security disable module install or module upload on prestashop 1.7 and 1.6

[Zohaib-fk]

Hi,

I want to know is it possible to disable new module install on prestashop version 1.7 OR disable module upload from back-office.

Some settings in settings files or database.

This will help to prevent hackers from uploading module from back-office and executing bad php scripts from prestashop store.

On my demo instance someone installed modules and disturb the demo instance.

I know about disable left menu option from ps_tab table improve set to 0.

Also is there any way to find suspicious files or folders not part of prestashop. My web hosting support team was able to help me to find suspicious files when my wordpress website was hacked.

Any idea?

Edited August 4, 2018 by zohaib82 (see edit history)

[Zohaib-fk]

I got the solution and want to share with community.

On version 1.7 , need to comment return value of the function.

root/src/PrestaShopBundle/Controller/Admin/ModuleController.php

 

protected function getToolbarButtons()
{
    $translator = $this->get('translator');

    // toolbarButtons
    $toolbarButtons = array();

    if (!in_array(
        $this->authorizationLevel($this::controller_name),
        array(
            PageVoter::LEVEL_READ,
            PageVoter::LEVEL_UPDATE,
        )
    )) {
        $toolbarButtons['add_module'] = array(
            'href' => '#',
            'desc' => $translator->trans('Upload a module', array(), 'Admin.Modules.Feature'),
            'icon' => 'cloud_upload',
            'help' => $translator->trans('Upload a module', array(), 'Admin.Modules.Feature'),
        );
    }

   // return array_merge($toolbarButtons, $this->getAddonsConnectToolbar());
}

 

On version 1.6 

root/adminfolder/themes/default/template/controllers/modules/page_header_toolbar.tpl

 

{block name=toolbarBox}

{/block}

 

Edited August 4, 2018 by zohaib82 (see edit history)