Some people may be curious about the title I’ve chosen for this article.  Before people become concerned about my state of mind—am I really not going to write about Kunena anymore or is this the end of my {kun´ēzē} business—I have a few words to say about recent changes in this popular Joomla extension.  There are a couple of hidden surprises in the latest versions of Kunena that may make you think twice about wanting to install them.

At the outset, you do not need to be alarmed or feel nervous that the latest version will make your websites any more vulnerable than what they currently are.  The changes in Kunena version 4.0.12 [K 4.0.12] and 5.0.2 [K 5.0.2] will not make websites any more or less secure than the previous releases.  There have been a couple of minor technical improvements—those are the facts—but there have also been changes that may upset some people:  one change, in particular, that challenges the reasons people choose Kunena in the first place!  The good news is that the “last word” in this article will help reduce those fears.

Background

I built this website a couple of years ago with the intentions of (a) providing a premium question-and-answer centre to help people with Joomla and, in particular,  Kunena, (b) an opportunity to sell or share my software (including templates for Kunena) and (c) providing a personal commentary and advice with my ’blog. Without going into specifics, my intentions and objectives have shifted towards a more general Joomla focus instead of being solely “devoted” to the Kunena brand.

My regular readers will have observed that I have downplayed my Kunena templating products; I do not have the time to maintain or support alternative templates for Kunena and, being truthful, I don’t use them myself.  I’ve systematically overhauled the downloads page; the Kunena templates that I’d written are no longer available.  The downloads page does contain a few original extensions I’ve written and tested for all versions of Kunena used on sites that I currently operate.  I’ve also written other extensions—some that are free and some that people have to pay to download—and I continue to support my products.  In effect, I don’t want to be labelled as “the Kunena guy”; the title is too restrictive and there's no profit in operating like that.

A secondary reason for retreating from the “Kunena business” was a “difference of opinion” (shall we say).  Basically I’ve had enough of continually being attacked as an incompetent, ignorant fool—I still haven’t received any apology and I’m still outcast by the Kunena team—so I decided that the latest episode in a one-sided feud was a good opportunity to excuse myself quietly without further pain; to leave the helping-out at the Kunena forum to the people who’ve created the problems in the first place.  I’m happy and I think they are, too.

The third reason for me “leaving” Kunena is because it has became too difficult to obtain reliable and up-to-date information about what’s happening.  Aside from the culture of secrecy[1] involved in the project, (a) the Kunena developers rarely answer anyone’s questions, (b) when they do respond, the answers are abrupt, vague or incomprehensible and (c) the “support site” is almost impossible to navigate.  While it could be said that the layout of any website is a matter of aesthetics (or personal preference), the Kunena site is a muddle for novice and experienced consumer alike who are not interested in the overcrowded, cluttered, in-your-face advertising[2].

Every website is a business in some form or another and the first order of business is to cover your operating expenses.  You can (a) charge people to pay to view your site, (b) encourage people to donate their time and/or money to help with your running costs and/or (c) obtain revenue via in-site advertising.  The success of your business depends on how well others enjoy doing business with you, whether they’ll visit your site, buy your products or refer others to your site and do the same and, hopefully, give you some profit at the end of the day.  This website is no different.  There are a couple of advertisements that appear on the pages—I certainly appreciate the tiny click-rate revenue they give me—but, I hope, they’re not too invasive.  The point that I’m trying to make is that the Kunena site is swamped with advertising material; the over-use of advertising seems to defeat the purpose of its existence.  How a site owner designs their site and runs their business is entirely up to them, of course; I’m not suggesting otherwise.

K 4.0.12 and K 5.0.2

The latest two releases of Kunena contain fixes for a couple of relatively minor, “known” technical problems.  The main purpose of these releases, however, is to encourage existing Kunena users to update their forum software (to K 5.0.x—ultimately—but more about that later) and add a new “feature” to the credits page.  This section discusses the implications of that “feature” and what you may want to do about it.

If you have not disabled the Kunena update sites (more about that later) and depending on what version of Kunena you have installed, you will see one of the three update availability notifications shown below (click to enlarge the images).

Pay particular attention to the information at the top of the page, viz. “Before updating please ensure that the update is compatible with your Joomla! installation”.  If you are unsure then do not update (in any event it is a good idea to backup your website before updating any Joomla extensions).  If you have K 3.0.8 installed then, after installing K 4.0.11, you will be prompted to update to K 4.0.12.  If you have K 4.0.12 installed then you will further be prompted to update to K 5.0.2.

If you are currently using the Blue Eagle template[3] in Kunena then you will lose it; K 5.0 does not support Blue Eagle or other third-party templates derived from it.

By default, Kunena puts two links at the foot of every forum page.  The first is an internal link within your site with the caption “Powered by” which is a link to the forum credits page; the second link has the caption “Kunena forum” and it is a direct link to the Kunena website—in internet terminology, this is called a backlink.  There is nothing specifically wrong, nor is it a legal requirement of the Kunena software licensing[3], with retaining or removing these links.

Kunena credits page

Before the latest updates …

Depending on what version of Kunena you have installed, if you using either K 4.0.12 or K 5.0.2, you will see one of these kinds of forum credits pages demonstrated in the following images (click to enlarge the images).

The purpose of these pages is two-fold:  (a) as a way for the Kunena team to inform you who was involved in developing the software that you have installed and to thank the community for keeping the product open-source, and (b) so these links are crawled by the search engines to give people a rough idea of how many[5] Kunena forum sites exist on the internet.  Although these pages are “advertising” for Kunena, they’re fairly innocuous; they don’t cost you anything and they don’t hurt your website.

I have never been concerned about having these links on my website(s) until the latest versions of Kunena were released.  Some people are not as tolerant as me and the question “how to remove the powered by Kunena text″ is frequently discussed on the internet.  Various reasons have been put forward as to why it people require the “Powered by Kunena″ text and links [PBK] to be removed, including (among others),

I'm pretty sure the deliberate effort to force users to display the Powered by Kunena link is contradictory to the terms of GPL (all versions).forum user, Kunena Forum, 24-Jul-2012

This is untrue:  there is nothing in the GPL states that backlinks somehow violate to the licence provisions.

My portal is for an intranet:  some users do not have internet [connectivity and therefore these] links don’t work.  If I [could choose, I would remove the links and] … my boss [doesn’t like them because they are] “not are visual and pretty”; and I have 3 of them!  [Can I] make a donation to [remove these things]?another forum user, Kunena Forum, 19-Jun-2013

There are ways to hide the credits page including with the use of CSS or by hacking the Kunena software.  Neither of these methods is satisfactory because (a) although using a {display: none} rule will visually remove the text, search engines will still discover those links and (b) you will have to hack the code again every time there is a software update.  Even so, is this just a storm in a teacup or has something changed to re-open the case for removing the credits page and backlinks?  The point that needs to be made is that no “donation” (or polite request) to the Kunena project will help you completely remove all traces of the “Powered by Kunena Forum” text and links.

After the latest updates …

You will see what I mean by the new “feature” on the credits page by looking at the screenshots shown below (click to enlarge the images).

As you can see, the effect of this change is to covertly install advertising (and the means to generate revenue) for the Kunena project.  Although there is nothing legally wrong with this approach, it was done without my permission.  I don′t know about you but I did not build my website as a launch-pad to solicit donations for the Kunena team.  Further, as I clearly state in the terms of use on this site,

7.2 Any attempts to solicit commercial business through the use of this website are strictly prohibited, except where explicitly allowed.Site terms of use, 20-Jun-2015

No-one asked my permission and I did not give my permission for my site to be used in this way.  As I said, although this is not technically illegal from the Kunena team’s perspective, it’s in violation of my own site’s conditions (and it may be against your wish, also) and this causes a problem.  Furthermore, this “donate [to the Kunena team]” button has confused some members of the community with questions like the following being posted on the Kunena forum:

[Do I need to pay to] remove “Powered by Kunena”?a forum user, Kunena Forum, 5-Oct-2016

This developer’s response[6] is shown in the screenshot on the right (click to enlarge the image).  The reply basically intimates that people can remove this link if they want and that the team is “looking for a plugin that will remove the code”.  I strongly doubt that the eventual plugin will be shared with the community free of charge.  Why would someone add a feature—to obtain money from it—and then release an optional extra to disable it at no cost?  That doesn’t make any sense to me.

Updated 28-Jan-2017The Kunena team have released their Powered By Remover plugin[7] today at a cost of EUR 10.00 which is equivalent in cost—for this one product—to double the cost of purchasing all of the extensions that I've developed. My readers can draw their own conclusions.

Updated 18-Jan-2018I read on the Kunena forum today [8] a number of false claims made by people that the Cleaner for Kunena plugin which I developed is “dodgy”, “does not work anymore” and my method removes the Powered by Kunena notice through CSS.  All of these claims are false.  It is disappointing that people will use other forums to discredit honest developers instead of bringing their complaints directly to those who have developed products and market them in accordance with the strict requirements of the Joomla Extensions Directory policy.  Unfortunately, because I am unable to respond directly to those libellous comments, I have to suffer this kind of abuse in silence.

If people have problems or concerns with any product purchased here, they can bring them to my attention and I am sure we can resolve these things properly instead of making false and unsubstantiated allegations elsewhere.

The main problem with this feature, in my opinion, is the way it leverages everyone’s website as a revenue stream for the project, costing the developers nothing to turn our sites into advertising portals while we, who maintain the infrastructure, get no financial benefit in return!

Protect against the “XML discovery” method to find out what version of Kunena you’ve installed

Did you know that most people can discover what version of Kunena you’ve installed on your site without logging in to the backend?  This isn’t a bug and it’s not a secret; you do not even need the component enabled or any visible menu items on the frontend.  As long as you have Kunena installed—any version of it—the only thing people need to do is enter the following URL into their web browser:  <yoursitename>/administrator/components/com_kunena/kunena.xml.  Anyone can then discover if, for example, you are using K 2.0.3, K 3.0.7, K 4.0.5, K 5.0.1 … just about any version you care to name!

Fortunately there are several ways that you can prevent people snooping around your site to discover what kinds of software you may have installed; you may already have security methods implemented to deal with such threats.  One way (and it’s not the only method) is to add a few lines of code to the .htaccess file in your site root directory, like this:

If you are serious about protecting your trade secrets, I recommend you do this now.

Stop being hassled to update Kunena

If you are happy with running K 3.0 or K 4.0 (because you’re using the Blue Eagle template or a third-party template based on it) or you are worried about K 5.0 being incompatible with your wesbite and you don’t want to be continually reminded about the availability of K 5.0, there is an easy way to disable the notifications.  Use Joomla’s disable update sites feature.

See the screenshot at the right (click to enlarge the image).

1. Go to Extensions » Manage » Update Sites
2. Click the green tick box to disable updates from the Kunena update server

When you’re ready you can update Kunena at your own convenience and re-enable the Update Sites at a future time.

I do not recommend disabling automatic Kunena updates indefinitely; disabling automatic updates should only be done for personal or technical considerations that you’ve determined.  Keep in mind that software developers cannot support out-of-date versions indefinitely (if at all) and you may not get any response to requests for help with software that is two or three years past its release date.  If you continue to use old software then you accept that it’s your choice, your responsibility to maintain it and the risks that go with using it.

A cleaner Kunena

As we have discussed earlier, there are two commonly-used ways to removed the PBK:

The problems with both of these methods is that (a) they may not always work and future releases of Kunena may render your changes inoperable, (b) hacking code is strongly discouraged because of the additional maintenance effort involved and the potential to make mistakes, (c) hiding the text with CSS will not prevent search engines discovering it, and (d) there are other ways for that people can access the forum credits page.

How to view the credits page even if the links have been hidden or removed?

People can still view the credits page:

1. If your site uses SEF URLs, enter the URL in your browser in the form of <yoursitename>/<forum-menu-item>/credits (for example https://www.kunena.org/forum/credits)
2. Irrespective of whether your site uses SEF URLs, enter the URL in the form of <yoursitename>/index.php?option=com_kunena&view=credits&Itemid=n, where n is the ID of the menu item referring to the forum home page (the menu item needs to be enabled for this method to succeed).  This method is not easy to discover unless you are using non-SEF URLs.

Irrespective of whether your site uses SEF URLs, enter the URL in the form of <yoursitename>/index.php?option=com_kunena&view=credits&Itemid=n, where n is the ID of the menu item referring to the forum home page (the menu item needs to be enabled for this method to succeed).  This method is not easy to discover unless you are using non-SEF URLs.

The totally clean solution

This section summarises the common knowledge about how to remove the PBK, to eliminate evidence that you are using Kunena on your website, and to disable access to the form credits page.

CSS method Simple, low-cost, not guaranteed when future templates are released by the Kunena developers
Effect on PBK Reasonably effective
Security effectiveness Poor: search engines can still detect the non-visible text
Effective against credit page access Nil

Edit source code Difficult to implement because location varies; undocumented; risk of errors if not properly executed
Effect on PBK Excellent
Security effectiveness Moderate: does not prevent back-door discovery of Kunena
Effective against credit page access Nil

.htaccess protection Operates independently of Kunena
Effect on PBK Nil
Security effectiveness High, when used in combination with other methods prevents back-door discovery of Kunena
Effective against credit page access Nil

Plugin from Kunena team Easy to maintain. Cost:  EUR 10.00.  Requires  K 5.0.6.1+
Effect on PBK Excellent
Security effectiveness Unknown: possibly may not prevent back-door discovery of Kunena
Effective against credit page access Unknown

As you can see, there is no single solution to the problems caused by Kunena (and the PBK, in particular) at least as far as versions of Kunena before K 5.0.6.1 are concerned.  The simplest solution would be to modify the Kunena configuration settings to allow the PBK display as an option.  As far as I know there are no plans to make this deactivate the feature by a configuration option; it would not be in the developer’s interests to remove the free advertising derived from the feature.  We know that the Kunena team has released a plugin for K 5.0.6.1 (as an extra paid feature) but that it will not, by itself, address all of the concerns that I've mentioned in this article.

A few years ago (when I was part of the Kunena team), there was a discussion about creating a subscription-based “professional” version of Kunena with dedicated support for those who were willing to pay for it.  The idea never progressed beyond the conceptual stage but one of the developers created a plugin that removed the PBK; this plugin was called Kunena Pro and it was that plugin that I mentioned on the forum a few months ago.  I suspect, but I have no proof, that this is the same plugin that the current team already has and will release at some future time.

We need a “Kunena® cleaner™”

For those people who use versions of Kunena before K 5.0.6.1 and who are reluctant to update only to have to pay extra to remove the PBK text links I have good news:  I already have a solution!

If you’ve found your way to the end of this article and you now feel better informed about the issues with the latest updates to Kunena (or if you simply want a solution to remove the PBK from an older version of Kunena) then this is what you’ve been waiting for.  I have designed and built the Cleaner for Kunena plugin.  It is available for download from this website at a very reasonable low cost.

Cleaner for Kunena plugin no maintenance required (one-click operation); very low cost.
Effect on PBK Excellent
Security effectiveness Very good
Effective against credit page access Excellent

If you think that you have a better solution then I am eager to hear it.  The “last word” about Kunena is yours.  Thank you for reading this article and thank you for your continued support of my work.

Notes:

[1]  I have written before about what I labelled “secret squirrel games″—Secret Squirrel was a children's cartoon character in the 1960s.  The term “secret squirrel” applies to those who are engaged in undercover or covert operations.

[2] In one example page I counted no fewer than 10 advertisements—not counting the PayPal donate button and the 7 “social media″ links—that have nothing to do with the specific question or responses relating to the subject.

[3] A couple of people were unaware that the “recommended″/automated update to K 5.0 uninstalled the Blue Eagle template and forced them to use the Crypsis template instead—to their surprise and dismay!

[4] For a detailed discussion about the Kunena licensing rules, see https://www.kunena.org/forum/77-General-Talk-about-Kunena/39871-please-help-me-understand-the-gpl-for-kunena-and-removing-the-powered-by-kunena-link.

[5] The count is very approximate; for example, enter the term "Powered by Kunena" in Google and you will get ~2.7 million hits.

[6] https://www.kunena.org/forum/k5-0-support-archive/138701-question-about-gpl-kunena-please-answer-me#180127; screen capture taken on 11-Oct-2016 01:00 UTC.

[7] The Powered By Remover plugin released by the Kunena team does not work with old versions of Kunena; the plugin requires the installation of K 5.0.6.1+ (https://www.kunena.org/forum/k5-0-support-archive/139666-powered-by-kunena-forum#183396).

[8] The Powered By Remover plugin released by the Kunena team does not work with old versions of Kunena; the plugin requires the installation of K 5.0.6.1+ (https://www.kunena.org/forum/k5-0-support-archive/139666-powered-by-kunena-forum#183396).

About the author:

Michael Russell has worked in the information technology industry since 1971 and, since retiring from the workforce in 2007, is a website hobbyist specialising in Joomla, a former member of the Kunena project for more than 8 years, and contributor on The Joomla Forum™. The opinions expressed in this article are entirely those of the author. View his profile here.