Support

Admin Tools

#13658 Real admin being logged out due to 'Admin Query string' when logged in correctly

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Friday, 28 September 2012 01:41 CDT

davesage
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? No - none relevant
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 2.5.7
PHP version: 5.3.x
MySQL version: 5.1.x
Host: (optional, but it helps us help you)
Admin Tools version: 2.3.2

Description of my issue:
I have seen this a few times on different sites with different admin users and I'm stumped.

They log in to the backend using the correct admin secret word, login goes fine, they surf around the backend but for some reason get kicked out to the homepage with an exception getting raised 'admin query string'.

What reason would there be for them to get kicked out when they logged in ok? I have a hunch it might be linked with their session timing out and them loggin back in, could their session id get confused where Joomla lets them back into a cached page but then admin tools throws a wobbly thinking they didn't use any secret word so boots them out?

It has happened a few times and it annoys clients, especially when they get the 'you are a hacker...' notice which I try to change so isn't so pointed. Sometimes they also get auto-banned as they keep loading the old page. I add them to the whitelist (in the configure WAF) and this works but if they were on a dynamic IP this wouldn't resolve it for long.

Any thoughts would be welcome,

Keep up the good work!

Dave

nicholas
Akeeba Staff
Manager
I have a hunch it might be linked with their session timing out

You are spot on. When you type a URL with the query string parameter a flag is added in the user's session object denoting that he has already entered the correct query string parameter. On each subsequent back-end query load our plugin checks the session. If this flag is not set it will redirect the visitor back to the site's frontpage. If the flag is set it does nothing. If the session expires, the user's IP changes or the cookie is deleted then the session is reset and the flag is no longer there. This causes Admin Tools' plugin to kick in.

It has happened a few times and it annoys clients, especially when they get the 'you are a hacker...' notice which I try to change so isn't so pointed.

First adjust your IP auto-ban parameters. I'd recommend blocking an IP for 15 minutes after 3 security exceptions in 2 minutes. This is enough to block bots, but not enough to block humans doing something wrong. Moreover this is also the place where you can change the message.

Sometimes they also get auto-banned as they keep loading the old page.

Well, just tell them that if they get booted to the front-end they have to re-login, otherwise they will have to do a forced 15 minutes coffee break.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

davesage
Hi,

Thanks for all the advice and thorough explanation. I'll ensure to tell clients to login again if they get booted out instead of trying to hit back or something else.

In terms of the messages, I do update these but it seems as though whenever I upgrade admin tools my override messages get blanked/returned to default and it doesn't store my values in these two fields, all the rest of the settings are fine??

Cheers,

Dave

nicholas
Akeeba Staff
Manager
I'm not sure why these two message would be reset. All of these settings are stored in the same JSON encoded field inside the same database table.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!