Detaljer: Skrevet af: Frank Jumppanen Andersen; Oprettet: 26. september 2026; Visninger: 12

Time has passed, and since original article How to use Joomla security in own php code my own coding has switched to Joomla native using Component Creator so this trick has really not been needed.

Now however I have found some smart php apps which I would like to integrate into Joomla security - so had to refer to this again - and upgrade it to work with Joomla 6.

After re-trying several several modules for integrating own php code using Joomla extension, I had to give up this aproach, and go for inclusion using iframe integration (standard Joomla wrapper option). This because it is still out of reach for me to rewrite the app's to be fully Joomla component.

....SO - here we go (again)

A litlle background info

Current case is Single File PHP Gallery - a very simple self contained gallery. I use this a lot to build easy maintainable foto albums for family reference and sharing - but I would really like to make sure pictures are not accessed directly. SFPG does a lot to ensure this - but still - if you get the direct link, the gallery is publicly accessible.

Task is to modify old Joomla 1.5 method to be included in SFPG calling

How to do it!

This way to do it is based on

passing the current session-ID from Joomla to the target-web-page in the Joomla Wrapper (iFrame)
in the target-page use the session-ID to retrieve user info from Joomla user file
using Joomla user info to decide on acces to programs
remember to keep passing session-ID!

I'll descibe the steps in details below...

Passing session-ID to target web page

To qoute the original article which is no longer accessible...

.. to pass the specific session-variable of Joomla to the iframe ....

The new concept of "Template Overrides" in Joomla 1.5.x makes it easy and there is no hack in the Joomla-core necessary. I assume knowledge about this concept, otherwise there is lot of information on the joomla-websites. You make a file in your joomla-templatey directory which should be:

your_joomla_template/html/com_wrapper/wrapper/default.php to override the core-wrapper-component.

At the beginning of the source-code - right after the default "no direct access"- lines copy this:
#################
$session =& JFactory::getSession();
$sid = $session->getId();
###################

This passes the current joomla-sessionvariable to the variable $id through joomlaspecific functions. $id must now be added to the url, which calls the iframe in Joomla-framework - to be found a litte bit below:

src="/joomla/wrapper->url; ?>"
is modified to:
src="/joomla/wrapper->url."?sessioncookie=$sid"; ?>"

Passing a sessionvariable to the iframe doesn't work in the Joomla-Framework - I don't know why. I get the error "Notice: Undefined index: sessioncookie in ..... " - sessioncookie as sessionvariable is not recognized by the iframe. url works!

To eleborate just a litle.. You have to copy the standard php file from the Joomla folder, to a new folder in Your template folder! For me that was:

kratvej28c.dk/joomla/components/com_wrapper/views/wrapper/tmpl/default.php

kratvej28c.dk/joomla/templates/ja_purity/html/com_wrapper/wrapper/default.php

...and then modify the source as described. That completes Joomla modifications! Remember to check future Joomla relases for changes to the wrapper component, and update Your modified copy as needed!

Beware! This change in template might cause problems if You use wrapper for other purposes - as other pages might take the passes sessioninfo as an error. Should this happen, You'll have to create a second copy of your template, doing the changes to this, and assign it for these specific wrapper pages - thus only passing sessioninfo to pages who need it!

I will try later to create modified version of com_wrapper to handle this...

Joomla 6 - modifications

Above article uses older Joomla. For Joomla 6 we need to retrieve session info like this:

#################
$session = Joomla\CMS\Factory::getApplication()->getSession();
$sid = $session->getId();
###################

and modify the url genration like this:

src="<?php echo $this->escape($this->wrapper->url)."?sessioncookie=$sid"; ?>"

That was not so bad - and easy to test that the ID is actually passed!

Retrieve user info from Joomla user file

Joomla keeps track of active users by maintaining records in the table jos_session in the MySQL database.

To get information on the current user, all You have to do is to check if the session ID is still found in the table, and retrieve user details.

I have written a litle php module called jos_info.php to be included in my programs. It looks like this

<?PHP

// this script access Joomla databases session-table to verify sessionid, and retrieve user info
// fields: username, time, session_id, guest, userid, usertype, gid, client_id, data

// Set flag that in parent file
// define( '_JosSession', 1 );

// no direct access
defined( '_JosSession' ) or die( 'Restricted access' );

// DB login information
$jos_username = 'testreader'; // restrict user to read just this table if possible
$jos_password = 'password';
$jos_database = 'database';
$jos_table = 'table';
$jos_host = 'host';

/****** Connect to MySQL ******/
if(!extension_loaded('mysqlnd')){
die("ERROR: PHP is not configured to connect to MySQL.");
}

// Create connection
$conn = new mysqli($jos_host, $jos_username, $jos_password, $jos_database);

// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

// Check table name to make sure....
$sql = "select * from ".$jos_table." where session_id='".sessioncookie."'";

// Execute the SQL query
$result = $conn->query($sql);

// Process the result set
if ($result->num_rows > 0) {
// check if name i filled
$row = $result->fetch_assoc();
if(!$row["username"]) {
die("ERROR: Login to access content.");
}
} else {
die("ERROR: can not find session in database.");
}

?>

Notice the 'defined( '_JosSession' ) or die( 'Restricted access' );' This is the standard Joomla way to make sure that individual php modules are not accessed directly, and this is of course adopted here as well.

Also note the check that a username iis found. Old sessions might be present, but username is empty if session has expired!

Quite a lot has changed since old Joomla 1.5 and PHP 4.x - so took some testing to get it working.......

Using Joomla user info

Now, to actually use the Joomla seesion and user info in Your own php programs, You have to add a few lines of code right in the start of the first php page.

First it is necessary to retrieve the passed sessionid (agian - a lot different now in PHP 8.3):

define('sessioncookie', htmlspecialchars($_GET["sessioncookie"]));

if (!sessioncookie) {
die("ERROR: no session!");
}
define('_JosSession', 1 ); // define for later test if module called directly
include("./jos_info.php");

The check on 'sessioncookie' is to make sure the parameter is passed - so direct call without will fail!

Note: 'sessioncookie' if defined as global constant! This to ensure it is available ofr use everywhere in the original script.

Then You have to set the flag as this IS the parent file:

define( '_JosSession', 1 ); // define for later test if module called directly

And finally You include the php module doing the rest of the checking:

include("./jos_info.php");

...and continue with original script - adding 'sessioncookie' to all relevant links!

Modifying original script

You might well end up where this is just to difficult - but in my case luckily Kenny Svalgaard has done a great job of clean structured coding.

The basic URL to the page is contained i 'phpSelf' - so basically task was:

1) modify phpSelf: var phpSelf = '".$_SERVER['PHP_SELF']."?sessioncookie=".sessioncookie."';
2) modify following parameters added - doing search & replace: phpSelf+'? ==> phpSelf+'&

...and everything is working 😊

Note the use of global constant .sessioncookie. ==== the key to success 😉

How to use Joomla security in own php code - Joomla 6 update