[SOLVED] 403 error if textarea has iframe tag

[PWaddict]

If I add html code (iframe) from Google Maps in a textarea field and try to save the page I will get a 403 error and the page will not get saved. Once I disabled Mod Security from cPanel and waited few minutes then I could save the iframe on pages without problems. Is there another way to solve this without disabling Mod Security?

[Zeka]

Do you have the same issue? 

https://stackoverflow.com/questions/22964411/google-tag-manager-include-that-passes-mod-security-rules-in-apache

[adrian]

How about using this instead: http://modules.processwire.com/modules/textformatter-google-maps/

Much better than pasting in iframe code into an RTE ?

[PWaddict]

29 minutes ago, Zeka said:

Do you have the same issue? 

https://stackoverflow.com/questions/22964411/google-tag-manager-include-that-passes-mod-security-rules-in-apache

I don't know cause I'm using the analytics.js. Btw I tested a youtube iframe embed code and still same problem. I've even tested adding just this: <iframe> and still same problem. ModSecurity doesn't like the iframe tag when you post a form.

[PWaddict]

14 minutes ago, adrian said:

How about using this instead: http://modules.processwire.com/modules/textformatter-google-maps/

Much better than pasting in iframe code into an RTE ?

I've tested this and It isn't accurate at all. For a proper map with 100% accurate results and without an API key the embed one is the ONLY option.

[adrian]

7 minutes ago, PWaddict said:

I've tested this and It isn't accurate at all. For a proper map with 100% accurate results and without an API key the embed one is the ONLY option.

That module converts the url to an iframe link: https://github.com/teppokoivula/TextformatterGoogleMaps/blob/master/TextformatterGoogleMaps.module#L77

Do you think you could modify that line to change it to the parameters you need?

[PWaddict]

15 minutes ago, adrian said:

That module converts the url to an iframe link: https://github.com/teppokoivula/TextformatterGoogleMaps/blob/master/TextformatterGoogleMaps.module#L77

Do you think you could modify that line to change it to the parameters you need?

It isn't possible cause the map url & iframe link has some encoded values such as the unique place id which isn't possible to get without an API key.

[adrian]

Does modsec baulk at [iframe] ? 

If it works you could write a simple textformatter that translates that to <iframe>

[PWaddict]

28 minutes ago, adrian said:

Does modsec baulk at [iframe] ? 

If it works you could write a simple textformatter that translates that to <iframe>

Yes it works. Btw I've just entered the <iframe> tag on another textarea and it gets saved! I will check tomorrow why is this happening.

[PWaddict]

The hosting company excluded the rule #340147 from ModSecurity and the problem is gone.