Support

Let's make sure that the problem is indeed caused by Admin Tools. In order to do so, try the following:

1. Try setting the Error Reporting level in your Global Configuration to "None". Many errors are caused by harmless PHP Notices and Warnings being output to the browser, breaking anything which requires HTTP header manipulation such as Joomla!'s session management, AJAX calls and download systems.

2. Try to replicate the issue after disabling the "System - Admin Tools" plugin. If you can still replicate the issue, it is not caused by Admin Tools. Disabling that plugin means that Admin Tools code (including the Web Application Firewall) is not running on your site.

3. If you suspect an issue with the .htaccess file, replace its contents with the contents of the stock htaccess.txt file shipped with every version of Joomla!. If you are on GoDaddy please wait for 1-30 minutes for the changes to be effective. Then, retry loading the problem page. If you can still reproduce the error, then it is not caused by .htaccess Maker.

If doing any of the above resulted in the issue still occurring, it's not related with Admin Tools and we can't help you. If doing any of the above did stop the issue from occurring, we'll have to do some troubleshooting.

First go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save. Now try reproducing your issue. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here so that we can further help you.

If, however, you do not see a log entry, or the Date and/or IP address do not match your last access, this problem is not caused by Admin Tools' WAF. In this case, you will have to do some .htaccess troubleshooting. You may need to read the general .htaccess troubleshooting page, as well as the page on finding out necessary .htaccess exceptions.

All right! Now that we've narrowed it down you can follow the “How to determine which exceptions are required” instructions to see what is actually being blocked by the generated .htaccess.

I will take an educated guess. Your template or a plugin puts all your images through a directly web accessible .php file (it doesn't go through Joomla!'s index.php). This is bad practice –as you're opening many entry points to your site– but quite common. Just remember that when you allow direct access to .php files it is more than likely that Admin Tools' system plugin, therefore Admin Tools Web Application Firewall, is NOT executed when you are accessing them. In other words it makes it possible for an attacker to exploit a vulnerability that Admin Tools could catch, but since it doesn't run inside that script it won't.

Uploading to the Media Manager is not affected by the .htaccess Maker. The file is posted to Joomla!'s index.php file which is of course not blocked (that would make your site inaccessible).

Regarding Joomla! Update –which I've written myself, it used to be part of Admin Tools– we do add a special rule by default in .htaccess Maker to let it work. Did you remove the default "Allow direct access to these .php files" options?

> I have very few plugins installed. Is it possible for a template or plugin to change the way Media Manager handles files?

Yes, it is.

Please read the error message again and you'll see that it has nothing to do with the protection:

XMLHttpRequest cannot load http://www.mcanimalhospital.com/administrator/index.php?option=com_installer&view=update&task=update.ajax&eid=0&skip=700. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://mcanimalhospital.com' is therefore not allowed access.

You have a page on www.mcanimalhospital.com making an AJAX request to mcanimalhospital.com. This is considered a cross-site request as far as the browser is concerned which is not allowed. Please contact the developer of the extension making this request and ask them to use JURI::base() to get the correct domain name.

If this happens by the Joomla! core itself or if they are already using JURI::base() you need to edit your configuration.php file and set

$live_site = 'http://www.mcanimalhospital.com';

This is required on about 5% of servers which do not report the domain name correctly to PHP (therefore Joomla! has no idea what the correct domain name is).