Admin component in Joomla

Every Joomla site has a component called com_admin. Most administrators have never opened a single one of its files, yet this small component plays a central role. It collects the system information you copy into a forum post when you need help.

It renders the Help screen. And, less obviously, it runs the actual database migrations every time you click "Update Now" on a Joomla core update.

The name com_admin is a trap. It sounds like it covers the whole backend, but the backend (/administrator/) is actually a neighbourhood of many small components. com_admin is just one of them, with one very specific job: it is the component about the administrator itself.

The small core component that runs Joomla's upgrades, shows system information, and powers the help screen.

This article walks through what com_admin contains, how it fits into the Joomla 6 architecture, why script.php is one of the most important files in Joomla core, and what makes this component a useful reference example for developers who want to build modern Joomla components.

2. Where com_admin Lives

2.1 The Folder Structure

You can find the component in your Joomla installation here:

public_html/administrator/components/com_admin/
├── postinstall/       (post-install handlers)
├── services/          (DI container wiring)
├── sql/               (versioned DB migrations)
├── src/               (PHP classes, PSR-4)
├── tmpl/              (view templates)
├── admin.xml          (manifest)
└── script.php         (the upgrade engine)

Notice what is missing: there is no media/ folder and no front-end folder. com_admin is a pure backend component.

2.2 How to Open It in the Browser

There are only two URLs that lead into com_admin:

/administrator/index.php?option=com_admin&view=sysinfo
/administrator/index.php?option=com_admin&view=help

There is no list view, no edit form, and no toolbar with publish or trash buttons. Two screens, nothing more.

2.3 The Manifest File

Every Joomla component has a manifest. For com_admin it is admin.xml:

<extension type="component" method="upgrade">
    <name>com_admin</name>
    <version>4.0.0</version>
    <namespace path="src">Joomla\Component\Admin</namespace>
    <administration>
        <files folder="admin">
            <filename>admin.xml</filename>
            <filename>script.php</filename>
            <folder>postinstall</folder>
            <folder>services</folder>
            <folder>src</folder>
            <folder>tmpl</folder>
        </files>
    </administration>
</extension>

The attribute method="upgrade" matters: it tells Joomla to always upgrade the component instead of installing it from scratch. com_admin is never reinstalled clean on a running site.

4. The Modern Component Architecture

Even though com_admin only has two screens, it uses the full modern Joomla 4+/5/6 component architecture. That makes it an excellent reference for developers.

4.1 Namespacing and PSR-4

The component uses a clean namespace:

Namespace:  Joomla\Component\Admin
Path:       administrator/components/com_admin/src/

Joomla 6 uses PSR-4 autoloading. The file:

src/Model/SysinfoModel.php

maps automatically to the class:

Joomla\Component\Admin\Administrator\Model\SysinfoModel

You no longer need JLoader::register() glue code. The autoloader finds the class because the folder structure matches the namespace.

4.2 The MVC Skeleton

The src/ folder contains a small set of classes that together form a complete component:

src/
├── Controller/DisplayController.php    (entry point)
├── Dispatcher/Dispatcher.php           (routing + access)
├── Extension/AdminComponent.php        (boot hooks)
├── Model/HelpModel.php
├── Model/SysinfoModel.php
└── Service/HTML/                       (HTML helpers)

This is classic Model-View-Controller, but with two Joomla 4+ additions: a Dispatcher and an Extension class.

4.3 The Service Provider

The file services/provider.php wires the component into Joomla's Dependency Injection container:

return new class () implements ServiceProviderInterface {
    public function register(Container $container)
    {
        $container->registerServiceProvider(
            new MVCFactory('\\Joomla\\Component\\Admin')
        );
        $container->registerServiceProvider(
            new ComponentDispatcherFactory('\\Joomla\\Component\\Admin')
        );
        // ...
    }
};

Every modern Joomla component has a services/provider.php file like this. It is the official entry point for the DI container.

4.4 The Custom Dispatcher

The Dispatcher of com_admin contains a small but very intentional trick:

class Dispatcher extends ComponentDispatcher
{
    /**
     * com_admin does not require check permission,
     * so we override checkAccess method and have it empty
     */
    protected function checkAccess() {}
}

The method that normally enforces ACL is intentionally empty. The reason is that System Information and Help must keep working even when ACL is misconfigured. They are diagnostic tools, and a broken ACL is exactly when you need them most. Very few Joomla developers know this pattern exists.

4.5 The Extension Class

The Extension class AdminComponent runs at boot time and registers HTML helper services:

public function boot(ContainerInterface $container)
{
    $this->getRegistry()->register('system',        new System());
    $this->getRegistry()->register('phpsetting',    new PhpSetting());
    $this->getRegistry()->register('directory',     new Directory());
    $this->getRegistry()->register('configuration', new Configuration());
}

This lets templates call helpers in a consistent way:

echo HTMLHelper::_('phpsetting.setting', $key, $value);

4.6 The Controller Does (Almost) Nothing

The controller is intentionally minimal:

class DisplayController extends BaseController
{
    public function display($cachable = false, $urlparams = [])
    {
        $viewName = $this->input->get('view', $this->default_view);
        $format   = $this->input->get('format', 'html');

        // Check CSRF token for sysinfo export views
        if ($viewName === 'sysinfo'
            && ($format === 'text' || $format === 'json')) {
            $this->checkToken('GET');
        }

        return parent::display($cachable, $urlparams);
    }
}

It has one job: when System Information is exported as text or JSON, it requires a CSRF token. That stops an attacker from tricking a logged-in administrator into leaking system information through a malicious link. Small, but important.

6. Versioned SQL Migrations

6.1 The Files

Inside sql/updates/ are folders for each supported database driver:

sql/updates/mysql/
├── 6.0.0-2024-08-11.sql
├── 6.0.0-2025-09-23.sql
├── 6.0.0-2025-10-11.sql
├── 6.0.1-2025-10-29.sql
├── 6.1.0-2025-10-30.sql
├── 6.1.0-2026-02-06.sql
└── 6.1.0-2026-03-13.sql

sql/updates/postgresql/
└── (same files, PostgreSQL dialect)

The pattern is consistent:

• Each filename starts with the target Joomla version.
• After the version comes the date.
• Files are stored separately per database driver.

6.2 The Version Pointer in #__schemas

Joomla keeps track of which SQL files have already been applied. It uses a table called #__schemas:

SELECT e.element AS extension, s.version_id
  FROM jos_schemas s
  JOIN jos_extensions e ON e.extension_id = s.extension_id;

A typical result looks like this:

+------------------+---------------------+
| extension        | version_id          |
+------------------+---------------------+
| joomla           | 6.1.0-2026-03-13    |  (com_admin updates this)
| com_content      | 6.0.0-2024-08-11    |
| com_users        | 6.0.0-2025-05-20    |
+------------------+---------------------+

On every update, Joomla looks at the files in sql/updates/<driver>/, compares them to the last applied version_id, runs every file that is newer in filename order, and then stores the highest filename back into #__schemas.

If you ever need to force a re-run of a migration, this is the row to edit. Carefully.

6.3 A Real Migration File

An example from sql/updates/mysql/6.1.0-2026-03-13.sql:

-- disable autostart for the previous tour
UPDATE `#__guidedtours` SET `autostart` = 0
 WHERE `uid` = 'joomla-whatsnew-6-0';

INSERT INTO `#__guidedtours` (...)
SELECT 'COM_GUIDEDTOURS_TOUR_WHATSNEW_6_1_TITLE', ...
 WHERE NOT EXISTS (
   SELECT * FROM `#__guidedtours` g
    WHERE g.`uid` = 'joomla-whatsnew-6-1'
 );

Notice the WHERE NOT EXISTS guard. That makes the migration idempotent: running it twice does not cause errors or duplicate rows. Idempotent migrations are a recurring pattern in core Joomla updates.

8. How a Sysinfo Page Request Flows

8.1 The Path of a Request

It helps to see the full path a request takes when you open System Information:

URL: /administrator/index.php?option=com_admin&view=sysinfo
                |
                v
   services/provider.php
   (DI: registers MVCFactory + Dispatcher)
                |
                v
   Dispatcher::checkAccess()
   (empty override, so no ACL block)
                |
                v
   DisplayController::display()
   (CSRF check if format=text or json)
                |
                v
   SysinfoModel
   (gather and redact data)
                |
                v
   tmpl/sysinfo/default.php
   (render HTML)

Every modern Joomla component follows the same flow. Once you understand it for com_admin, you understand it for all of them.

8.2 Privacy by Design in SysinfoModel

SysinfoModel gathers a lot of sensitive information: PHP environment, paths, cookies, database settings. To make the screen safe to share, the model filters out a hard-coded list of private values:

protected $privateSettings = [
    'phpInfoArray' => [
        'CONTEXT_DOCUMENT_ROOT', 'Cookie', 'DOCUMENT_ROOT',
        'extension_dir', 'error_log', 'Host', 'HTTP_COOKIE',
        'HTTP_HOST', 'HTTP_ORIGIN', 'HTTP_REFERER',
        'mysql.default_socket', 'MYSQL_SOCKET', ...
    ],
];

When you copy your System Information into a forum post, this is the code that redacts your secrets. Do not bypass it.

8.3 Security Choices, Summarised

The design is opinionated: show enough to debug, hide enough to stay safe.

10. Common Confusions, Cleared Up

Several beliefs about com_admin are widespread but wrong.

12. Quick Reference

OPEN SYSINFO    /administrator/index.php?option=com_admin&view=sysinfo
OPEN HELP       /administrator/index.php?option=com_admin&view=help
SCRIPT          administrator/components/com_admin/script.php
SQL UPDATES     administrator/components/com_admin/sql/updates/<driver>/
VERSION TABLE   #__schemas       (one row per extension)
POST-INSTALL    administrator/components/com_admin/postinstall/
DISPATCHER      src/Dispatcher/Dispatcher.php   (empty checkAccess)
EXTENSION       src/Extension/AdminComponent.php (HTML helpers)
SERVICES        services/provider.php   (DI wiring)