by
KK » Sat Nov 07, 2015 2:01 pm
@trendoman
switch.php exposes the name and location of Couch Admin Folder on the front-end. So, think twice
Thanks for pointing out that.
The requirement of placing 'switch.php' within the 'couch' folder is actually a throwback from the days when Couch used IonCube encryption (all encrypted files had to be in the 'couch' folder).
With that no longer being the case, we are free to move switch.php out into the site's root.
After placing switch.php in the site's root, we'll need to make a couple of small changes to reflect the new arrangement -
1. modify 'switch.php' to indicate the changed 'couch' path -
orig: (line 12)
if ( !defined('K_COUCH_DIR') ) define( 'K_COUCH_DIR', str_replace( '\\', '/', dirname(realpath(__FILE__) ).'/') );
modified:
if ( !defined('K_COUCH_DIR') ) define( 'K_COUCH_DIR', str_replace( '\\', '/', dirname(realpath(__FILE__) ).'/couch/') );
N.B. If you have renamed 'couch' folder to something else, please put in the right name above.2. modify snippet 'lang_switcher_menu.html' to indicate the changed path of switch.php
orig: (line 7):
echo'<li class="'.$lang.$selected_class.'"><a href="<cms:show k_admin_link />switch.php?lang='.$lang.'&redirect='.urlencode($_SERVER["REQUEST_URI"]).'"><span>'.strtoupper($lang).'</span></a></li>';
modified:
echo'<li class="'.$lang.$selected_class.'"><a href="<cms:show k_site_link />switch.php?lang='.$lang.'&redirect='.urlencode($_SERVER["REQUEST_URI"]).'"><span>'.strtoupper($lang).'</span></a></li>';
And that should fix the admin path leak
Hope it helps.