joomla 1.5 admin folder token - php

Question

I'm trying to harden the admin login on a Joomla 1.5+ site and though the client may go for an upgrade soon- it hasn't happened yet. I edited the administrator/index.php with this code:
/* Block access to administrator
--------------------------------------------- */
$user =& JFactory::getUser();
$secretkey = 'mytoken';
$redirectto = 'location: http://www.myurl.com';
$usertype = 'Registered';
//Check if the user is not logged in or if is not a super user:
if ($user->guest) { //|| (!$user->guest && $user->usertype == $usertype) ) {
//Check if the secret key is present on the url:
if (#$_GET['access'] != $secretkey) { header($redirectto); }
}
/* --------------------------------------------- */
This was based on someones code which I found on the web. Currently, typing www.myurl.com/administrator/ or www.myurl.com/administrator/index.php redirects to the homepage. www.myurl.com/administrator/index.php?access=mytoken displays the login. The number of login attempts has gone down but the RSFirewall! component still reports several a day.
Before I commented the 2nd half of the first if statement the code always redirected no mater what..
How are they still accessing the login page? And what could I do better?

Answer 1

Instead of hacking the core why not use one of the many plugins available that provide this functionality?
On the current Joomla Extensions Directory (JED) many of the products listed in "Login Protection" have Joomla 1.5 versions, or failing that try the Archived JED (for Joomla 1.5 extensions) you could try the Login Protection section.
If your code is after the onAfterInitialise event in /administrator/index.php then the firewall software will probably still log the access. The onAfterInitialise event is the first place an extension can "plug-in" to the Joomla! environment.
To avoid any extensions at all you probably need your code before this block:
// trigger the onAfterInitialise events
JDEBUG ? $_PROFILER->mark('afterInitialise') : null;
$mainframe->triggerEvent('onAfterInitialise');
The various security plugin usually attach themselves to this event and order themselves first with very low or even negative values which is why they work without the firewall getting to see the issue.