2

I have a matrix field which the user can paste YouTube etc. embed code into, which is working fine with YouTube, but SoundCloud embed code causes it to return a page which simply says "Forbidden".

I've tried every combination of plain text, rich text, purify & clean HTML etc.

Trial and error has shown the problematic part of the embed to be this:

width="100%" height="166"

However I can't seem to pin down which part of this is actually the problem.

I tried a few variations to try to see what's going on...

The following fragments are saved fine:

%" h  
w="100%" h  
w="100%" h=  
w="100%" h="  
"100%" h  
100% 166  
width="100%"  
width="100" height="166"  
width=100% height=166

The following are not saved and return Forbidden: 

width="100%" height="166"  
w="100%" h="166"  
w="100%" h="1  
100%" h="1  
"100%" "166"  
width="1%" height="1"

I've tried pasting the same SoundCloud embed into various other fields across the site, it's fine everywhere else.

Curious!

Improve this question

2 Answers 2

Reset to default
4

There are a couple possible explanations for this.

  1. You have Suhosin installed, a PHP extension that enhances security by placing some pretty drastic restrictions on what data can be sent to the server. To find out, visit /admin/utils/phpinfo and search the page for "suhosin". If you see any references to it, you have it installed. Ask your host to uninstall it, or possibly just configure it to be allow this specific use case (and expect to have similar requests in the future).

  2. Your server (Apache or nginx) may be configured to deny traffic to the request URI. Check your server logs for recent forbidden/403 activity.

Improve this answer
5
  • Hi Brandon. I can't find a reference to "suhosin" on that list. I'll ask my host if it's installed to double-check.
    – user5149
    Commented May 17, 2016 at 15:39
  • @user5149 Could also be your server config. Just updated my answer.
    – Brandon Kelly
    Commented May 17, 2016 at 15:50
  • I'm confused about what you mean because the URI is the same whether it fails or succeeds, so I have various entries with the same URI, but when it fails, it gives a 403. "POST /admin/entries/videos/221-interviews HTTP/1.1" 403 "POST /admin/entries/videos/221-interviews HTTP/1.1" 302 "GET /admin/entries/videos/221-interviews HTTP/1.1" 200
    – user5149
    Commented May 17, 2016 at 16:13
  • 1
    @user5149 Talk to your host. They should be able to offer more insight. This is occurring before the request ever makes it to Craft; otherwise you would have more information than just the word "Forbidden".
    – Brandon Kelly
    Commented May 17, 2016 at 16:23
  • 2
    @user5149 mod_security is another extension that causes behavior like this.
    – Brad Bell ♦
    Commented May 17, 2016 at 17:02
4

I contacted the host and they found that it was mod_security, and disabled the rule that was causing this.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.