7

I have just updatet my store to the latest Magento CE 1.9.2.2 software version (not the Patch SUPEE-6788, I did the full core update using the Magento Downloader).

After the update I went to

System > Configuration > Advanced > Admin > Security

and found the Admin routing compatibility mode for extensions option to be set to Enable.

However, just below the "Enable/Disable" selector there is a short description which says

Enabling this setting increases risk of automated attacks against admin functionality.

Admin routing compatibility mode for extensions

I wasn't sure if I should change this setting or not so I went to the Magento website and there it says

To protect non-default admin URLs against automated attacks, the patch must be enabled by changing the routing compatibility mode in configuration. Use "Enable Admin routing compatibility mode" under System > Configuration > Admin > Security.

enter image description here

The people over at Byte say

Finally, to increase security, disable the “compatibility mode” here:

System > Config > Admin > Security > Admin routing compatibility mode for extensions

enter image description here

And then they display a screen shot showing the option in Enable mode.

I find all of this very confusing so my question is what mode of this option offers most security?

Should the selector display "Enable" or "Disable" after saving the config?

2
  • If you are still wondering if the patch is working. You can test this on magereport.com
    – khoekman
    Nov 4, 2015 at 10:12
  • Actually i am not sure whether magereport.com will check for the above setting. It should because otherwise it might give a false sense of security.
    – khoekman
    Nov 4, 2015 at 10:21

2 Answers 2

12

I think it's pretty easy to lull yourself into a false sense of security whith this.

Admin routing compatibility mode for extensions: Enabled (=Default)

This is the default setting after applying the patch. Your extensions won't break with this setting. Security is limited though.

Admin routing compatibility mode for extensions: Disabled

Only with a disabled compatibility mode you are on the secure side. If all your extensions are updated to work with the new way of admin routing, don't forget to change this setting to "disabled".

4

Admin Routing Compatibility mode works like Compatibility Mode in Internet Explorer.

It downgrades the application to function like an older version so the insecure modules will work.

When you have all your modules upgraded to work properly in the new security model, you will disable Admin Routing Compatibility mode to restrict access to the admin backend.

It's one of those Microsoft GPO things where yes means no.

Enabling this setting increases risk of automated attacks against admin functionality.

is the same thing as

NOTE: This patch is disabled by default.

In other words, Disabling what the patch does makes patched Magento able to run insecure modules by Enabling Admin Routing Compatibility.

1
  • Thank you for your answer. Just to be clear: When this option is saved as "Disable" it offers better security but could break extensions which are using unsafe admin routing? And could you please add a screen shot to your answer displaying the preferred admin routing setting for maximum security?
    – MatthijsIJ
    Oct 31, 2015 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.