Support

Admin Tools

#29466 website message 'access forbidden'

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Friday, 04 May 2018 17:17 CDT

Tuesday, 03 April 2018 09:27 CDT

rbradbury
A very few users report receiving an access forbidden message on their browser screen when attempting to navigate to the site. This is not the usual 403 message - it simply says 'access forbidden'. Nor does it reportedly appear on all website pages.

I have been unable to resolve this, primarily because I cannot replicate it myself. At first it seemed to be linked to users accessing via a VPN. Recently a user has disproved this theory. Another user resolved the issue by rebooting his broadband router. The problem is not avoided by user using a different browser. The site and users are UK based. Any ideas/suggestions gratefully received
Edited by rbradbury on 2018-04-03 09:27 CDT

Tuesday, 03 April 2018 10:02 CDT

tampe125
Hello,

the error message is a little strange, since Admin Tools will raise a 403 exception that will be handled by Joomla, displaying the error template.
So, first of all let's make sure that the problem is indeed caused by Admin Tools. In order to do so, try the following:

1. Try setting the Error Reporting level in your Global Configuration to "None". Many errors are caused by harmless PHP Notices and Warnings being output to the browser, breaking anything which requires HTTP header manipulation such as Joomla!'s session management, AJAX calls and download systems.

2. Try to replicate the issue after disabling the "System - Admin Tools" plugin. If you can still replicate the issue, it is not caused by Admin Tools. Disabling that plugin means that Admin Tools code (including the Web Application Firewall) is not running on your site.

3. If you suspect an issue with the .htaccess file, replace its contents with the contents of the stock htaccess.txt file shipped with every version of Joomla!. If you are on GoDaddy please wait for 1-30 minutes for the changes to be effective. Then, retry loading the problem page. If you can still reproduce the error, then it is not caused by .htaccess Maker.

If doing any of the above resulted in the issue still occurring, it's not related with Admin Tools and we can't help you. If doing any of the above did stop the issue from occurring, we'll have to do some troubleshooting.

First go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save. Now try reproducing your issue. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here so that we can further help you.

If, however, you do not see a log entry, or the Date and/or IP address do not match your last access, this problem is not caused by Admin Tools' WAF. In this case, you will have to do some .htaccess troubleshooting. You may need to read the general .htaccess troubleshooting page, as well as the page on finding out necessary .htaccess exceptions.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 03 April 2018 11:14 CDT

rbradbury
Thanks for the quick response, David

1. Joomla! error reporting was already set to 'None'

2. I disabled the Admin Tools plugin. User reported access forbidden message gone and able to access the site normally.

3. Log Security Exceptions in WAF was indeed already set to 'Yes'. However, upon checking the security exceptions log, the last entry was from some 3 hours ago. However, on searching the IP address, these two entries were found from two weeks ago

tmpl= in URL

http://www.iloc.co.uk/regalia/product/updatecart/cart_id-3388/cart_product_id-6289/quantity-0/return_url-aHR0cDovL3d3dy5pbG9jLmNvLnVrL3JlZ2FsaWEvY2hlY2tvdXQ=?tmpl=ajax

Wednesday, 04 April 2018 02:56 CDT

tampe125
Ok, I know what's going on.
You are using a component (Hikashop, if I'm right) that uses non standard values for the tmpl variable.
Please get inside the Configure WAF page and inside the field List of allowed tmpl= keywords please add ajax.

In this way you should be able to update your cart.
Regarding the blocked user, please search for his IP inside the Security Exception Logs, the Blacklisted IP and the Automatically Blocked IPs and deleted all the occurrences.
In this way he will be able to login again.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 04 May 2018 17:17 CDT

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.
Edited by on 2018-05-04 17:17 CDT

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!