Support

No worries, most solutions are not obvious unless you're very well versed in the ways Admin Tools protects your site. That's why we're here; to help :)

First, add the following exceptions to the list:

components/com_virtuemart/notify_preorder.php
components/com_virtuemart/notify.php

then clickon "Save and create .htaccess"

Then go to Configure WAF and disable the Bad Behaviour integration (I am going to remove that option as it is too trigger finger-happy and throws too many false positives). Save the configuration and you should be back in business!

If it is blocked by any other feature of Admin Tools (not just.htaccess Maker) PayPal would still complain.

Normally these are the only settings required. If PayPal still complains, you can go to Admin Tools, Web Application Firewall, Exceptions Log and see if something in PayPal's IPN response triggered an exception. If yes, you can tell me and we're going to figure out a solution. If not, we will have to review the settings in the .htaccess Maker.

I am currently the only developer in the team. Most likely the team is going to expand in the not-so-distant future, though :)

Hi!

If you disable the "System - Admin Tools" plugin and remove the .htaccess file generated by Admin Tools then there is absolutely no code of ours running on your site. I don't understand how a component which is installed but not used could have affected your site's operation. If the code doesn't run, it has no effect - it's computer code, not a magic spell. Maybe you forgot to disable the one option which was conflicting with your e-commerce extension after all, or used the Administrator Password Protection (see below).

I am, too, using Admin Tools on this site and, just like you, I sell subscriptions over PayPal. In fact, that's the only way I can make money. I have also helped build or maintain other sites except this one. I have not seen any conflicts between Admin Tools and PayPal as long as I:
a. remove the Bad Behaviour integration or add PayPal's IPN IP to Bad Behaviour's IP white list
b. Do not use the Administrator Password Protection. Note that VirtueMart is placing its IPN endpoint PHP file in the administrator directory. If you password protect the administrator directory then of course it won't work! Apache will require a username/password to access that file, ignoring the .htaccess exceptions (sorry, that's how Apache works, it's not my fault and I can obviously not change it)
c. add .htaccess exceptions for any PHP files which act as IPN endpoints

My guess is that you have a problem with the administrator password protection feature. If you remove it (e.g. remove the .htaccess and .htpasswd files from your administrator directory) the problems should go away. All of the other issues are fixed with WAF configuration changes and .htaccess exceptions.

Well, I'm not a newbie either and I do know how things I've built work and what the potential problems are ;)

First, let's examine how PayPal works and where each option comes into play. PayPal is a. issuing IPN notifications (POSTing to a hidden URL) and b. redirecting the user back to your site, all the while POSTing the same data as IPN.

The first thing that we have to establish is what the IPN script is. If it's not going through Joomla!'s index.php files, the following two things are required:
1. If the script is inside the administrator directory, you must not use the Administrator Password Protection because Apache will block access to the script
2. You must add it to the exceptions list (allow direct access to these files) in .htaccess Maker, so that it is not blocked
3. If you are using a redirection, e.g. non-www to www, you MUST use the correct URL, e.g. http://www.example.com/adminsitrator/com_foobar/ipn.php and NOT http://example.com/adminsitrator/com_foobar/ipn.php. This is a very common mistake. Do note that HTTP 302 redirections do not pass the POST data along and cause the IPN post to fail.

This is adequate, since the "System - Admin Tools" plugin is of course not executed by scripts which run outside the context of Joomla!'s index*.php files.

If the IPN goes through Joomla!'s index.php (like it does on this very site and, I assume, happens with the music downloads software) or if you get errors when users are redirected back from PayPal to your site, you need to disable the following Web Application Firewall options:
- "Cross Site Scripting block (XSSShield)" as it may cause issues with a minority of IPN requests
- "CSRF/Anti-spam form protection (CSRFShield)" as it will get triggered by POST requests originating from a remote server (they have a blank referrer or a referrer not belonging to your site)
- Block tmpl=foo system template switch if you suspect that your e-commerce software is using any tmpl=foo parameter, where foo is not included in the "List of allowed tmpl= keywords". Alternatively, if you do know which such parameter is used, add it to the list.
- Enable Bad Behaviour filter unless you add 66.211.170.66 to "White list IPs (comma separated list)"
- You should also add 66.211.170.66 to the "Never block these IPs" list under the "Auto-ban Repeat Offenders"

Of course, you can always review the Security Exceptions log for security exceptions originating from 66.211.170.66, the IP of PayPal's IPN server. You can see which protection is triggered and disable it in WAF configuration.

That said, if you do disable ALL options in Web Application Firewall, the plugin does absolutely nothing. It goes through a series of if-blocks, it sees that nothing is enabled and simply exits. So, telling me that you disabled everything, the site didn't work and uninstalling Admin Tools allowed everything to work just "doesn't stick". As you know -probably better than me- if some code doesn't execute, its mere existence doesn't make any difference to the outcome. That's why I suspect that you didn't disable all options when doing your debugging.

If you want, you can set up a clone of your site (a dev site), linked with PayPal's sandbox -if that's an option on your e-commerce software- and I will set up Admin Tools for you so that it doesn't conflict with your site.

You're welcome :)

There's no way you tried all of the above steps. One of those steps would have allowed you to find out the problem:

Of course, you can always review the Security Exceptions log for security exceptions originating from 66.211.170.66, the IP of PayPal's IPN server. You can see which protection is triggered and disable it in WAF configuration.

So, did you do that? What is the reason mentioned in the security exceptions log for the IP address 66.211.170.66?