Hi there - I’m having some trouble with URLs in the CP after updating to 2.3.0. I think part of it has to do with what my usual practice has been previously, which was to login by visiting domain.com/sysfolder. That then carries the system folder segment into the CP URLs. And that always worked before. I would wind up with a CP URL for the template manager of domain.com/sysfolder/index.php?D=cp&C=design&M=manager
Following an update to a site I’m working on now from 2.2.1 to 2.3.0, I’m getting some issues. The URLS in the CP appear to have changed because now the documentation refers to logging in to the control panel via domain.com/admin.php. And that affects the URLS within the CP. The URL for the template manager now seems to be http://domain.com/admin.php?D=cp&C=design&M=manager. If I log in to the system through my sys folder, the CP nav URLs seems to alternate between index.php and admin.php - and any of those that use admin.php won’t work because the sysfolder segment is still part of the URL throughout.
So while I think I’ve figured out what the issue (clearly i need to get in the habit now of logging in through domain.com/admin.php) I still want to ask a couple of questions about it.
My usual practice with EE sites had been to rename the system folder to something obscure known only to me and my client, as per the user guide’s recommendation. I had not yet gone to the added step of moving the system folder above the root but was likely to start doing so in the next couple of sites i worked on. And so to log in to the CP I would visit domain.com/sysfolder
With 2.3 (or perhaps slightly earlier and I simply hadn’t noticed the same issues), EE expects domain.com/admin.php to be the point of login and admin.php in the URL cues EE to its administrative functions.
I don’t mind that - in fact it kind of makes sense, but my question is this - why lose the systemfolder from the URL? The obfuscated systemfolder name was an additional means of security, wasn’t it? And moving above the root was another? Wasn’t making it harder for an unauthorized person to even arrive at the login screen intended as a measure of security?
I don’t have server security or admin experience, so this may be a naive question, but doesn’t the simplification of the URL make it easier for someone to get to the login screen and take away the benefit changing the system folder name had? Or was that more a means of protection from another kind of infiltration?
Thanks!