Support

Hi,

I had an issue where the Social login callbacks were blocked by the htaccess maker rule: Protect against common file injection attacks. Apparently it doesn't like a get parameter starting with https. I could solve it by adding this custom rule to the beginning of the htaccess file:

# Allow supported Akeeba Social Login OAuth callbacks
RewriteCond %{HTTPS} =on [OR]
RewriteCond %{HTTP:X-Forwarded-Proto} =https
RewriteCond %{HTTP_HOST} ^www\.MYDOMAIN\.com(?::443)?$ [NC]
RewriteCond %{REQUEST_URI} ^/index\.php$ [NC]
RewriteCond %{QUERY_STRING} ^(?:(?:option|group|plugin|format|iss|code|scope|authuser|prompt|state|session_state)=[^&]*&?)+$ [NC]
RewriteCond %{QUERY_STRING} (^|&)option=com_ajax(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)group=sociallogin(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)plugin=(google|microsoft|github|facebook)(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)format=raw(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)code=[^&]+(&|$) [NC]
RewriteRule ^index\.php$ - [END]

It's fixed for me so I marked the ticket low priority but it took me a good while to even notice and to find the reason for the error. Maybe it could be fixed at the root eventually. Thank you!

You're absolutely right. I didn't check the other integrations and wrongly assumed they follow the same pattern. In fact, only Google is blocked by the htaccess rule and there is no need to include the other providers. (I'm only using those four so I didn't check any of the other ones either).
Only with google:

RewriteCond %{HTTPS} =on [OR]
RewriteCond %{HTTP:X-Forwarded-Proto} =https
RewriteCond %{HTTP_HOST} ^www\.MYDOMAIN\.com(?::443)?$ [NC]
RewriteCond %{REQUEST_URI} ^/index\.php$ [NC]
RewriteCond %{QUERY_STRING} ^(?:(?:option|group|plugin|format|iss|code|scope|authuser|prompt|state|session_state)=[^&]*&?)+$ [NC]
RewriteCond %{QUERY_STRING} (^|&)option=com_ajax(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)group=sociallogin(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)plugin=google(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)format=raw(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)iss=https://accounts\.google\.com(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)code=[^&]+(&|$) [NC]
RewriteRule ^index\.php$ - [END]