Hello cavo789,

Sorry for late reply to this,
What my suggestion is you can consult with your Webhosting provider about the file permission regarding this http://thesite/media/com_komento/config/xxx.json

which Chmod permission you set should meet your requirement, so the public user will not have the permission to access this file.

Hope this help.

Hi. Thanks for your intervention (I can't say "answer" since it's not).

Very strange answer since Komento create this file so Komento need to secure this file. If I put a .htaccess file in my folder to refuse access to .json file, what about Komento ? If you create the file, there is a reason I presume. If I block access to the file, Komento will still continue to works ? If suppose not : if the file is there, you need it no ?

Why put versions infos ? I can understand for the configuration option but why Joomla & Komento versions ?

At this stage, I've removed Komento from my site. For that reason and the number of lines in my Apache logfile (41% of my log entries are Komento; there is still an opened ticket for this topic). You've a great tool; really, but the added value; for me and for my site, is really poor so I prefer to remove it.

Thanks for your intervention and for your work.

Christophe

Hello,

It's actually pretty easy to find out the information of your Joomla site even if there are no .json files Furthermore, there is no way one can guess the hash for the file name

Hello

>It's actually pretty easy to find out the information of your Joomla site even if there are no .json files

Except if are closing these doors ;-)

I kill files like joomla.xml manifest, readme.md, changelog, install.php, ...; protect my /administrator (IP white list), deny access to .ini files, and other things like that. I try to close as many door as possible.

>Furthermore, there is no way one can guess the hash for the file name

What if someone display my webpage with his browser's debugger enabled. He'll see every ressources requested by the page in his "Network" tab. Every ressources like images, css, javascript and json file. He should not guess the filename, the network tab will list the call

I repeat : your tools are GREAT, really. No doubt on this.

For my website, the blog section is really limited and I receive very few comments on it so, I prefer to remove Komento. Because I don't really need this type of tool.

I would recommand to remove any version number in your json file.

Have a nice day.

Unfortunately there's no way to remove this currently as they are required