Book Image

Learning Joomla! 3 Extension Development - Third Edition

By : Timothy John Plummer
Book Image

Learning Joomla! 3 Extension Development - Third Edition

By: Timothy John Plummer

Overview of this book

Joomla 3 is the first of the major open source content management systems that was meant to be mobile friendly by default. Joomla uses object-oriented principles, is database agnostic, and has the best mix of functionality, extensibility, and user friendliness. Add to that the fact that Joomla is completely community driven, and you have a winning combination that is available to everyone, and is the perfect platform to build your own custom applications. "Learning Joomla! 3 Extension Development" is an integrated series of practical, hands-on tutorials that guide you through building and extending Joomla plugins, modules, and components. With Joomla having been downloaded well over 35 million times, there is a huge market for Joomla extensions, so you could potentially earn some extra cash in your spare time using your newly acquired Joomla extension development skills. We will start with developing simple plugins and modules, and then progress to more complex backend and frontend component development. Then we will try our hand at ethical hacking, so you will learn about common security vulnerabilities and what you can do to avoid them. After that we will look at how you can prepare your extensions for distribution and updates, as well as how you can extend your components with various plugins and modules. Finally, you will end up with a fully functioning package of extensions that you can use on your own site or share with others. If you want to build your own custom applications in Joomla, then "Learning Joomla! 3 Extension Development" will teach you everything you need to know in a practical, hands-on manner.
Table of Contents (18 chapters)
Learning Joomla! 3 Extension Development
Credits
About the Author
Acknowledgement
About the Reviewers
www.PacktPub.com
Preface
Index

Path disclosure


We've talked a lot about always adding the defined('_JEXEC') or die statement at the top of all your PHP files, which prevents direct execution of the PHP files and only allows them to run via Joomla!. If you leave this out, it can lead to path disclosure vulnerabilities, which are basically error messages on your site that tell the hacker details about your website such as the full path of the files on the web server. This may give the hacker information such as the username of your account with your hosting company, which is often used when logging into CPanel or connecting to the site via FTP.

We can easily simulate this by editing clicktocall.php under /plugins/content/clicktocall and removing the defined('_JEXEC') or die statement at the top of the file. Then browse to the following URL (where joomla3 is your site name on your local development environment):

http://localhost/joomla3/plugins/content/clicktocall/clicktocall.php

Note

You may need to set display_errors =...