New feature: enhance security with custom admin URL.

[kiatng]

Description (*)

Ref #1209 (comment), where I was trying to make use of the nginx config for admin without the use of caddy. For this, I needed the ability to have a custom admin URL, which is configurable here:

However, Custom Admin URL is not implemented. This PR is my attempt to complete the implementation.

When Custom Admin URL is used, frontend access to admin is forbidden in the function match() in app/code/core/Mage/Core/Controller/Varien/Router/Admin.php. This is independent of server config, which provides an alternate way:

magento-lts/dev/openmage/nginx-frontend.conf

Lines 150 to 154 in 5a95706

	# Non-rewritten URLs, Admin and API are disabled for frontend
	location /index.php/ { return 404; }
	location ~ ^/admin(?:/(.*))?$ { return 404; }
	location /api/ { return 404; }
	location /api.php { return 404; }

Related Pull Requests

PR #1209

Manual testing scenarios (*)

1. Add a separate host for admin, example nginx config:

server {
    listen 80;
    server_name admin.example.com;

    access_log /var/log/nginx/admin.example.com-access.log combined;
    error_log /var/log/nginx/admin.example.com-error.log;

    set $webroot /var/web/example; # OpenMage root

    include include/openmage-admin.conf; # See dev/openmage/nginx-admin.conf
}

2. It's probably not feasible to set Custom Admin URL in admin. So add it directly to the table:

UPDATE `core_config_data` SET `value` = '1' WHERE `path` = 'admin/url/use_custom';
INSERT INTO `core_config_data` (`scope`, `scope_id`, `path`, `value`, `updated_at`) 
  VALUES ('default', '0', 'admin/url/custom', 'admin.example.com', CURRENT_TIMESTAMP);

3. Navigate to admin.example.com/adminFrontName where adminFrontName is set in /etc/local.xml
4. Navigate to main store www.example.com/adminFrontName should return 404 page not found.

Questions or comments

I am not sure if this is the best way to implement the custom admin URL. Collab welcome.

Possible issue for API in 3rd-party code because of

magento-lts/api.php

Line 38 in 5496d8a

Mage::init('admin');

As can be seen above, API is admin store, and if there is a Mage::getUrl() in the response params, the URL will not be accessible. There is no Mage::getUrl() in the core, but may be present in 3rd-party code/modules.

[sreichel]

I did a quick test ...

It seems it needs some documentation. Changes to .htaccess etc ...

I tried with apache (DDEV), added addtional host names, but got redirected to frontend page.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud