TinyMCE: editing href which includes any url params results in 403 overlay

[gwinkler]

Hi,

I'm working on a website and have a textarea field which uses TinyMCE.

Now, I have the following problem:
If I add a link via the UI which leads to some Google Docs document (which my client did), e.g. https://drive.google.com/open?id=SOME_ID&usp=drive_copy, I can create the link and it works fine, but if I want to edit it again via clicking on it in the editor, a modal opens with a 403 error. The link, which leads to the 403, is: https://DOMAIN/admin/page/link/?modal=1&id=1042&href=https%3A%2F%2Fdrive.google.com%2Fopen%3Fid%3DSOME_ID-%26usp%3Ddrive_copy&text=TITLE

I investigated the problem so far that apparently all urls are blocked which include encoded url params (such as "open" and "id" in my case).

I am not sure if this is a problem of my web server or of the .htaccess from Processwire.

I would really appreciate it if someone knows something about this issue or could at least try to reproduce it!

Edited August 17, 2024 by gwinkler

[BitPoet]

Most likely an issue with the webserver. Apache's mod_security blocks encoded urls in GET parameters by default, so I'd start looking there.

[gwinkler]

Thanks for your assessment, I will contact my hosting provider and ask them for help. If this then still seems to be related to Processwire, I'll come back to this thread.

[bernhard]

I think this is what you are seeing: https://github.com/processwire/processwire-issues/issues/1952

[gwinkler]

Oh thanks a lot, that sounds quite like my problem! I'll check what my hoster says about the Apache version used.