-
Notifications
You must be signed in to change notification settings - Fork 1
Description
Reviewing plugin found that when your in the CloudFlare plugin the URL you are using does not include the admin entry. Example:
Normal Admin URL:
https://stompybots.com/index.php/admin/dashboard/index/key/fa10a08f0aa2050d28713549aab71d22/
URL when using CloudFlare Plugin:
https://stompybots.com/index.php/cloudflare/dashboard/index/key/fa10a08f0aa2050d28713549aab71d22/
My though process was if people are trying to secure the backend using a page rule, or a rewrite rule the CloudFlare plugins URL would be ignored by said rule. Example:
Setting up a page rule in CloudFlare to increase the default Security from Medium to High for following URLs:
stompybots.com/index.php/admin/
As there is nothing in the CloudFlare Plugin URL that matches this the page rule won't apply.
Further testing shows that if you are trying to locked down the backend with a page rule or htaccess redirect, the CloudFlare URL can still be used to log into.
Example:
Created Page rule to redirect anyone going to anywhere in the backend to the front page:
stompybots.com/index.php/admin Redirects to https://stompybots.com
Using the following URL I was able to log into the CloudFlare Plugin:
https://stompybots.com/index.php/cloudflare/dashboard