Suppress mime type detection - makes dropdown menus in admin unusable Topic is solved

[MediaFish]

Hi,

When I have the following active in my .htaccess file the dropdown menus in the Joomla Admin Menu do not drop down anymore.

## Suppress mime type detection in browsers for unknown types
<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</IfModule>

When deleting it there is no problem - anybody else had this problem - or might this be server related?

You can check the behaviour here on this short video https://drive.google.com/file/d/1ivX5sF ... BWwPE/view

Thanks

[toivo]

The issue can be caused by javascript errors. The nosniff option causes browsers to refuse to run scripts if the MIME types of the scripts are not correct.

Press F12 to run Web Developer tools and check if there are any error reports in the Console tab.

[MediaFish]

Hi,

Thanks, yes there are many resources that are blocked and I also have loads of warnings below - but why are they blocked as most if not all of them seem to be native Joomla files -

Are the mime types missing on the server?

Blocked:

Code: Select all

Die Ressource von "http://mywebsite.com/media/jui/js/jquery.min.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/jui/js/jquery-noconflict.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/jui/js/jquery-migrate.min.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/jui/js/bootstrap.min.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/plg_quickicon_joomlaupdate/js/jupdatecheck.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/plg_quickicon_extensionupdate/js/extensionupdatecheck.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/plg_quickicon_privacycheck/js/privacycheck.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/mod_sampledata/js/sampledata-process.js" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/media/system/js/core.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
Die Ressource von "http://mywebsite.com/administrator/templates/isis/js/template.js?e8ec6ae6be0f26ef964db23672d38157" wurde wegen eines MIME-Typ-Konfliktes ("text/x-js") blockiert (X-Content-Type-Options: nosniff).[Weitere Informationen] index.php
ReferenceError: jQuery is not defined[Weitere Informationen] index.php:97:1

Warnings:

Code: Select all

Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/jui/js/jquery.min.js?e8ec6ae6be0f26ef964db23672d38157". index.php:84:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/jui/js/jquery-noconflict.js?e8ec6ae6be0f26ef964db23672d38157". index.php:85:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/jui/js/jquery-migrate.min.js?e8ec6ae6be0f26ef964db23672d38157". index.php:86:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/jui/js/bootstrap.min.js?e8ec6ae6be0f26ef964db23672d38157". index.php:87:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/plg_quickicon_joomlaupdate/js/jupdatecheck.js?e8ec6ae6be0f26ef964db23672d38157". index.php:88:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/plg_quickicon_extensionupdate/js/extensionupdatecheck.js?e8ec6ae6be0f26ef964db23672d38157". index.php:89:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/plg_quickicon_privacycheck/js/privacycheck.js?e8ec6ae6be0f26ef964db23672d38157". index.php:90:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/mod_sampledata/js/sampledata-process.js". index.php:91:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/media/system/js/core.js?e8ec6ae6be0f26ef964db23672d38157". index.php:92:1
Laden fehlgeschlagen für das <script> mit der Quelle "http://mywebsite.com/administrator/templates/isis/js/template.js?e8ec6ae6be0f26ef964db23672d38157". index.php:94:1

[toivo]

The issue looks like originating from the caching mechanism. The MIME type "text/x-js" is not accepted by browsers when the nosniff option has been set. The correct MIME type is "application/javascript".

This behaviour was reported after Joomla 3.9.3 had been released with the advice introducing the security option, which enables strict MIME type checking in browsers:
viewtopic.php?f=710&t=970137#p3561929

[MediaFish]

Hi,

Thanks,

I deactivated all extensions, templates, languages modules and plugins installed that are not native and set themplate to beez3.
I deleted the cache in the browser
I deleted the cache in the old template I used
I checked the cache folder in Joomla - no files were inside
I activated the "nosniff" in the .htaccess again and uploaded it
I refreshed the admin page and got 10 errors

caught ReferenceError: jQuery is not defined
at index.php:33

And at index.php line 33 it says:

jQuery(function($){ initTooltips(); $("body").on("subform-row-add", initTooltips); function initTooltips (event, container) { container = container || document;$(container).find(".hasTooltip").tooltip({"html": true,"container": "body"});} });



I then installed a fresh Joomla 3.8 and updated it to 3.9.5 version without any extension and get the exact same error if nosniff option activated...

So it seems this has nothing to do with any extensions as suggested in the thread you linked to -

Any suggestions appreciated :-)

[toivo]

Unable to reproduce the error in either site on localhost Wampserver or remote Linux. If that problem were commonplace, the forum would be flooded with similar reports.

Please post the results of the Forum Post Assistant (FPA) by following the instructions from viewtopic.php?f=806&t=969442.

[toivo]

Upload the following script to the Joomla folder and browse to it, to check the MIME types of the scripts from the back end. Normally they are listed as 'text/plain'.

Code: Select all

<?php
$crlf		= '<br />';
$scripts	= array(
		'media/jui/js/jquery.js', 
		'media/jui/js/jquery.min.js',
		'media/jui/js/jquery-noconflict.js',
		'media/jui/js/jquery-migrate.min.js',
		'media/plg_quickicon_joomlaupdate/js/jupdatecheck.js',
		'media/plg_quickicon_extensionupdate/js/extensionupdatecheck.js',
		'media/plg_quickicon_privacycheck/js/privacycheck.js',
		'media/jui/js/bootstrap.min.js',
		'media/mod_sampledata/js/sampledata-process.js',
		'media/system/js/core.js',
		'administrator/templates/isis/js/template.js'
	);
foreach ($scripts as $script)
{
	echo $script . ' = ' . mime_content_type($script) . $crlf;
}

[MediaFish]

Hi,

Thanks I get the following result:

media/jui/js/jquery.js = text/plain
media/jui/js/jquery.min.js = text/plain
media/jui/js/jquery-noconflict.js = text/plain
media/jui/js/jquery-migrate.min.js = text/plain
media/plg_quickicon_joomlaupdate/js/jupdatecheck.js = text/plain
media/plg_quickicon_extensionupdate/js/extensionupdatecheck.js = text/plain
media/plg_quickicon_privacycheck/js/privacycheck.js = text/plain
media/jui/js/bootstrap.min.js = text/plain
media/mod_sampledata/js/sampledata-process.js = text/plain
media/system/js/core.js = text/plain
administrator/templates/isis/js/template.js = text/plain

[toivo]

That looks all right. What about the FPA results? Something may not be configured right in the server if the browser detects MIME type 'text/x-js' instead.

[MediaFish]

Hi again,

Yes sorry I did not read that here it is:

When I have the following active in my .htaccess file the dropdown menus in the Joomla Admin Menu do not drop down anymore. ## Suppress mime type detection in browsers for unknown types <IfModule mod_headers.c> Header always set X-Content-Type-Options "nosniff" </IfModule> When deleting it there is no problem - anybody else had this problem - or might this be server related?

Joomla! Instance :: Joomla! 3.9.5-Stable (Amani) 9-April-2019
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) | Owner: --protected-- . (uid: /gid: ) | Group: --protected-- (gid: ) | Valid For: 3.9
Configuration Options :: Offline: false | SEF: true | SEF Suffix: false | SEF ReWrite: true | .htaccess/web.config: Yes | GZip: false | Cache: false | CacheTime: 15 | CacheHandler: file | CachePlatformPrefix: false | FTP Layer: false | Proxy: false | LiveSite: | Session lifetime: 15 | Session handler: database | Shared sessions: false | SSL: 0 | Error Reporting: maximum | Site Debug: false | Language Debug: false | Default Access: 1 | Unicode Slugs: false | dbConnection Type: mysqli | PHP Supports J! 3.9.5: Yes | Database Supports J! 3.9.5: Yes | Database Credentials Present: Yes |

Host Configuration :: OS: Linux | OS Version: 4.8.11-hoststar | Technology: x86_64 | Web Server: Apache | Encoding: gzip, deflate | Doc Root: --protected-- | System TMP Writable: Yes | Free Disk Space : 199.60 GiB |

PHP Configuration :: Version: 7.1.1 | PHP API: cgi-fcgi | Session Path Writable: No | Display Errors: | Error Reporting: 1 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: /home/www/:/tmp:/usr/local/php71/lib/php/ | Uploads: 1 | Max. Upload Size: 100M | Max. POST Size: 100M | Max. Input Time: 60 | Max. Execution Time: 180 | Memory Limit: 128M

Database Configuration :: Version: 5.6.36 (Client:mysqlnd 5.0.12-dev - 20150407 - $Id: b396954eeb2d1d9ed7902b8bae237b287f21ad9e $) | Host: --protected-- (--protected--) | default Collation: latin1_swedish_ci (default Character Set: latin1) | Database Size: 5.63 MiB | #of Tables:  82

PHP Extensions :: Core (7.1.1) | date (7.1.1) | libxml (7.1.1) | openssl (7.1.1) | pcre (7.1.1) | zlib (7.1.1) | bcmath (7.1.1) | bz2 (7.1.1) | calendar (7.1.1) | ctype (7.1.1) | curl (7.1.1) | dom (20031129) | hash (1.0) | fileinfo (1.0.5) | filter (7.1.1) | ftp (7.1.1) | gd (7.1.1) | gettext (7.1.1) | SPL (7.1.1) | iconv (7.1.1) | session (7.1.1) | intl (1.1.0) | json (1.5.0) | mbstring (7.1.1) | mcrypt (7.1.1) | standard (7.1.1) | mysqlnd (mysqlnd 5.0.12-dev - 20150407 - $Id: b396954eeb2d1d9ed7902b8bae237b287f21ad9e $) | pcntl (7.1.1) | mysqli (7.1.1) | Phar (2.0.2) | posix (7.1.1) | readline (7.1.1) | Reflection (7.1.1) | imap (7.1.1) | shmop (7.1.1) | SimpleXML (7.1.1) | soap (7.1.1) | sockets (7.1.1) | exif (1.4 $Id: 8bdc0c8f27c2c9dd1f7551f1f9fe3ab57a06a4b1 $) | sysvmsg (7.1.1) | sysvsem (7.1.1) | sysvshm (7.1.1) | tokenizer (7.1.1) | wddx (7.1.1) | xml (7.1.1) | xmlreader (7.1.1) | xmlrpc (7.1.1) | xmlwriter (7.1.1) | xsl (7.1.1) | zip (1.13.5) | cgi-fcgi () | PDO (7.1.1) | pdo_mysql (7.1.1) | pdo_sqlite (7.1.1) | sqlite3 (0.7-dev) | imagick (3.4.3) | ionCube Loader () | Zend Engine (3.1.0) |
Potential Missing Extensions ::
Disabled Functions :: apache_get_modules | apache_get_version | apache_getenv | apache_note | apache_setenv | define_syslog_variables | ini_alter | link | openlog | passthru | pfsockopen | posix_getpwuid | posix_kill | posix_mkfifo | posix_setpgid | posix_setsid | posix_setuid | posix_uname | proc_close | proc_get_status | proc_nice | proc_open | proc_terminate | shell_exec | show_source | syslog | system | virtual |

Switch User Environment (Experimental) :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Custom SU (LiteSpeed/Cloud/Grid): No
Potential Ownership Issues: Maybe

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (---) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) | administrator/logs/ (755) |

Elevated Permissions (First 10) ::

Database statistics :: Uptime: 1595952 | Threads: 6 | Questions: 207650974 | Slow queries: 213 | Opens: 8111704 | Flush tables: 1 | Open tables: 64 | Queries per second avg: 130.111 |

Components :: SITE ::
Core :: com_wrapper (3.0.0) 1 | com_mailto (3.0.0) 1 |
3rd Party::

Components :: ADMIN ::
Core :: com_associations (3.7.0) 1 | com_contenthistory (3.2.0) 1 | com_templates (3.0.0) 1 | com_menus (3.0.0) 1 | com_banners (3.0.0) 1 | com_postinstall (3.2.0) 1 | com_plugins (3.0.0) 1 | com_cpanel (3.0.0) 1 | com_privacy (3.9.0) 1 | com_fields (3.7.0) 1 | com_installer (3.0.0) 1 | com_finder (3.0.0) 1 | com_content (3.0.0) 1 | com_newsfeeds (3.0.0) 1 | com_modules (3.0.0) 1 | com_tags (3.1.0) 1 | com_actionlogs (3.9.0) 1 | com_redirect (3.0.0) 1 | com_media (3.0.0) 1 | com_users (3.0.0) 1 | com_languages (3.0.0) 1 | com_categories (3.0.0) 1 | com_checkin (3.0.0) 1 | com_joomlaupdate (3.6.2) 1 | com_cache (3.0.0) 1 | com_messages (3.0.0) 1 | com_admin (3.0.0) 1 | com_config (3.0.0) 1 | com_ajax (3.2.0) 1 | com_search (3.0.0) 1 | com_login (3.0.0) 1 |
3rd Party:: Akeeba (6.4.2.1) 1 |

Modules :: SITE ::
Core :: mod_breadcrumbs (3.0.0) 1 | mod_banners (3.0.0) 1 | mod_search (3.0.0) 1 | mod_random_image (3.0.0) 1 | mod_wrapper (3.0.0) 1 | mod_tags_popular (3.1.0) 1 | mod_stats (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_syndicate (3.0.0) 1 | mod_articles_latest (3.0.0) 1 | mod_tags_similar (3.1.0) 1 | mod_articles_archive (3.0.0) 1 | mod_users_latest (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_articles_categories (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_related_items (3.0.0) 1 | mod_finder (3.0.0) 1 | mod_articles_news (3.0.0) 1 | mod_login (3.0.0) 1 | mod_articles_category (3.0.0) 1 | mod_languages (3.5.0) 1 | mod_articles_popular (3.0.0) 1 | mod_whosonline (3.0.0) 1 | mod_footer (3.0.0) 1 |
3rd Party:: Builder (1.19.2) 1 |

Modules :: ADMIN ::
Core :: mod_multilangstatus (3.0.0) 1 | mod_logged (3.0.0) 1 | mod_status (3.0.0) 1 | mod_quickicon (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_stats_admin (3.0.0) 1 | mod_latestactions (3.9.0) 1 | mod_menu (3.0.0) 1 | mod_latest (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_version (3.0.0) 1 | mod_toolbar (3.0.0) 1 | mod_login (3.0.0) 1 | mod_title (3.0.0) 1 | mod_sampledata (3.8.0) 1 | mod_privacy_dashboard (3.9.0) 1 | mod_popular (3.0.0) 1 | mod_submenu (3.0.0) 1 |
3rd Party::

Libraries :: SITE ::
Core ::
3rd Party::

Plugins :: SITE ::
Core :: plg_user_profile (3.0.0) 0 | plg_user_terms (3.9.0) 0 | plg_user_joomla (3.0.0) 1 | plg_user_contactcreator (3.0.0) 0 | plg_content_loadmodule (3.0.0) 1 | plg_content_vote (3.0.0) 0 | plg_content_joomla (3.0.0) 1 | plg_content_finder (3.0.0) 0 | plg_content_confirmconsent (3.9.0) 0 | plg_content_pagenavigation (3.0.0) 1 | plg_content_pagebreak (3.0.0) 1 | plg_content_fields (3.7.0) 1 | plg_content_emailcloak (3.0.0) 1 | plg_captcha_recaptcha_invisible (3.8) 0 | plg_captcha_recaptcha (3.4.0) 0 | plg_privacy_user (3.9.0) 1 | plg_privacy_content (3.9.0) 1 | plg_privacy_actionlogs (3.9.0) 1 | plg_privacy_consents (3.9.0) 1 | plg_privacy_message (3.9.0) 1 | plg_extension_joomla (3.0.0) 1 | plg_authentication_ldap (3.0.0) 0 | plg_authentication_cookie (3.0.0) 1 | plg_authentication_gmail (3.0.0) 0 | plg_authentication_joomla (3.0.0) 1 | plg_editors-xtd_readmore (3.0.0) 1 | plg_editors-xtd_menu (3.7.0) 1 | plg_editors-xtd_image (3.0.0) 1 | plg_editors-xtd_module (3.5.0) 1 | plg_editors-xtd_article (3.0.0) 1 | plg_editors-xtd_pagebreak (3.0.0) 1 | plg_editors-xtd_fields (3.7.0) 1 | plg_twofactorauth_totp (3.2.0) 0 | plg_twofactorauth_yubikey (3.2.0) 0 | plg_search_content (3.0.0) 1 | plg_search_contacts (3.0.0) 1 | plg_search_newsfeeds (3.0.0) 1 | plg_search_tags (3.0.0) 1 | plg_search_categories (3.0.0) 1 | plg_quickicon_joomlaupdate (3.0.0) 1 | plg_quickicon_privacycheck (3.9.0) 1 | plg_quickicon_extensionupdate (3.0.0) 1 | plg_quickicon_phpversioncheck (3.7.0) 1 | plg_system_debug (3.0.0) 1 | plg_system_cache (3.0.0) 0 | plg_system_p3p (3.0.0) 0 | plg_system_sessiongc (3.8.6) 1 | plg_system_redirect (3.0.0) 0 | PLG_SYSTEM_ACTIONLOGS (3.9.0) 0 | plg_system_privacyconsent (3.9.0) 0 | plg_system_logout (3.0.0) 1 | plg_system_languagefilter (3.0.0) 1 | plg_system_stats (3.5.0) 1 | plg_system_languagecode (3.0.0) 1 | plg_system_remember (3.0.0) 1 | plg_system_logrotation (3.9.0) 1 | plg_system_sef (3.0.0) 1 | plg_system_log (3.0.0) 1 | plg_system_updatenotification (3.5.0) 1 | plg_system_highlight (3.0.0) 1 | plg_system_fields (3.7.0) 1 | PLG_ACTIONLOG_JOOMLA (3.9.0) 1 | plg_finder_content (3.0.0) 1 | plg_finder_contacts (3.0.0) 1 | plg_finder_newsfeeds (3.0.0) 1 | plg_finder_tags (3.0.0) 1 | plg_finder_categories (3.0.0) 1 | plg_fields_user (3.7.0) 1 | plg_fields_list (3.7.0) 1 | plg_fields_radio (3.7.0) 1 | plg_fields_integer (3.7.0) 1 | plg_fields_repeatable (3.9.0) 1 | plg_fields_imagelist (3.7.0) 1 | plg_fields_text (3.7.0) 1 | plg_fields_media (3.7.0) 1 | plg_fields_sql (3.7.0) 1 | plg_fields_textarea (3.7.0) 1 | plg_fields_calendar (3.7.0) 1 | plg_fields_color (3.7.0) 1 | plg_fields_usergrouplist (3.7.0) 1 | plg_fields_editor (3.7.0) 1 | plg_fields_checkboxes (3.7.0) 1 | plg_fields_url (3.7.0) 1 | plg_installer_webinstaller (2.0.1) 1 | plg_installer_packageinstaller (3.6.0) 1 | PLG_INSTALLER_URLINSTALLER (3.6.0) 1 | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) 1 |
3rd Party:: plg_quickicon_akeebabackup (6.4.2.1) 1 | PLG_SYSTEM_BACKUPONUPDATE (6.4.2.1) 1 | System - YOOtheme Framework (1.19.2) 1 | PLG_SYSTEM_AKEEBAUPDATECHECK (6.4.2.1) 0 | PLG_SYSTEM_AKEEBAACTIONLOG (6.4.2.1) 0 | plg_editors_codemirror (5.40.0) 1 | plg_editors_tinymce (4.5.9) 1 | Installer - YOOtheme (1.0.3) 1 |

Templates :: SITE :: protostar (1.0) 1 | beez3 (3.1.0) 1 | yootheme (1.19.2) 1 |
Templates :: ADMIN :: isis (1.0) 1 | hathor (3.0.0) 1 |

[toivo]

Even if your issue occurs at the back end, what happens if you disable the Yootheme system plugin?

[MediaFish]

Hi,

Thanks - that's the first thing I did - deactivating all third-party plugins.

I will contact the hosting company tomorrow and let you know what they say.

Thanks again

[MediaFish]

Hi,

Answer from the host: This behaviour is due to the server configuration.

They also said they are about to update the server and after the update there should not be a problem - the host is Hoststar if anybody else got the same problem...

Thanks for assisting.

[toivo]

Thanks for the update. The host may be using a reverse proxy front ending your site, with its own configuration, causing the issue.

[uaintgotthisid]

Thanks for this I'm getting this loads too. I'll contact my host.