Support

Admin Tools

#33159 Admin tools Blocking Balbooa Form Submissions

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Tuesday, 07 July 2020 17:17 CDT

futureclient
We have a client inform us that when trying to submit a regular contact form enquiry on their site, they got blocked by admin tools.

Looking at the Exceptions log it states:
CSRF Shield - /index.php?option=com_baforms&task=form.getRecaptchaData
CSRF Shield - /index.php?option=com_baforms&task=form.getFormsLanguage

We have tested on different PC systems at different locations with different results:
Location 1
PC 1 | Windows | Chrome - Not blocked
PC 2 | Windows | Microsoft Edge - Blocked

Location 2 (client)
PC 1 | Mac | Chrome & Safari - Blocked

Location 3
PC 1 | Windows | Chrome - Blocked

What is the issue for this? A lot of our websites use Balbooa Forms and Akeeba Admin Tools so this is a major issue. We contacted Balbooa and they said to "address this issue" to you

Regards

futureclient
UPDATE
When an IP gets gets logged as an exception there is a message that we have set 'to get in touch with us if you are having problems accessing our website'.

A client has just called us to say they have been blocked out, what they did was:-

Search on Google for the business and they clicked on the 'Visit Website' button (on the right), they then got instantly blocked, they didn't even see the website just got the exception message and phoned us, as it's our number on the message.

This has been the same for two other clients this morning, since we have updated both Balbooa Forms and Admin Tools. Both have Macs

As soon as we unpublish the Balbooa forms plugin it seems to be fine and no blocking happens.

nicholas
Akeeba Staff
Manager
Administrator, Components, Admin Tools, Web Application Firewall, Configure WAF. Click on the Request Filtering tab and find the CSRF/Anti-spam form protection (CSRFShield) setting. Set it to No. Click on Save & Close in the toolbar.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

futureclient
Following these steps seems to have fixed the issue. This seems to only have issues on the latest release of BA Forms, version 2.0.4.

Thanks

nicholas
Akeeba Staff
Manager
You can try setting that option to Basic. I believe the problem was only caused by setting it to Advanced, an option that dates back to the Joomla 1.5 days when the only POST requests expected carried an anti-CSRF token and Joomla used just one type of token. These assumptions are no longer true and that's a setting that's been slated for removal in the next version.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!