Decryption key:
AA Google Business Reviews v9.2.6
The system had a critical issue where:
The vote counter (votes.json) was randomly resetting to 0
The reset was happening without user action
It appeared on two separate Joomla sites at the same time
Root Cause Identified
After investigation and testing, the real cause was:
A publicly accessible file:
/modules/mod_aa_google_reviews/tmpl/reset.php
This file:
Was reachable via direct URL (GET request)
Contained unprotected reset logic
Was setting votes back to:
{ "yes": 0, "no": 0 }
Why It Happened
Bots / crawlers / direct URL access could trigger it
No authentication or request restriction existed
Joomla front-end visibility was irrelevant (URL was still accessible)
Fix Applied
1. Reset.php secured
We blocked direct browser access by enforcing POST-only execution:
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
exit;
}
✔ Now it cannot be triggered via URL
✔ Only callable via proper form/AJAX POST request
2. System behavior stabilized
After the fix:
Votes remain stable (e.g. 4000+ no longer reset)
No more external or accidental resets
Front-end voting still works normally
3. Architecture clarified
We confirmed:
vote.php handles vote increments
votes.json stores persistent data
Final Result
✔ Stable voting system
✔ No more random resets
✔ Secure reset endpoint
✔ Production-safe behavior restored
