Support

Admin Tools

#24875 jRealtime Analytics

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Friday, 06 May 2016 17:20 CDT

trogladyte
 I had another ticket that touched on this same other component - https://www.akeebabackup.com/support/admin-tools/24014-2-calendars-both-upsetting-admin-tools.html.

I ended up whitelisting the component to stop the triggers. I know this isn't an Admin Tools issue, but I ould like some help trying to understand what Admin Tools may be seeing as a threat. In the other ticket the issue was XSSSHIELD being triggered. Now, on a different site, it's CSRF Shield being triggered. Again, I've whitelisted the component and, hopefully, that'll be the end of it. Though I'm bothered about why the analytics component would be triggering something which I read is related to form submission.

EDIT: Just had an idea where the form comes in. The site in question - www.lincolnchamber.com - has another component jBusinessDirectory (not the same author) which has a search form that may be used when looking for a member (rather than clicking through everyone). The office manager mentioned the blocking occurred while looking through the directory - possibly by submitting the search form. Yet the target URL listed in Admin Tools was https://www.lincolnchamber.com/index.php?option=com_jrealtimeanalytics&format=json.

I've written to the analytics component developer too though, last time, I kind of got the brush off - or it felt like it. That's why I'm also trying to gain some insight if I get another such reply!

Appreciate your help.

nicholas
Akeeba Staff
Manager
The CSRF protection is not really necessary nowadays since all developers include the Joomla! form token which does exactly that, protect against CSRF. This feature was necessary back in Joomla! 1.5 when developers didn't take this basic security precaution.

What happens is that the form in question is most likely generated through Javascript. As such, Admin Tools –which runs on the server side– does not have the chance to see the form and add its own token. Therefore as soon as you submit the form the Admin Tools token is not there and triggers the exception.

The other possibility, if you use the Advanced mode, is that your browser auto-fills a hidden field Admin Tools adds to every form. This field is supposed to remain empty since humans cannot see it and interact with it. When Admin Tools sees the field filled in it triggers a security exception.

My advice is to turn off the CSRF protection feature because it is no longer needed. In fact, it's one of the features which will go away in the not so distant future.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!