[BUG]: Cloudflare is making it impossible to upgrade #1210
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: joomla/Component-Builder#1210
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What Happened?
With Joomla! installed on localhost, I installed version 5.0.4-beta1.
Today I have attempted to perform updates through Extensions > Manage Extensions, it keeps showing an error:
Update: Could not open update site #4 "Component Builder", URL: https://git.vdm.dev/joomla/Component-Builder/raw/branch/5.x/componentbuilder_update_server.xml
I have attempted to load this URL and was blocked by Cloudflare "Please verify you are human". After complying with their request, I can then see the contents of the XML file in the browser tab, however when I then try to do the updates again in Joomla!, it gives the same error message.
Steps to reproduce the Bug
Install Joomla! on localhost.
Install JCB v5.0.4-beta1.
Go to System > Extensions > Manage Extensions.
Click "Check for Updates"
It should show available updates, however it shows an error message instead "Update: Could not open update site #4 "Component Builder", URL: https://git.vdm.dev/joomla/Component-Builder/raw/branch/5.x/componentbuilder_update_server.xml"
Which Joomla version are you compiling in?
5.2.5
Which PHP version are you compiling in?
8.1.31
Which Joomla versions are you targeting?
3 and 5
Which PHP version are you targeting?
7.4,8.1, 8.2
Which Web server is JCB running on?
Dockerfile from php:8.1-fpm-bullseye
Which Relational Database is JCB running on?
Docker image mysql:8.0.40-debian
Which OS is JCB running on?
Debian Bullseye
Which JCB version are you using?
v5.0.4-beta1
Where in JCB did this issue occur?
Other
On which browsers did you encounter the issue?
Firefox, Chrome, Microsoft Edge
Additional Comments
I was also not able to upgrade Joomla! Core from 5.2.2 to 5.2.5 through the administrator control panel, it was giving some error message "File checksum failed", so I had to go and download the upgrade zip file and upload it manually. It was then able to upgrade to 5.2.5 successfully.
I have tried to do the upgrade on three browsers: Firefox, Chrome and Microsoft.
I am using a Windows 11 OS behind a corporate firewall. I have also tried disconnecting from that network and connecting to my Mobile Phone's WIFI hotspot, but it still gives the same error message "unable to load the xml file".
I have obtained some information for debugging. This is the content of $response after $response = $http->get($url, [], 20); at line 251 of /libraries/src/Updater/UpdateAdapter.php
I can see a 403 "Forbidden" response is being returned by Cloudflare. I would imagine that Cloudflare is choosing to forbid the PHP Http Client because it is regarding it as a bot:
object(Joomla\CMS\Http\Response)#1586 (7) { ["phrases":"Laminas\Diactoros\Response":private]=> array(66) { [100]=> string(8) "Continue" [101]=> string(19) "Switching Protocols" [102]=> string(10) "Processing" [103]=> string(11) "Early Hints" [200]=> string(2) "OK" [201]=> string(7) "Created" [202]=> string(8) "Accepted" [203]=> string(29) "Non-Authoritative Information" [204]=> string(10) "No Content" [205]=> string(13) "Reset Content" [206]=> string(15) "Partial Content" [207]=> string(12) "Multi-Status" [208]=> string(16) "Already Reported" [226]=> string(7) "IM Used" [300]=> string(16) "Multiple Choices" [301]=> string(17) "Moved Permanently" [302]=> string(5) "Found" [303]=> string(9) "See Other" [304]=> string(12) "Not Modified" [305]=> string(9) "Use Proxy" [306]=> string(12) "Switch Proxy" [307]=> string(18) "Temporary Redirect" [308]=> string(18) "Permanent Redirect" [400]=> string(11) "Bad Request" [401]=> string(12) "Unauthorized" [402]=> string(16) "Payment Required" [403]=> string(9) "Forbidden" [404]=> string(9) "Not Found" [405]=> string(18) "Method Not Allowed" [406]=> string(14) "Not Acceptable" [407]=> string(29) "Proxy Authentication Required" [408]=> string(15) "Request Timeout" [409]=> string(8) "Conflict" [410]=> string(4) "Gone" [411]=> string(15) "Length Required" [412]=> string(19) "Precondition Failed" [413]=> string(17) "Content Too Large" [414]=> string(12) "URI Too Long" [415]=> string(22) "Unsupported Media Type" [416]=> string(21) "Range Not Satisfiable" [417]=> string(18) "Expectation Failed" [418]=> string(12) "I'm a teapot" [421]=> string(19) "Misdirected Request" [422]=> string(21) "Unprocessable Content" [423]=> string(6) "Locked" [424]=> string(17) "Failed Dependency" [425]=> string(9) "Too Early" [426]=> string(16) "Upgrade Required" [428]=> string(21) "Precondition Required" [429]=> string(17) "Too Many Requests" [431]=> string(31) "Request Header Fields Too Large" [444]=> string(34) "Connection Closed Without Response" [451]=> string(29) "Unavailable For Legal Reasons" [499]=> string(21) "Client Closed Request" [500]=> string(21) "Internal Server Error" [501]=> string(15) "Not Implemented" [502]=> string(11) "Bad Gateway" [503]=> string(19) "Service Unavailable" [504]=> string(15) "Gateway Timeout" [505]=> string(26) "HTTP Version Not Supported" [506]=> string(23) "Variant Also Negotiates" [507]=> string(20) "Insufficient Storage" [508]=> string(13) "Loop Detected" [510]=> string(24) "Not Extended (OBSOLETED)" [511]=> string(31) "Network Authentication Required" [599]=> string(29) "Network Connect Timeout Error" } ["reasonPhrase":"Laminas\Diactoros\Response":private]=> string(9) "Forbidden" ["statusCode":"Laminas\Diactoros\Response":private]=> int(403) ["headers":protected]=> array(22) { ["date"]=> array(1) { [0]=> string(29) "Wed, 12 Mar 2025 23:07:14 GMT" } ["content-type"]=> array(1) { [0]=> string(24) "text/html; charset=UTF-8" } ["accept-ch"]=> array(1) { [0]=> string(277) "Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA" } ["cf-mitigated"]=> array(1) { [0]=> string(9) "challenge" } ["critical-ch"]=> array(1) { [0]=> string(277) "Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA" } ["cross-origin-embedder-policy"]=> array(1) { [0]=> string(12) "require-corp" } ["cross-origin-opener-policy"]=> array(1) { [0]=> string(11) "same-origin" } ["cross-origin-resource-policy"]=> array(1) { [0]=> string(11) "same-origin" } ["origin-agent-cluster"]=> array(1) { [0]=> string(2) "?1" } ["permissions-policy"]=> array(1) { [0]=> string(267) "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()" } ["referrer-policy"]=> array(1) { [0]=> string(11) "same-origin" } ["server-timing"]=> array(2) { [0]=> string(30) "chlray;desc="91f6f25578e2d9bf"" [1]=> string(196) "cfL4;desc="?proto=TCP&rtt=10177&min_rtt=9835&rtt_var=2590&sent=6&recv=8&lost=0&retrans=0&sent_bytes=3373&recv_bytes=858&delivery_rate=380479&cwnd=252&unsent_bytes=0&cid=7acd262a84c26616&ts=21&x=0"" } ["x-content-options"]=> array(1) { [0]=> string(7) "nosniff" } ["x-frame-options"]=> array(1) { [0]=> string(10) "SAMEORIGIN" } ["cf-chl-out"]=> array(1) { [0]=> string(133) "gN6oAvoWiTReyoFaJO65LgoZkSeV3B8X3FPtcMeEpLMAoPAnSjb83FE0/x3A1dgmZHAm747qSm3reHe7QhTZT/KzLWUD+wdzCIIpkwpxfoE=$l3TCB3z+3J6PhXj17Xjilw==" } ["cache-control"]=> array(1) { [0]=> string(82) "private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0" } ["expires"]=> array(1) { [0]=> string(29) "Thu, 01 Jan 1970 00:00:01 GMT" } ["report-to"]=> array(1) { [0]=> string(247) "{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xdwl7DqTFnUSdVDb8aYLsxk3Q5EReN7RcL%2FHCHUcE5KXuRs52Qw2%2By4XctzYmzciD2iRpAmC0Y%2Beto4wjhptHAvvobjfDeMIuwtlchIcMzQ5RoInp%2BhpGFadzW%2FpCw%3D%3D"}],"group":"cf-nel","max_age":604800}" } ["nel"]=> array(1) { [0]=> string(60) "{"success_fraction":0,"report_to":"cf-nel","max_age":604800}" } ["server"]=> array(1) { [0]=> string(10) "cloudflare" } ["cf-ray"]=> array(1) { [0]=> string(20) "91f6f25578e2d9bf-AKL" } ["alt-svc"]=> array(1) { [0]=> string(19) "h3=":443"; ma=86400" } } ["headerNames":protected]=> array(22) { ["date"]=> string(4) "date" ["content-type"]=> string(12) "content-type" ["accept-ch"]=> string(9) "accept-ch" ["cf-mitigated"]=> string(12) "cf-mitigated" ["critical-ch"]=> string(11) "critical-ch" ["cross-origin-embedder-policy"]=> string(28) "cross-origin-embedder-policy" ["cross-origin-opener-policy"]=> string(26) "cross-origin-opener-policy" ["cross-origin-resource-policy"]=> string(28) "cross-origin-resource-policy" ["origin-agent-cluster"]=> string(20) "origin-agent-cluster" ["permissions-policy"]=> string(18) "permissions-policy" ["referrer-policy"]=> string(15) "referrer-policy" ["server-timing"]=> string(13) "server-timing" ["x-content-options"]=> string(17) "x-content-options" ["x-frame-options"]=> string(15) "x-frame-options" ["cf-chl-out"]=> string(10) "cf-chl-out" ["cache-control"]=> string(13) "cache-control" ["expires"]=> string(7) "expires" ["report-to"]=> string(9) "report-to" ["nel"]=> string(3) "nel" ["server"]=> string(6) "server" ["cf-ray"]=> string(6) "cf-ray" ["alt-svc"]=> string(7) "alt-svc" } ["protocol":"Laminas\Diactoros\Response":private]=> string(3) "1.1" ["stream":"Laminas\Diactoros\Response":private]=> object(Laminas\Diactoros\Stream)#1580 (2) { ["resource":protected]=> resource(610) of type (stream) ["stream":protected]=> string(12) "php://memory" } }Hi, Please note that our primary system at git.vdm.dev includes bot protection security, which can occasionally interfere with automated update processes. To make things easier, we’ve mirrored the JCB packages on GitHub.
You can download the latest version directly from the following link:
🔗
https://github.com/vdm-io/pkg-component-builder/archive/refs/tags/v5.1.1-alpha5.zipTo resolve the update issue, simply point your JCB update path to this URL. This should allow the update to complete successfully.
Let us know if you run into any further issues—we're happy to help!
This will also work: