Support

 Hi,

We're having an issue on our website - when we go to edit a document (using DocMan 2.0 plugin), the following error comes up: "Error: 403 - This request is blocked by Admin Tools. Please change this message in the component's options."

I disabled the Admin Tools plugin, and the edit document page loads up fine, leading me to believe that the issue is some kind of setting inside of Admin Tools.

Could someone please help us? I've gone through the WAF configuration settings and I can't seem to find what is causing this issue.

Thanks

Did you also rename the .htaccess file when you disabled the plugin? The .htaccess Maker has an allowed file type list. If the type of document that you're editing is not in the list, you will get a 403.

Assuming that you didn't rename the .htacess file, then the issue has to be in the WAF somewhere. It does not use an allowed type list. Check the Security Exceptions Log to see what is triggering the 403 and we will go from there. We will probably have to disable the type of protection that your plugin is triggering, we won't be able to whitelist the plugin.

No, I didn't rename the .htaccess file when I disabled the plugin.

In the WAF Security Exceptions Log, the reason for triggering the 403 is "tmpl= in URL". Here is a sample URL that was logged: http://wallkillpd.origamidove.com/document-center/office-of-emergency-management/9-ready-seniors-2014.html?view=document&layout=form&tmpl=koowa

I'm not sure what is causing this sudden issue. This site is running live with no issues - I cloned the site on our development server and upgraded the site from Joomla 2.5.27 to Joomla 3.3.6. Is it possible that the new version of Joomla is causing the issues?

Thanks

The tmpl= settings are in WAF Configuration, on the Visual Fingerprinting Protection tab. I'm not sure exactly what option you need to change. There is too much I don't know, did you change the site template with your upgrade? What is the name of the site template? Where is "koowa" coming from?

No, the site template wasn't changed. We just backed up the site with Akeeba Backup and restored it to another server.

I went ahead and in the Visual Fingerprinting Protection tab, I changed the "Block tmpl=foo system template switch" to "No" and it looks like it fixed the 403 error on the front end. Not sure where the "koowa" is coming from, it doesn't appear on the link on the front end, just shows up in the URL listed in the Security Exceptions Log.

Thanks for all of your help in finding the setting, everything looks to be up and working now.