Support

Admin Tools

#28653 I am getting a 403 error when sending an HTTP Post

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by djc on Wednesday, 25 October 2017 08:42 CDT

djc
I think I figured it out, but would like your advise on how to proceed.

I have created access levels that match the user groups. I added Super Users to the access levels so that I did not have to put the admins in each user group. That appears to be what caused the error.

I added the component that I am HTTP posting to to the WAF exceptions, but still got the error.
Then I enabled front end editing, and still got the error.

I then disabled Admin Tools and everything went fine.
My next experiment was to remove Super Users from the Access Levels, and that worked fine.

Lastly, I re-enebled Admin Tools and left Super Users out of the Access Levels and things seem to be working.

How would you handle that problem? Are there settings in Admin Tools that will allow this? Should I put my admins in all the other user groups?

Ideas?

Thanks,
Dom

nicholas
Akeeba Staff
Manager
Using POST or GET and the component being used seem to be unrelated to what you are experiencing.

I am also not clear what "I added Super Users to the access levels" is supposed to mean. Access Levels in Joomla! determine who can read (view) something. They have nothing to do with POST which is used to add or modify information. Combined with the second half of your ticket it makes me think that you are either doing something else (e.g. adding the Super User privilege to a user group), or this is unrelated to your issue, or you have a component written by someone who doesn't understand Joomla! and uses Access Levels to control something other than viewing information.

However, I suspect that all of that is irrelevant to our discussion. What I am mostly interested is that the 403 seems to be linked to Admin Tools if I understand correctly what you are saying.

First go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save. Now try reproducing your issue. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here so that we can further help you.

If this is not the case then Admin Tools is irrelevant to your issue and you most likely have the case of the badly written component I described above. In this case you will need to contact the developer of that component and ask him to check if he's really using Access Levels for limiting anything other than view access which would, of course, be a bug in his code.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

djc
Thank you for your reply!

I have done the testing that you suggested and I get Frontend Edit Admin User errors when the post is made when either Admin tools is running or Superuser is part of the access level.

I tested it with both with "Disable creating / editing backend users from the frontend" both on and off and with Disable editing backend users' properties"

I am not complaining about Admin Tools, it is a great product....I am just trying to understand why this is happening and the best course of action to take.

Regards,
Dom

nicholas
Akeeba Staff
Manager
I am afraid that you did not follow my instructions or at least you didn't provide me with the information I requested. As a result I am still lacking any useful information which would help me help you. Moreover, you said:

I get Frontend Edit Admin User errors when the post is made when either Admin tools is running or Superuser is part of the access level.


The way you are phrasing this it sounds like you have two unrelated issues: A. if the Super User is included in the access level you get an error (this issue only has to do with the component itself, not Admin Tools) and B. if Admin Tools is enabled you get an error (I understand that this happens when the Super User is NOT included in the access level, making it a conflict between the component and Admin Tools). However, the way it's phrased I don't know if B means that you left the Super User in the Access Level which would mean that you would only have a non-Admin Tools issue (case A) since you'd have effectively proven that Admin Tools is unrelated to the outcome. Moreover, since you say that you are getting a 403 page -understanding it's Joomla's error page, which is not what Admin Tools displays- I am further suspecting that your issue has actually nothing to do with Admin Tools.

In order to understand what really happens and help you out I need you to both run a few more tests and provide me some all important information and screenshots.

Test #1

  1. Make sure that the Super User is included in the access level.
  2. Now, go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save.
  3. Try reproducing your issue.
  4. Take a screenshot of the page, including the browser address bar, and attach it here with the name "test_01".
  5. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log.
  6. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here with the indication "TEST 1 - WITH SUPER USER".


Test #2

  1. Make sure that the Super User is NOT included in the access level.
  2. Now, go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save.
  3. Try reproducing your issue.
  4. Take a screenshot of the page, including the browser address bar, and attach it here with the name "test_02".
  5. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log.
  6. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here with the indication "TEST 2 - WITHOUT SUPER USER".


More information I need to help you
  • Which is the component you are using?
  • What exactly are you trying to do with that component?
  • Can you reproduce the issue if you disable Admin Tools but have the Super User added to the Access Level?
  • If you can reproduce this issue please attach a screenshot from the error page, including the browser address bar, with the name "test_03"
  • Can you reproduce the issue if you enable Admin Tools but have the Super User removed from the Access Level? (Attention! This is the opposite from the previous question).
  • If you can reproduce this issue please attach a screenshot from the error page, including the browser address bar, with the name "test_04"


I would like to kindly request that you run both tests, following my instructions exactly and in the order presented. Please remember to provide me with the information I requested. Finally, let me remind you that attachments are private; only you and I can see the attachments even though the ticket is public. So don't worry, you are not inadvertently divulging information about your site when you attach the screenshots I am requesting :)

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

djc
Thank you for your reply.

I am going to close this ticket as we are somehow not communicating. I have done all possible variations of experiments with this and tried to explain the results to you. I failed.

I am going to assume that it is not Admin Tools and look elsewhere.

Thank you again for the time you spent.
Dom

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!