Support

Support,

I have just installed a new Joomla site on a Sub-domain that is hosted by SiteGround.com. Each time I log into the administrator account I'm getting the following Security Exceptions. I wasn't paying a lot of attention to it until Admin Tools locked me out of the site. Here is the details I'm getting in the Exception Log.

Admin Query String https://hopeco.upliftangel.com/administrator/index.php?option=com_jreviews
Backend Edit Admin User https://hopeco.upliftangel.com/administrator/index.php

I have the Admin Secret URL turned on and that is working fine.
I have also installed JReviews on the site, so that may be triggering the Security Exception.
I also cleared the browser cookies and history and had the same thing happen.

Looks like JReviews is trying to run something each time the admin user logs on.

Is there a way to fix this or do I need to turn off the Exception Monitoring?

Let me know if you need any more info.
Dan

Hi Dan! If you look at Web Application Firewall, Configure WAF, on the Hardening Options tab, the field "Disable creating / editing backend users from the frontend" is causing the problem. I think jreviews is trying to write to the user record and since this is an administrator, Admin Tools is throwing an exception.

We can turn that option off, but that isn't the best solution. It would work temporarily.

The exception text that you posted is not what I would expect. Is that really what is in the log? There are usually component and view parameters that we can use to create a WAF Exception.

Hi Dale,

I took a screen shot of the Security Error Log from WAF on the site so you could see what I'm seeing.

I also went to WAF Hardening Options and turned OFF as you recommended.

Disable editing backend users' properties
Disable creating / editing backend users from the frontend

Let me know if you want any more information or a different log.

Dan

Dan,

Nicholas tells me that we can't do what I had in mind. We can't set up an exemption to allow one extension to write to the user records. So the other place that can block that is on the same page, just above the first one, "Disable editing backend users' properties". Set that to No.

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.