Support

I am going to take a look at this. This week I am alone here due to summer vacations. Due to a rather high number of tickets requiring developer oversight it will take me much longer than usual to clear the queue. Please expect a reply to your ticket within a 3-5 working days.

Yes, you do not need this rule in Joomla! 3.7. You can safely disable it.

The problem is the &6 at the end. I have no idea why that ends up in your URL. It creates a query string parameter with a key of (integer) 6 and null value. This is obviously a typo.

When Joomla! processes the request it figures out that this kind of parameter has no place. Unfortunately, what it does is worse. It creates a query string parameter with key '' (empty string) and null value. And because we're heading to a perfect storm, when we are getting the query string parameters as an array PHP converts the empty string to the integer value 0. Continuing on our perfect storm, PHP treats the string literal 'list[select]' as being equal to the integer value 0.

Are you still with me? Due to some Joomla! and PHP quirks that lone 6 at the end of the URL is considered to be an exact match to list[select]. Of course at this point we have to compare its value (null) against the regular expression assigned to this blacklist rule. The regular expression is to the tune of "if it doesn't contain X or Y raise an alarm". Since the value is null this negative regular expression matches. Hence the blocked request.

After two hours and half a bottle of cola I can tell you that I have figured out why this happens and found a way to work around it. When the ticket system reopens on Monday please do tell me how the heck was that URL generated because that freaking lone 6 at the end is most definitely NOT right (and the source of all our problems). Kindly note that tomorrow I'll keep the ticket system closed as I need to go through the developer-level ticket backlog, something I've been trying to do the last 2 days (only that it kept growing faster than I could chop it down).

Adding arbitrary numbers to the end of URLs is not supported by Joomla!. The JInput class does not expect to see numeric parameters. It's a case not covered so when a numeric parameter with no value is used everything falls apart in interesting ways. Well, at least the next version of Admin Tools will have a workaround against misbehaving search engines which are acting more like penetration testing software than indexing services, but I digress :)