Skip to content

project_issue/bug - CloudFlare Admin URL different then normal Admin URL #83

@rogerujetrails

Description

@rogerujetrails

Reviewing plugin found that when your in the CloudFlare plugin the URL you are using does not include the admin entry. Example:

Normal Admin URL:
https://stompybots.com/index.php/admin/dashboard/index/key/fa10a08f0aa2050d28713549aab71d22/

URL when using CloudFlare Plugin:
https://stompybots.com/index.php/cloudflare/dashboard/index/key/fa10a08f0aa2050d28713549aab71d22/

My though process was if people are trying to secure the backend using a page rule, or a rewrite rule the CloudFlare plugins URL would be ignored by said rule. Example:

Setting up a page rule in CloudFlare to increase the default Security from Medium to High for following URLs:

stompybots.com/index.php/admin/

As there is nothing in the CloudFlare Plugin URL that matches this the page rule won't apply.

Further testing shows that if you are trying to locked down the backend with a page rule or htaccess redirect, the CloudFlare URL can still be used to log into.

Example:

Created Page rule to redirect anyone going to anywhere in the backend to the front page:
stompybots.com/index.php/admin Redirects to https://stompybots.com

Using the following URL I was able to log into the CloudFlare Plugin:
https://stompybots.com/index.php/cloudflare/dashboard

Metadata

Metadata

Assignees

Labels

bugSomething is not working as expected

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions