Support

Admin Tools

#21223 Secret Administrator URL parameter

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Thursday, 16 October 2014 00:41 CDT

BernhardS
Hi support team,

just upgraded to Admin Tools 3.3.0 and again the same problem. Secret URL doesn't work properly. You can connect to backend login without parameter and after logout you are again at backend login and not on homepage as in version 3.1.1.

Help needed - warm regards Bernhard

nicholas
Akeeba Staff
Manager
I am entirely sure that this is definitely NOT the case. The reason I sound so confident is that I have written a test for that which has run on the 48 combinations of {Windows 8, Max OS X Mavericks, Ubuntu Server 14.04} x {PHP 5.3, 5.4, 5.5, 5.6} x {Joomla! 2.5, 3.1, 3.2, 3.3}. In fact it has not just run once, it has run ten times on each environment over the last week. The Secret URL Parameter works perfectly fine and I'm willing to place a bet on its working fine. That's why I barely slept in 3 weeks, writing automated tests for Admin Tools and testing the tests on all supported environments: so that I can bet that a feature is REALLY working, not just me thinking it is working.

For your information:
  • You cannot access the administrator URL without a secret URL parameter UNLESS you had previously accessed the administrator URL WITH a secret URL parameter from the same browser. In the latter case the "this guy knows the secret URL parameter, don't kick him out" flag is already set in your browsing session. A bug in 3.1.1 and earlier (the same one I write about in the next bullet point) prevented this from happening.
  • Version 3.1.1 and earlier had a bug when logging out. You were kicked to the front-end and a security exception was raised. This was wrong. When you log out you should see the login page without a security exception being raised. This is what you observe in 3.3.0 which means that I did fix the bug.


Try clearing your browser cookies and then retry accessing your administrator URL without a URL parameter. It will kick you out to the front-end of the site. If it doesn't kick you out the update of Admin Tools failed. In this case just reinstall Admin Tools 3.3.0 without uninstalling it first.

BTW: I seriously doubt you are running Joomla! 3.6.6. Maybe you mean 3.3.6, the latest published Joomla! 3 version? In this case you are using the same Joomla! version I tested against.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

BernhardS
Hello Nicholas,

sorry naturally it is Joomla 3.3.6 ;-)

I tried out all your suggestions, but nothing helps.

Try clearing your browser cookies and then retry accessing your administrator URL without a URL parameter. It will kick you out to the front-end of the site. If it doesn't kick you out the update of Admin Tools failed. In this case just reinstall Admin Tools 3.3.0 without uninstalling it first.

When I do this I get the information that "You are a spammer ..." and I have to delete my IP in WAF to connect again. I have installed Admin Tools again, cleared all caches, tried to connect with other browsers (IE 11 for example - never used for this before).

If you want to try it out yourself I can give you the URL and if needed access to the backend, but not here ;-)

Warm regards Bernhard

nicholas
Akeeba Staff
Manager
We have already tested Admin Tools with nearly 300 tests on each of the 48 supported combinations of Operating System, PHP versions and Joomla! versions. We cannot reproduce this issue in any of these environments. Therefore we consider it to not be a bug but something related either to a partial upgrade of your Admin Tools installation or something related to your host. Unfortunately neither of these factors is in our control and we cannot provide any further assistance.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!