Support

Admin Tools

#10049 periodic XSSShield with Kunena

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Friday, 30 September 2011 16:17 CDT

xenocast
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the forum before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 1.7.1
PHP version: 5.2.14
MySQL version: 5.0.92
Host: (optional, but it helps us help you)
Admin Tools version: AT Pro 2.1.10


Description of my issue:
First, I love AdminTools. It has become my favorite Joomla extension and I have half a mind to start referring nicholas as "Saint Nic." (Patron saint of Joomla) ;)

This issue is stumping me though:

I've got Kunena 1.7 setup and users are getting periodic 403 errors when submitting a post. Discussing with a user he says that it happens (sometimes) when he creates a post then hits the submit button. In the AT log I see that the affected script is here:
/index.php?option=com_kunena&func=post&Itemid=

But what is strange (to me at least) is that it only happens periodically. Any ideas?

nicholas
Akeeba Staff
Manager
This does happen with posts when they end in a URL and non-alphanumeric characters or contain a high number of links followed by text which could trigger the XSS filter. The thing is that the XSS filter is context-free, which means that it doesn't know if the incoming post variable is the body of a post (containing BBcode) and doesn't know where a URL stops. This means that this kind of free-form text can be misdiagnosed as a potential XSS attack. Depending on the frequency and severity of these incidents, you may consider to either live with them -and post a sticky note that posts must not end with a URL not followed by alphanumeric characters- or turn off the XSSShield completely.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

xenocast
Thanks for the quick reply. This is a pretty active forum so it is not a "live with it" option - even with instructions - which as you know, often go completely unread despite any efforts at cajoling etc.
Could this also affect the Forgot Password functionality of Joomla? This is another issue that has come up with users saying that the verification code doesn't work / error User not found (when the user certainly does exist)

nicholas
Akeeba Staff
Manager
No, this doesn't affect the Forget Password page. What usually happens is that the user types a different email address than the one he used to connect to the site or, when he gets the email, he copied the space and dot after the token, leading to an invalid token. I get half a dozen of emails every month from users complaining about such issues myself. In 100% of the cases it was a simple user error. Usually I only have to remind them their username or email address.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

xenocast
unfortunately that is not the case here. I tested it with multiple users and made sure that the code, email address and users were exact. I found a reference to this type of problem with Joomla 1.5 but nothing related to 1.7 and the 1.5 fixes were not relevant. But I will keep looking. Probably not AT related, I was just hoping it might be and there was a known fix.
thanks

nicholas
Akeeba Staff
Manager
I haven't used 1.7 on a large scale site yet, so I can't speculate on the possible cause. I just know it isn't Admin Tools because we are not filtering, we are blocking. If AT was involved, your users would see a 403 page.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!