2

I have a site I'm troubleshooting at the moment where articles won't save via the front end and return a 403 error when you either Save or Cancel editing.

After whittling down potential causes, this morning I've gone and cut and pasted code in the article until it broke... which happened when it got to <!-- container-fluid --> HTML comment. This is automatically inserted by JCE to indicate the end of a container, and HTML comments should usually be inoccuous.

Removing the HTML comments resolves the issue temporarily, but then when I go to edit the page again, when it switches on in Editor view, the HTML comments are added in automatically again, and the 403 returns.

Looking for thoughts on:

  • Disabling the insertion of the html comments
  • Adjusting the setting in Joomla that is causing 403 protection

Site has Joomla 4.2.3, latest JCE, Admintools, SP Page Builder and more.

Improve this question
4
  • Have you played with your .htaccess to see if any of the rules in there are being tripped up by the string you say is causing the issue? If you have access I would be looking in the log of your firewall or server security modules to see if they are flagging the string. If you look at that string in raw form are there any hidden control characters lurking in the background? Does altering the naughty string change the response? Does the string save in the same Article in the back end?
    – Irata ♦
    Commented Sep 30, 2022 at 0:25
  • Going through your suggests, none of it makes any difference. Site is with Ventra so logging a ticket. Vanilla Joomla .htaccess vs Admin Tools .htaccess; Nothing in the response via developer tools shows anything that can be wrong. Only thing that is different is whether or not there's html comments.
    – Patrick Jackson
    Commented Oct 3, 2022 at 5:08
  • What if you remove the 'container-fluid' and replace it with nothing or 'fred', does it still break? I recently worked on a problem with our friend NS, where a benign piece of text in an outgoing email was triggering security rules and this smells similar. You might need to narrow it down further to what is in the comment, is it the first/only comment, what is the text before and after the comment. Can you replace it with &gt; and &lt; ?
    – Irata ♦
    Commented Oct 3, 2022 at 7:28
  • 1
    Turns out Ventra have Mod Security logs you can see via VIP Control, and then Mod Security logs that you can only see at the WHM and/or server CLI level. In this case, turns out it was a log in the second category that identified which Mod Security rule was causing the issue, and they were then able to isolate it for the account fixing the issue. I think I'm just spoilt in having had dedicated servers for most of my own hosting requirements :D
    – Patrick Jackson
    Commented Oct 3, 2022 at 11:13

1 Answer 1

Reset to default
3

After contacting the hosting company, they were further able to look deeper on their server logs and identified that there was a Mod Security rule that was firing which was blocking the processing of the response when there was a HTML comment in the content.

They were able to then isolate the rule and resolve the issue.

Improve this answer
2
  • What was the actual string causing the rule to be triggered?
    – Irata ♦
    Commented Oct 3, 2022 at 22:47
  • Of course Ventra won’t fix this globally. They’ll just wait for each customer to encounter the problem (& not for the first time).
    – Moilleadóir
    Commented Oct 14, 2022 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.