Ähm, meinst du nicht, das clm_pdf ans Ende sollte, denn ...format=clm_pdf funktioniert, ...clm_pdf?view..... macht es nicht.
Von daher würde es mit der Aussage
Wo dieser Eintrag steht ist eigentlich völlig egal. Die URL wird jedoch nachträglich aufbereitet (mod_rewrite), dabei wird format=clm_pdf entfernt und clm_pdf als Dateityp eingebaut (wie auch immer der bei euch aufgelöst wird). Ich hatte gehofft, dass er das nur macht wenn pdf am Ende steht, dies hat sich aber damit erledigt.
Wenn auch das Testpaket nicht hilft, kannst du mir dann einen Zugang zum Backend (speziell Logging vom CLM) und FTP einrichten? Damit könnte ich einige Variationen in der URL Generierung ausprobieren.
edit:
Versuch bitte auch mal diese leicht angepasste htaccess Datei.
htaccess
### joomla-security # Version: 2.5v1 (2012-05-19) ###
#################################################
### ESSENTIALS
RewriteEngine On
ServerSignature Off
Options All -Indexes
Options +FollowSymLinks
########## Begin - RewriteBase
## Uncomment following line if your webserver's URL
## is not directly related to physical file paths.
## Update Your Joomla! Directory (just / for root)
RewriteBase /
########## End - RewriteBase
### FILTER REQUEST METHODS AND OTHER STUFF
RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC,OR]
RewriteCond %{THE_REQUEST} (\\r|\\n|%0A|%0D) [NC,OR]
RewriteCond %{HTTP_REFERER} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_COOKIE} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999} [NC,OR]
### BLOCK SOME USER AGENTS
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|curl|wget|python|nikto|scan) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
### QUERY STRING EXPLOITS
RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
RewriteCond %{QUERY_STRING} tag\= [NC,OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|'|"|\?|\*|%%|&%%|&"|").* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} (;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|md5|benchmark) [NC,OR]
RewriteCond %{QUERY_STRING} \.\./\.\. [OR]
RewriteCond %{QUERY_STRING} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC]
RewriteRule ^(.*)$ - [R=404,L]
###############################################
##### ADDITIONAL SECURITY FUNCTIONS - END #####
###############################################
#########################################################
##### ADDITIONAL JOOMLA! SECURITY FUNCTIONS - START #####
#########################################################
########## Begin - Rule to block "?tp=1"
RewriteCond %{QUERY_STRING} tp=(.*)
RewriteRule ^(.*)$ index.php [F,L]
########## End - Rule to block "?tp=1"
########## Begin - Rule to block "?templateStyle"
RewriteCond %{QUERY_STRING} templateStyle=(.*)
RewriteRule ^(.*)$ index.php [F,L]
########## End - Rule to block "?templateStyle"
########## Begin - Rewrite rules to block out some common exploits
## If you experience problems on your site block out the operations listed below
## This attempts to block the most common type of exploit `attempts` to Joomla!
#
## Deny access to extension xml files (uncomment out to activate)
#<Files ~ "\.xml$">
#Order allow,deny
#Deny from all
#Satisfy all
#</Files>
## End of deny access to extension xml files
# Block out any script trying to base64_encode data within the URL.
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
# Block out any script that includes a <script> tag in URL.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL.
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL.
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Return 403 Forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]
#
########## End - Rewrite rules to block out some common exploits
########## Begin - File injection protection by SigSiu.net
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC]
RewriteRule ^(.*)$ - [R=404,L]
########## End - File injection protection
########## Begin - Disallow PHP Easter Eggs by Nicholas K. Dionysopoulos
## Disallow PHP Easter Eggs (can be used in fingerprinting attacks to determine
## your PHP version).
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
RewriteRule ^(.*)$ - [R=404,L]
########## End - Disallow PHP Easter Eggs
########## Begin - Deny access to some files
RewriteRule ^(htaccess\.txt|configuration\.php(-dist)?|php\.ini)$ - [R=404,L]
########## End - Deny access to some files
#######################################################
##### ADDITIONAL JOOMLA! SECURITY FUNCTIONS - End #####
#######################################################
##############################################
##### ADDITIONAL CACHE FUNCTIONS - START #####
##############################################
### Compress the output with Gzip
#AddOutputFilterByType deflate text/html text/plain text/css text/javascript application/javascript application/x-javascript application/rss+xml
### Set the default character set
#AddDefaultCharset utf-8
<IfModule mod_headers.c>
<FilesMatch "\\.(ico|pdf|clm_pdf|flv|jpg|jpeg|png|gif|swf)$">
Header set Cache-Control "max-age=33135480, public"
</FilesMatch>
<FilesMatch "\\.(css|js)$">
Header set Cache-Control "max-age=604800, public"
</FilesMatch>
<FilesMatch "\\.(xml|txt)$">
Header set Cache-Control "max-age=216000, public, must-revalidate"
</FilesMatch>
<FilesMatch "\\.(html|htm|php)$">
Header set Cache-Control "max-age=33135480, public"
</FilesMatch>
</IfModule>
############################################
##### ADDITIONAL CACHE FUNCTIONS - END #####
############################################
########## Begin - Joomla! core SEF Section
#
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
#
# If the requested path and file is not /index.php and the request
# has not already been internally rewritten to the index.php script
RewriteCond %{REQUEST_URI} !^/index\.php
# and the request is for something within the component folder,
# or for the site root, or for an extensionless URL, or the
# requested URL ends with one of the listed extensions
RewriteCond %{REQUEST_URI} /component/|(/[^.]*|\.(php|html?|feed|clm_pdf|pdf|vcf|raw))$ [NC]
# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d
# internally rewrite the request to the index.php script
RewriteRule .* index.php [L]
#
########## End - Joomla! core SEF Section
