See this post in the Facebook user group for details: https://www.facebook.com/groups/joomlanospam/permalink/10158355853635997/

Tagging @richard67

Steps to reproduce the issue

• Use a live host which has some sort of anti-DoS protection. This is the tricky bit...
• Install Joomla 4
• Go to the administrator main page

Expected result

The notification icons are all green.

Actual result

Some or all of the notification icons remain red.

System information (as much as possible)

You need a live host which has some sort of anti-DoS protection and your Internet connection needs to be fast enough to trigger it.

Additional comments

This is the same problem I described in #37911 under “Batch update checks”.

Each one of the notification icons uses Joomla.Request to run an XMLHttpRequest on the server to retrieve the status of the icon. If the request fails with a server error the icon stays red.

The problem is that all of these icons try to send the request at the same time. From the server's point of view this looks like a Denial of Service attack. As a result the requests are blocked on most live servers (e.g. cPanel-based servers with mod_bw if I recall the name of the Apache module correctly). In some servers the user's IP is temporarily blocked.

The solution for this is a bit more complicated than what I did in my Joomla! Update PR #37911. Since each of these icons is its own plugin we can't magically batch them, nor is it desirable. Each update check may take a lot of time that combining them in a single request would cause a server timeout.

The solution is to handle these requests the same way I am handling multiple requests in Akeeba Backup's database and filesystem filter pages: a FIFO buffer.

We can add a new option to Joomla.Request, let's call it fifo. If it's true the request is added to a FIFO buffer. If the FIFO buffer was previously empty, Joomla.Request fetches and executes the first request in the FIFO buffer. Upon conclusion (successful return or error) it calls the handler code for that request and then repeats the FIFO fetch until there are no more requests in the FIFO buffer.

This is not perfectly bulletproof (bulletproofing it would require installing a timer triggering every 0.1s) but it's workable. In the use case described in this issue we'd never get concurrent requests. In case we had several asynchronous JS threads (timers) we might indeed get multiple requests but I think it's safe to say that this is not a use case Joomla.Request was made to handle anyway.