Support

Joomla! version: (2.5.9)
PHP version: (5.3)
MySQL version: (unknown)
Host: (arvixe)
Admin Tools version: (2.4.4)

Description of my issue:

I set up the security exception email and I have been receiving emails all day.  The majority are template= in URL by I have had a fair share of Admin Query String.

Could you please explain what this means.  I read through the support pages and saw some stuff about joomla mail but I don't understand it.  I'd like to know that I have this stuff setup the best way I know how.  I have added these ip addresses to my blacklist but they just keep coming in.  Please let me know what I can do.

Thanks,

Kurt

Blacklist question.  I added the following IP 193.169.87.206  to my blacklist but later in the evening I got another security exception email.  I thought if I added it to my blacklist it would ban them from my site.  

Could you explain this as well as my previous question.

Thanks!

K.

I have read this info in the doc

https://www.akeebabackup.com/documentation/admin-tools/web-application-firewall.html#waf-configure

This is how I have the site currently configured

Block tmpl=foo system template switch - Yes
List of allowed tmpl= keywords - component,system,raw
Block template=foo site template switch - Yes
Allow site templates - No

I read this ticket which talks about the send article by mail function causing the issue, but unlike this msg most of the ip addresses that cause this warning are from outside my country and are ip addresses I cannout identify.

https://www.akeebabackup.com/support/admin-tools/12656-security-message-template--in-url.html

Do I have the tool configured correctly?

Am I to understand that these emails mean that my site and most sites in general are just constantly scanned for vunerability? Or am I still not understanding what these emails mean.

Thanks!

Kurt

Here is an example of one of the log target urls.  I've edited the name of our site before I posted.

They all seem to be using the mailto component.  The link string is always different.

http://site.org/component/mailto/?link=15481df192e89f051e6fb52e62d26098502f0287&template=zion&tmpl=component

Forgive my ignorance but, but does this mean people are manipulating the site to send email or atleast attempting to?

Per your request I have changes the "Allow site templates" from No to Yes.

Thanks for all the good info!

I have "Disallow site access to IPs in Blacklist" set to "Yes" and I have had the following IP 121.83.221.74 in my blacklist but my log show the following repeated all through the night - 2013-02-26 00:53:15    121.83.221.74 Login failure.

If I blacklisted that IP, shouldn't that block that user from even seeing the site?

K.

I am running php 5.3.15.

As I stated in my prior  email I do have  "Disallow site access to IPs in Blacklist" set to "Yes"

I checked my System - Admin Tools Plugin.  It is enabled.

This morning I updated to Admin Tools to 2.5.1

I'll keep an eye on it and the next time I black list an IP I'll check to make sure it's working.

Until then,

Thanks!

K.