Joomla! Documentation - User contributions [en]

Security Checklist/Getting Started

2011-02-12T02:58:28Z

Evinyatar: /* Security matters */

{{RightTOC}}
== Read Me First==

=== Security matters ===

:Internet security is a fast moving challenge and ever present threat. There is no one right way to secure a website, and all security methods are subject to instant obsolescence, incremental improvement, and constant revision. All public facing websites are open to constant attack. Are you willing and able to invest the time it takes to administer a dynamic, 24x7, world-accessible, database-driven, interactive, user-authenticated website? Do you have the time and resources to respond to the constant flow of new Internet security issues? The [[Top 10 Stupidest Administrator Tricks]] is a comic/tragic look at what can go wrong. Don't learn these tricks the hard way! Depending on your own experience, reading the ''Stupidest Tricks'' will either make you laugh or cry. Luckily, there are some well-established principles upon which to base your defensive plans. The following checklists point you toward current best practices for Joomla security.

=== How to read these documents ===
#Not all techniques are appropriate for every level of experience. Apply the techniques you understand and read up on the ones you don't.
#Not all techniques are appropriate for every server. If you use a shared server, you must depend on the settings established by your hosting provider. If you are using a virtual or dedicated server, you can apply more creative security tactics.
#Not all security tactics are appropriate for all versions of Joomla. Where a technique applies to only one version it is noted by one of the following icons: {{JVer|1.0}}{{JVer|1.5}}{{JVer|1.6}}.

=== The most important guidelines===
:These checklists are long and growing because the full plot is thick, complex, and expanding, but don't despair! Here are a few essential guidelines for securing any website. Following them will protect you from most catastrophes.

# '''Backup early and often:''' Setup (and use and test) a regular backup and recovery process. When done well, this ensures that you can recover from almost any imaginable disaster.
# '''Update early and often:''' Promptly update to the latest ''stable'' version of Joomla! and any installed third-party extensions. This ensures that your site is protected from the newest vulnerabilities as soon as a fix is released and from the latest attack methods as soon as a defense is developed.
# '''Use a secure host''' Use a high-quality Web host. Do not be fooled by offers of 'unlimited bandwidth, unlimited hard drive space, unlimited databases, etc.
# '''Use the community''' Don't forget the truism, "If a deal is too good to be true, it is." It seems that nothing on Earth is unlimited--except perhaps the gullibility of fools and the greed of those who prey upon them. Consider hiring professional assistance if you have inadequate experience or knowledge in this area. One of the advantages of GNU software is that user support is free. Take good advantage of this by asking good questions within the [http://forum.joomla.org Joomla! Forums]. When doing so, be sure to use the the most appropriate board, such as Installation, Migration and Updating, Administration.

::The most helpful posts in the Joomla! Security Forum are converted into [[Security and Performance FAQs]]. Many of the items on this list are explained in much greater detail in the FAQs.

::You may want to read the excellent [[Beginners|Absolute Beginners Guide to Joomla!]] It has wealth of tips and tricks presented in an easy to understand format. Even experienced Joomlaists find great ideas here.

::Hunt down the many nuggets of wisdom found in the [http://forum.joomla.org Joomla! Forums], in particular the [http://forum.joomla.org/viewforum.php?f=432 Joomla! 1.5 Security Forum] and the [http://forum.joomla.org/viewforum.php?f=267 Joomla! 1.0 Security Forum].

::To receive all Joomla security announcements, subscribe to Joomla Security News. There are several ways to subscribe:

::# [http://feedburner.google.com/fb/a/mailverify?uri=JoomlaSecurityNews Automatic Email Notification]
::# [http://feeds.joomla.org/JoomlaSecurityNews RSS feed].

=== The bad news ===
#'''There is no perfect security on the Web!''' As economists would say, "There's no free lunch." Don't be fooled by Joomla's award winning ease-of-use. Maintaining a secure Web site on the open Internet is not easy. Maintaining adequate security requires a wide and ever-growing range of skills and knowledge, constant watchfulness, and a robust backup and recovery process.
#'''There's no one right way!''' Due to the variety and complexity of modern web systems, security issues can't be resolved with simple, one-size-fits-all solutions. You (or someone you trust) must learn enough about your server infrastructure to make valid security decisions. Strong security is a moving target. Today's expert might be tomorrow's victim. Welcome to the game...
#'''There's no substitute for experience!''' To secure your Web site, you must gain real experience (some of which will be bitter), or get experienced help from others. If you haven't invested the considerable time it takes to learn how to maintain a secure Web site, be sure you can consult with someone who has. Read this tongue-in-cheek description of the [[Top_10_Stupidest_Administrator_Tricks|Top 10 Stupidest Administrator Tricks]] which illustrates typical, blow-by-blow examples of how to learn Web security the hard way.

=== The good news ===

#'''Even a beginner can start at the head of the herd''' User forums for many systems are clogged with [http://www.google.com/search?q=Help!+I've+been+hacked Help! I've been hacked] posts by people who did NOT follow standard security practices. If you are studying this checklist before your site is attacked, congratulations, you're already ahead of the herd.
#'''It's not as hard as it looks''' If this is one of your first websites, security issues may seem overwhelming, but you don't have to deal with all of them at once. Start with the most critical issues. As you become more familiar with [http://www.gnu.org GNU] tools and techniques, including [http://www.gnu.org/ GNU/Linux], [http://www.apache.org Apache], [http://www.mysql.com MySQL], [http://en.wikipedia.org/wiki/SQL SQL], [http://www.php.net PHP], [http://en.wikipedia.org/wiki/HTTP HTTP], [http://en.wikipedia.org/wiki/CSS CSS], [http://en.wikipedia.org/wiki/XML XML], [http://en.wikipedia.org/wiki/RSS RSS], [http://en.wikipedia.org/wiki/TCP/IP TCP/IP], [http://en.wikipedia.org/wiki/FTP FTP], [http://subversion.tigris.org/ Subversion], [http://en.wikipedia.org/wiki/JavaScript JavaScript], and [http://www.joomla.org Joomla!], you'll add refinements to your set of security tactics.
#'''You can get help''' If you believe your website was attacked, '''do not''' simply post an announcement with full details in the Joomla! forums. If you are dealing with a new vulnerability or new form of attack, publishing that information could put other websites at risk. Instead, report possible security vulnerabilities to the [http://developer.joomla.org/security/contact-the-team.html Joomla! Security Task Force].

== Security Checklists Table of Contents==
# [[Security Checklist 1 - Getting Started|Getting Started]]
# [[Security Checklist 2 - Hosting and Server Setup|Hosting and Server Setup]]
# [[Security Checklist 3 - Testing and Development|Testing and Development]]
# [[Security Checklist 4 - Joomla Setup|Joomla Setup]]
# [[Security Checklist 5 - Site Administration|Site Administration]]
# [[Security Checklist 6 - Site Recovery|Site Recovery]]


[[Category:Security Checklist]]

== Edited by==
[http://forum.joomla.org/memberlist.php?mode=viewprofile&u=39784 rliskey]

J2.5:What's new in Joomla 2.5

2011-01-26T14:51:34Z

Evinyatar:

The principal changes introduced in Joomla 1.6 are:

* '''New Access Control System''' - Allows site administrators control over who can view and manage content.
* '''Unlimited Depth Organizational Model''' - Gives site administrators and content creators user-defined category levels that allow for the creation of a category tree with as many or as few levels for organizing articles and other content as needed.
* '''One-Click Extension Updates''' - Allows users to keep sites secure and controlled by simplifying the process of updating extensions.
* '''Semantic XHTML Layouts''' - Provides a better baseline for content presentation.

The following is a more complete list of changes.
==Administrators==
===Introduction===
*Consistent UI
*Consistent Features
*Richer sample data
*IE 7+, Firefox 3.x, Safari 4.x
*PHP 5.2.4+
*MySQL 5.0.4 (allows for wide varchars)

===Administrator===
*Menu Changes
*Submenu consistency

====Toolbar Features====
*Save
*Save & Close
*Save & New
*Save as Copy
*Expired session will return to the page you were on when you got logged out (can be hit and miss)
*Most search filters allow you to search for a record id via [ id:123 ]
*"Parameters" are now referred to as "Options"
*Template Styles
*Integrated Trash Management
*Consistent archive support for most content
*Extension Installer Improvements

===Module Enhancements===
*Publish up and down
*Add option to display on all pages "except" selected
*Expanded Category System
*404 Page Redirection
*Better Menu Management
*Alternative layouts for content, modules and menus (taken from the home template)

===New Templates===
*Atomic
*Beez2
*(Administrator) Bluestork (replaces Khephri)
*(Administrator) Hathor
*Legacy layer in Milkyway
*Backend supports layout overrides
*New Modules
*New Plugins
*Content Languages
*User Login Permissions
*Activate selected users from the user list now (and filter)
*Administrator registration approval
*Polls component removed
*New codemirror editor

===SEO Improvements===
*Meta decription and keywords for categories
*Articles can change the page title and page header separately

===Global Configuration===
*Add site name to titles
*Default Access Level
*Set Metadata Language (buggy)
*Unicode Aliases
*Cookie domain and path
*User Setting moved to User Manager -> Options
*Media Settings moved to Media Manager -> Options
*Server Timezone now a location, not an integer offset
*New Global Permissions tab

===User Manager===
*Can activate a user from the list now
*User can be assigned to multiple groups
*Manage user groups
*Manager content access levels

===Media Manager===
*Flash uploader fixed

===Menu Manager===
====Menus List====
*Rebuild button to press when you brick the menu
*Clicking the menu name brings up the menu items list rather than going into Edit Menu. To edit the menu, click on the check box next to the name and click on the Edit icon in the toolbar.

====Items List====
*Menus support the language filter
*Default now called Home
*Home is now clickable in the menu item list
*A separate home can be set for different languages

=====New batch operations=====
*Set access level
*Copy or move to another part of this or another menu

====Edit Item====
*Improved "Type" selector with human readable view and layout names
*Note field added
*New window target
*New Language assignment
*New Template style
*Ability to add & edit Module assignments from this page
*Ability to create alternative menu items with customised parameters
*Ability to create multiple alternative layouts for one template

=====New options for the menu links and pages themselves=====
*Link title attribute
*Link CSS style
*Menu image is changed to a modal selector
*CSS class for page heading
*Page meta description
*Page meta keywords
*Robots options

===Articles Manager===
*Frontpage is now referred to as Featured
*Article manager uses submenu to quickly skip between articles , categories and featured
*Sections and categories are now merged.

====Articles List====
*''"Missing move and copy; filter by author"''
*New column to show language
*Filtering by language available

====Article Edit====
*Created by user now selected by modal popup
*New ability to set the page title from the article
*Define create, delete, edit and publishing permissions

====Archived Articles====
*In 1.5, Archived Articles had to first be changed to Published or Unpublished before update.
*In 1.6, an Article with an Archived Status *can* be changed without changing the State first.

===Categories===
====Category List====
*Nested view
*Filtering on language

====Edit Category====
*New note field
*Section replaced with ability to assign a parent category
*Ability to assign content language

=====New Options (not previously available in 1.5)=====
*Assign alternate layout
*Define create, delete, edit and publishing permissions
*Meta description
*Meta keywords
*Alternative page title
*Meta author
*Meta robots

===Banners===
====Banners list====
* Missing copy toolbar button
*New archive toolbar button
*New columns to show meta keywords, purchase type and language
*New filtering by client and language

====Edit Banner====
*New type toggle for Image or Custom (dynamically changes the available form fields)
*New alt text field for image
*New language field

=====New Options=====
*Ability to set the created date
*Ability to set start and finish publishing times
*Ability to set the purchase type
*Ability to track impressions
*Ability to track clicks
*Use own prefix ?
*Tags renamed to meta
*Contacts
*Messaging
*Newsfeeds
*Search
*Weblinks
*Redirect

===Extensions Manager===
====Discover====
*Module mgr
*Plugin Mgr
*Template Mgr
*Language mgr

===Templates Manager===
*Options - allows you to enable/disable the tp=1 feature

===Misc===
*Auto create linked contact when creating new user ??

==Access Controls==
*Introduction
*User Groups
*Access Levels
*Permission Layers
*How Permissions are Inherited
*How to debrick your site

==Developers==
===Introduction===
*PHP 5.2.4+
*MySQL 5.0.4 (allows for wide varchars)
*IE7+, Firefox 3+, Safari 4+
*Focus on code consistency
*Focus on code reduction

Usage of PHP Native Functions where possible, for example:
*[[JXMLElement]] extends the native [http://php.net/manual/en/book.simplexml.php SimpleXML] class
*[[JDate]] extends the [http://www.php.net/manual/en/class.datetime.php DateTime] class
*Native INI parser to load languages

===Removed features===
*ADODB compatibility methods in database classes
*DOMIT (unsupported XML library)
*Legacy mode (includes global $mainframe, etc)
*JTemplate (based on patTemplate)
*patTemplate (templating engine)
*PDF support
*PEAR libraries (due to license incompatibilities)
*phpgacl
*PHP 4.0 and 5.0 compatibility files
*XStandard Editor

===Deprecated Features===
*JController::_acoSection
*JController::_acoSectionValue
*JController::authorize()
*JController::setAccessControl()
*JDatabase::stderr()
*JDate::offest
*JDate::setOffset()
*JDate::toFormat() - use JDate::format() instead
*JException::toString()
*JFactory::getXMLParser()
*JHtmlBehavior::mootools() - use JHtmlBehavior::framework instead
*JHtmlGird::access()
*JHtmlImage::administrator - use JHtml::image instead
*JHtmlImage::site - use JHtml::image instead
*JHtmlList::accesslevel()
*JHtmlList::specificordering() - use JHtml::_('list.ordering')
*JHtmlList::category()
*JHtmlSelect::optgroup() - see JHtmlSelect::groupedList()
*JLanguage::_parseLanguageFiles - renamed to parseLanguageFiles
*JLanguage::_parseXMLLanguageFile - renamed to parseXMLLanguageFile
*JLanguage::_parseXMLLanguageFiles - renamed to parseXMLLanguageFiles
*JObject::toString - replaced with magic method
*JRegistry::getNameSpaces()
*JRegistry::getValue()
*JRegistry::makeNameSpace()
*JRegistry::setValue()
*JPane - See JHtmlSliders
*JParameter - replaced by JForm
*JSimpleXML, JSimpleXMLElement - Use JXMLElement instead, based on the native SimpleXMLElement
*JTable::canDelete() - models or controllers should be doing the access checks
*JTable::toXML()
*JToolbarHelper customX(), addNewX(), editListX(), editHtmlX(), editCssX(), deleteListX()
*JUser::authorize() - Use JUser::authorise()
*JUtility::dump()
*JUtility::array_unshift_ref() - Not needed in PHP 5
*JUtility::getHash() - Use JApplication::getHash()
*JUtility::getToken() - Use JFactory::getSession()->getFormToken()
*JUtility::isWinOS() - Use JApplication::isWinOS()
*JUtility::return_bytes() - See InstallerModelWarnings::return_bytes()
*JUtility::sendMail() - Use JFactory::getMailer()->sendMail()
*JUtility::sendAdminMail() - Use JFactory::getMailer()->sendMail()
*JXMLElement::data() - Provided for backward compatibility
*JXMLElement::getAttribute() - Provided for backward compatibility

===Database===
*JTable now automatically looks up the fields from the database schema
*New JDatabaseQuery - A chained CRUD query builder
*New JDatabase::getNextRow
*New JDatabase::getNextObject
*JDatabase::loadAssocList - Now takes a second argument to just return the value of a column
*JDatabase::setQuery - Added chaining support

====Important Schema Changes====
*New jos_extensions table to list all extensions
*Components table information moved and split between jos_extensions and jos_menu (special menu called _adminmenu)

The old phpgacl (jos_core_acl*) and jos_groups tables have been reworked into:
*jos_assets
*jos_user_usergroup_map
*jos_usergroups
*jos_viewlevels
*Archived state changed from a value of -1 to +2

===Improved MVC===
====Models====
*JModelList
*JModelForm
*JModelAdmin
*Format handling (eg JSON)
*Sub-controller handling

====Controllers====
*JControllerForm
*JControllerAdmin
*JController::setMessage takes second arg to set the message type
*JController can set the default view
*Added chaining support to several JController methods

====Views====
*Semantic core output
*Milkyway legacy layouts
*The old component parameters are not automatically added to the menu anymore. You need to explicitly put them in the layout XML files.
*The menu manager will now detect additional layouts for a given view in the default template.

===Form API===
====Event manipulation====
*onContentPrepareForm
*onContentPrepareData

===Translation and Language Support===
''See [[International Enhancements for Version 1.6]] for a more complete list of changes in internationalisation features.''
*Support for unicode slugs, eg, SEF URL's with Greek characters
*3-letter languages now supported, xxx-XX
*All existing language keys have been refactored

====INI files must validate====
*Upper case key with no spaces, alphanumeric characters and underscores
*Quoted values
*Double quotes within literal strings must use _QQ_ in the form KEY="<a href="_QQ_"index.php"_QQ_">Click</a>"

====Javascript translation layer====
*See the flash uploader script for an example
Local extension language files

====Language file API====
*Pluralisation support
*Transliteration support for ASCII or Unicode slugs
*Ignore Search Words
*Minimum search word length
*Custom language overrides
*System language file to support administrator menu and installation (.sys.ini)

====Language switcher====
*Language Filter plugin enables language switching
*Sets the automatic filtering via JFactory::getApplication()->setLanguageFilter(true)
*A frontend component with language support would test JFactory::getApplication()->getLanguageFilter(), which returns the selected language code from the Languages Module
*The language field can be a language code for a single language, or "*" to be displayed for all languages
*Community extension for language maintenance com_localise

===Extension management===
See /tests/_data/installer_packages/ for complete examples of all extensions and manifests.

====New installation types====
=====Libraries=====
*Must include an XML manifest where type="library"
*Can only be installed into a sub-folder of /libraries/
*Can extend parts of an existing library, eg /libraries/joomla/database/database/oracle.php

=====Packages multi-installer=====
*Must include an XML manifest where type="package"
*A package is a zip of zip's

New install script can be provided with 5 methods:
=====preflight=====
*Runs before anything is run and while the extracted files are in the uploaded temp folder

======Could allow for:======
*secondary extraction of custom zip's
*version checks to be performed
*halting the installer on an error

=====install / update=====
*Runs after the database scripts are executed
*If the extension is new, the install method is run
*If the extension exists then update method is run if method="upgrade", otherwise assumes that the extension is not meant to be upgradable

=====postflight=====
*Runs after the extension is registered in the database
*Is not run for the uninstall process (nothing left to do obviously)

====Discover====
*Does not do any file copying, only works with what it finds
*Performs preflight, install and postflight
*Developer of installer has two language files??

====Update site====
*Can publish an XML manifest on your site that can include individual extensions and extension sets.

====XML Manifest Changes====
*<install> is deprecated - use <extension>
*New <update> tag. Takes a <schemas> tag which can define <schemapath>
*<params> and <param> tags are deprecated, use <fields>, <fieldsets> and <field> instead

====File changes====
*Installation manifest must be the same name as the extension, eg com_foobar/foobar.xml This helps with discovery (otherwise the function has to go through all the files in the extension folder
*Plugins are now in folders like modules and components
*See SVN/tests/_data/installer_packages/ for complete examples of all extensions and manifests.
*The method="upgrade" will compare individual files in the original and incoming manifests and will remove files as appropriate. However, it will not remove differences in the <folder> tags.
*Future support for rollback

===Events===
====New Events====
*onBeforeCompileHead
*onBeforeRender
*onContentBeforeDelete
*onContentAfterDelete
*onContentChangeState
*onContentPrepare
*onContentPrepareData
*onContentPrepareForm
*onExtensionBeforeInstall
*onExtensionBeforeUpdate
*onExtensionBeforeUninstall
*onExtensionAfterInstall
*onExtensionAfterUpdate
*onExtensionAfterUninstall

====Renamed Events====
*onContentAfterSave
*onContentAfterTitle
*onContentAfterDisplay
*onContentBeforeDisplay
*onContentBeforeSave
*onContentSearch
*onContentSearchAreas
*onUserAuthenticate
*onUserAfterDelete
*onUserAfterSave
*onUserBeforeDelete
*onUserBeforeSave
*onUserLogin
*onUserLogout
*All content events (except for search and search areas) now pass a 'context' as the first argument to alert the plugin as to what type of content is being passed. The plugin event may or may not heed this context.

===Categories===
*Component can provide custom options for its own categories via optional category.xml
*Supported via JTableNested

===Access Controls===
*A thing that can be controlled by permissions is registered in the assets table
*JTable handles this transparently via asset_id field
*For view permissions, support is as simple as adding
<source lang="php">
$user = JFactory::getUser();
$groups = implode(',', $user->authorisedLevels());
$query->where('a.access IN (' . $groups . ')');
</source>

For action permissions, same format as in 1.5:
<source lang="php">
$user->authorise($actionName, $assetName)
</source>
*OpenID library has been removed
*Geshi library moved to plugin folder
*JRegistry notes defaults to JSON (new format), dynamically converting existing data in INI format
*New JStream
*New JApplicationHelper::getComponentName
*Core icons moved to /media/
*Backward incompatible change to JEditor::display
*Added chaining support to JMail
*JFilterInput can no longer be called statically
*JHtml::image now supports relative paths
*All system images are overridable in the default template
*New JHtmlString
*Added wincache session handler for IIS
*New JFilterOutput::stripImages
*JPath::check takes second arg for separator (to pass to JPath::clean)
*Expanded configuration support through config.xml (multiple tabs)

====Core actions====
*core.login.site
*core.login.admin
*core.admin
*core.manage
*core.create
*core.edit
*core.edit.state
*edit.own
*core.delete
*Miscellaneous changes

===Debug Plugin===
*More tools for assisting with translation

===JavaScript===
Some JavaScript (noteable the submitform() and submitbutton() functions have been namespaced and changed to expect id="adminForm" instead of name="adminForm". It is still possible to use name="adminForm" with these functions in Joomla 1.6, however this functionality will likely be removed in the next version.
Some old, non-namespaced, functions, for example isChecked() and changeDynaList(), still need name="adminForm". So if you need to use one of these functions you need to use both and id="adminForm" and name="adminForm" or you overwrite Joomla.submitbutton() to customize it, there are some examples of the latter in backend edit layouts.
====Deprecated====
*submitform() - use Joomla.submitform() instead
*submitbutton() - use Joomla.submitbutton() instead

====Mootools 1.3====
*Need to use document.id instead of $

==Cache changes ==
===API changes relevant to 3rd party developers===
====Component view cache====

Component view cache now takes an array of url parameters and their types to create Cacheid. This is a replacement for a previous unsafe way which took the whole URL for this and so opened the doors for DOS attacks via random url parameters added to request URL's.

Com_contact example:

<source lang="php">
$safeurlparams = array(
'id'=>'INT',
'catid'=>'INT', 'limit'=>'INT',
'limitstart'=>'INT',
'filter_order'=>'CMD',
'filter_order_Dir'=>'CMD'
);

parent::display($cachable,$safeurlparams);
</source>

Old cacheid created from URL was retained for backwards compatibility and takes effect if there are no $safeurlparams.

====Module cache====
This has been completly reconceptualized. Module cache now has 5 different modes of operation, 3 of them are to be set from module XML file, while 2 are meant to be used from within the module itself. Default is backwards compatible oldstatic mode that requires no changes to a module.

Modes to be set in XML:
*'''static''' - one cache file for all pages with the same module parameters
*'''oldstatic''' - 1.5. definition of module caching, one cache file for all pages with the same module id and user aid. Default for backwards compatibility
*'''itemid''' - changes on itemid change

In addition to cache field that was required in 1.5 there is now another hidden field called cachemode that sets any of the above modes.

<source lang="xml">
<field name="cachemode" type="hidden" label="" default="static">
<option value="static"></option>
</source>

Modes to be called from inside the module:
*'''safeuri''' - id is created from $cacheparams->modeparams array, the same as in component view cache
*'''id''' - module sets own cache id's

To use this modes one must rename cache field in xml to owncache field and call JModuleHelper::ModuleCache from within the module's main php file. This is actually a shortcut to cache callback to avoid code duplication in every module.

An example that uses safeuri mode and replaces uncached
$list = modRelatedItemsHelper::getList($params) :

<source lang="php">
$cacheparams = new stdClass;
$cacheparams->cachemode = 'safeuri';
$cacheparams->class = 'modRelatedItemsHelper';
$cacheparams->method = 'getList';
$cacheparams->methodparams = $params;
$cacheparams->modeparams = array('id'=>'int','Itemid'=>'int');
$list = JModuleHelper::ModuleCache ($module, $params, $cacheparams);
</source>

====Functional changes====
'''Cache administration (Clean cache, Purge cache) now works with all drivers''', not only with file cache.
'''New standalone garbage collect script''' that is to be called from crontab has been added. It can be found in libraries/joomla/utilities/garbagecron.php . For safety reasons it is recommended that it is renamed to something unique.

====CMS and framework level functional changes====
'''Caching is implemented in all components and modules''' that can potentially gain from cache.
Caching has also been added to some most expensive and frequent framework calls JComponentHelper::_load(), JModuleHelper::_load(),JMenuSite::load();

====Cache library changes====
Cache library has been completely refactored.
*Cache '''handlers have been renamed to controllers''' to better reflect their role and avoid confusion with cache storage handlers (referred to as drivers in following text).
*'''New JCacheController''' parent class has been added and inheritance has been changed to prevent bugs occurring from controller's and storage handler's get method clashes.

====JCache====
*'''getAll()''' method was added to JCache, JCacheStorage and all drivers, and it returns all cached items (this was previously possible only with file driver and hardcoded in administration)
*New '''lock and unlock''' methods were added to JCache, JCacheStorage and drivers. They enable cache item locking and unlocking to prevent errors on parallel accesses and double saves. This functionally was also implemented in controllers.
*Workarounds are now consolidated in new '''JCache getWorkarounds and setWorkarounds''' methods, are now used by all controllers and their use has been made optional.
*New makeId() method in JCache that creates cache id from registered url parameters set by components and system plugins

====JCacheController====
New parent class to Controllers that also functions as an intermediate to JCache. There is no JObject inheritance as otherwise magic __call doesn't work.
Change was needed to prevent bugs occurring from controller's and storage handler's get method clashes. They could be renamed but this would break backwards compatibility.

====JCacheStorage====
*_getCacheId method was moved from drivers to their parent JCacheStorage and all drives now use the same method by default
*CacheItem was moved from cache admin to framework JCacheStorageHelper, it is used by getAll
*There are new cachelite and wincache drivers. All other drivers have been fixed with missing functions (gc, clean) added, their code cleaned and tested they should be now working properly.
*Replaced separate _expire files in filecache driver with timestamps (this should amount to cca. 40% speed gain). The same in all drivers that had this.
*Numerous bugfixes on all levels, most important is proper use of options defaulting to configuration parameters settings and correctly passing from level to level.

====Other framework level changes====
*Safe url parameters registration added to JControler view method.
*New ModuleCache method in JModuleHelper that performs the above described module cache (in 5 modes) for both, modules and module renderer.
*JFactory::getFeedParser has been changed to use Joomla caching instead of simplepie's.

==Performance==
===Eliminate the usage of JTable for general browsing on the frontend===
*Session drops the usage of JTable
*Item views use a dedicated question, not JTable->load

==Known Issues==
*Scaling issues to address

==Notes==
===Releases===
*Alpha 1: 22 June 2009
*Alpha 2: 25 October 2009
*Beta 01: 18 May 2010
*Beta 02: 31 May 2010
*Beta 03: 14 June 2010
*Beta 04: 28 June 2010
*Beta 05: 12 July 2010
*Beta 06: 26 July 2010
*Beta 07: 09 August 2010
*Beta 08: 23 August 2010
*Beta 09: 06 September 2010
*Beta 10: 20 September 2010
*Beta 11: 03 October 2010
*Beta 12: 17 October 2010
*Beta 13: 31 October 2010
*Beta 14: 14 November 2010
*Beta 15: 29 November 2010
*Release Candidate 1: 13 December 2010
*Version 1.6.0 released 10 January 2011

==Infographic==
There's an official [http://downloads.joomlacode.org/frsrelease/6/0/2/60295/joomla-1-6-infographic-official-MC.jpg Joomla 1.6 infographic] available, which shows 10 of the new functions with screenshots.

[[Category:Joomla! 1.6]]