The 403 error is a different kettle of fish. This is Joomla losing the Download ID even though it's still defined in the component itself. This has to do with the insane way Joomla works for updates. We are copying the Download ID into Joomla's #__update_sites table, in the extra_query column as dlid=THE_DOWNLOAD_ID_YOU_ENTERED. When Joomla finds updates it creates entries in the #__updates table and copies over the extra_query column from the #__update_sites table at the time the update was found. When you try to install the update it reads our update information all over again, takes the download URL and appends the extra_query to the URL to create the authorised URL that includes the Download ID.
We observed that starting with Joomla 3.9.25 it would randomly lose the extra_query column content from the #__update_sites table. This typically happens when you use the Rebuild Update Sites button in Joomla's Update Sites page but we believe it may sometimes happen when you install an update (or our clients reporting this issue don't remember clicking the Rebuild Update Sites button; either could be true, honestly).
The solution to that is to remove the Download ID from the extension, save the component Options, visit the extension's Control Panel page and then enter the Download ID when prompted. This would normally work.... except that it only updates the #__update_sites table. Because of the way Joomla works you also need to clear the update cache and fetch the updates again.
This would normally work... except Joomla has another bug. There's an undocumented database query cache in the updates page which gets in the way.
To cut a long story short, here is the "simple" 18-step process to address the Joomla bugs you've stumbled upon: https://www.akeeba.com/documentation/akeeba-backup-documentation/update.html#dlid-change-after-update Please follow all of the steps, in the exact order presented, even though most of these look repetitive or just plain stupid. You will be working around a number of Joomla bugs by doing that.
These are Joomla bugs I have been privately reporting to the Joomla project since 2014. They were not getting fixed. I filed a public issue on march 6th, 2021 because I reckon 8 years of no action from the project's part is a disgrace. I was met with open hostility and threats against our company.
I'd very much prefer if we didn't have to use the broken, buggy, unfit for purpose built-in Joomla extensions updater. When we were using our own updater things were so much easier for you and us both. However, since 2017 we are FORCED to use Joomla's extensions updater on pain of having our software delisted from the Joomla Extensions Directory.
Now, does it make sense that the Joomla project forces us to use a broken updater, refuses to fix it and blames us, the victims, for the code they have no control over? No, it doesn't. It's a disgrace and unconscionable. We DID offer to fix these issues many times over the past 8 years; they refused our help. I don't know what else to do except stop covering for Joomla and give you, our clients, the unvarnished truth. Joomla's extensions updater is broken, the project refuses to fix it and forces it upon us third party developers. You will continue having problems updating software not because we, Akeeba Ltd, don't care or don't know how to fix it but because the Joomla project itself doesn't want to fix any of that and won't let us fix any of that either. I know exactly what is broken and why; I've told core maintainers plenty of times. They refuse to even consider the possibility that these obvious issues exist. What can I say? These people are crazy...
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
