Support

Admin Tools

#15583 template= in URL

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Tuesday, 02 April 2013 08:21 CDT

user47161
Hi,

I have a lot of Security Exception issues on my website and just would like to know more about them, what's really the reason (maybe I can do something against?), for example:

Reason: template= in URL

What does it mean?

I searched your website but found no accurate information. I only found some information about Bad Behaviour, there is even an info icon next to "Bad Behaviour" in Security Exceptions Log. But unfortunately none for the other reasons like "template= in URL" :(

nicholas
Akeeba Staff
Manager
Fair point, I had forgotten to update the documentation :s I have now updated the documentation with the security exception log reasons and what they mean.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user47161
I still cannot see what they mean. Or do you consider lines like

See the Configure WAF page, Block template=foo site template switch. The attack was blocked by Admin Tools.


an explanation what the reason means?

nicholas
Akeeba Staff
Manager
Yes, it is a very clear and helpful message. Let's see what you are are told:
See the Configure WAF page, Block template=foo site template switch.

Let's go to the documentation page of the Configure WAF page and search for "Block template=foo site template switch". Oh, there it is:

Another Joomla! hidden feature is the ability to switch between installed templates by passing a special URL parameter. For instance, if you want to apply the JA Purity template, just pass the parameter ?template=ja_purity. For a live example, have fun with http://www.joomla.org/?template=ja_purity. Enabling this option will turn off this hidden Joomla! feature.


What should we learn from that information? Joomla! allows you to switch the template used by the site when you pass it a template=something URL parameter. What does this Admin Tools' feature do? It blocks the use of that switch. Therefore, what can this possibly mean as a block reason? That someone tried to use such a template switching URL parameter and Admin Tools blocked them. Is there something not obvious? I'm asking this question honestly, without any trace of spite, as I'm too close to the code and documentation (I wrote both) to be their impartial judge. The only people who can provide feedback are my users, that means you. After all I'm writing the documentation for you, not me.

Please bear in mind that I am trying to reconcile the needs of two different and contradictory groups of users: on one hand I have those people who complain that the documentation is too big and on the other hand I have those who complain it's not detailed enough. I try to go for the middle ground. Any suggestions on performing this impossible task are always more than welcome.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user47161
Yes, it is a very clear ... Let's go to the documentation page of the Configure WAF page

That's not very clear! "See the Configure WAF page" does not tell me to "go to the documentation page of the Configure WAF page"! Configure WAF page is not the same as the documentation page of the Configure WAF page.

nicholas
Akeeba Staff
Manager
Wait... that was supposed to be a link! I can now see why you're saying it's not clear.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!