#6987 – Scripts by frontend editors result into Forbidden Access

 Hey there,

Frontend editor trying to embed a javscript file with script tags result into a Forbidden Access error for them.

Turns out this is due to sh404sef security features being enabled.

This only happens for lower-ACL users. Me as an administrator can add scripts from the frontend just fine, but authors or editors can't.

Is there any way around this?

Thanks!

Thanks for the speedy reply!

Weird. Turning off "Activate security functions" in sh404sef Security makes the problem go away. Re-activating that option make that problem return.

Also, when this "Forbidden Access" is triggered, this is logged in the sh404sef security logs:

2020-03-06 19:28:43 <script> tag in POST 2.35.148.121 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 POST /index.php?option=com_content&Itemid=171&a_id=2660&lang=en

These are my settings:

Nope, that doesn't fix it.

However, if I turn off the setting "Check also forms data (POST)", the issue goes away. So setting that to "No" addresses the issue.

However, I don't know if disabling that exposes the site to some other possible attack. ?

I already pasted that line above, maybe you missed it:

Tthis is what's logged in the sh404sef security logs when that happens:

2020-03-06 19:28:43 <script> tag in POST 2.35.148.121 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 POST /index.php?option=com_content&Itemid=171&a_id=2660&lang=en

Alright cool, thanks :)

Does disabling that pose any other possible security risk?

Ok, thanks :)

Maybe good to add in the documentation that if this option is enabled, it won't be possible to submit javascript tags in the article.