL: 5.7.23-23
Graphics Library: ImageMagick 6.9.10-68
Offline
#2 2021-09-10 07:22:35
- nicolas
- Former Piwigo Team
- 2004-12-30
- 1232
Re: Simple way to hide login from hackers
beepro wrote:
'F_LOGIN_ACTION' => get_root_url().'xyz.php',
now the login link is still there but it will give an error.
To actually log in, you type: 'yourpage.com/xyz.php' and it will work fine!
someone please tell me if this is a bad idea or not. I am new to piwigo.
It's a bit strange. How can your users can login now ?
Offline
#3 2021-09-10 10:36:38
- erAck
- Only trying to help
- 2015-09-06
- 2125
Re: Simple way to hide login from hackers
They probably don't have users.
Anyway, security by obscurity theater is a circus and why would one even want to rename the login. If you don't want the login credential fields to be displayed then configure the menu to not display it, under Admin -> Configuration -> Menus, on Identification (mbIdentification) check Hide.
Running Piwigo at https://erack.net/gallery/
Offline
#4 2022-02-18 13:02:21
- beepro
- Member
- 2021-09-05
- 59
Re: Simple way to hide login from hackers
presumably, even if you hide it. anyone who uses piwigo (or a robot) will know the url for the login prompt and attempt to break in. renaming it will simply give them error with nothing.
Offline
#5 2023-03-31 18:20:10
- Ralf
- Member
- Dorsten-Lembeck
- 2012-05-08
- 230
Re: Simple way to hide login from hackers
Or protect:
admin.php
password.php
identification.php
with the .htaccess file:
<Files identification.php>
AuthType Basic
AuthName "Restricted Access"
AuthUserFile /path/to/password/file
Require valid-user
</Files>
Place the password file outside your webroot folder and it is pretty save.
Renaming or changing something inside the files has one draw back:
After each update you have to rename the files again.
.htaccess file will not be overwritten by an update.
Cheers
Ralf
Offline