CiviCRM Community Forums (archive)

This is seems to be related to edit only certain system messages.

The way IDS is written there are certain entire paths that are automatically skipped.
      static $skip = array( 'civicrm/ajax', 'civicrm/admin/setting/updateConfigBackend', 'civicrm/admin/messageTemplates' );

one of those is 'civicrm/admin/messageTemplates'

When a system message template is edited the path is 'civicrm/admin/messageTemplates/add'
For most templates when a template is saved the target path is 'civicrm/admin/messageTemplates' (ie. pledge acknowlegement message)

This causes all IDS processing to be skipped for the template.

However when you edit the offline reciept message. The target path on save is:
'civicrm/admin/messageTemplates/add'

As a result the message is not skipped and the subsequent filters do nothing (msg_text which appears to be the offending field) in not excepted from the check.

Since the path check uses, in_array I assume it is and exact match. As a work around I will try adding 'civicrm/admin/messageTemplates/add' as a bypass.

However this does not explain the root issue of different templates having different target paths.

FYI - this fix (adding msg_text to the exceptions list in IDS.php) was committed and part of 3.2.2.

hmm

pretty sure the exception stuff is working

if i had to guess, your Config.IDS.ini did not regenerate and it was using an old cached version.

lobo

not sure since most of us dont have or use IE. You should download and check if it is fixed. If not, please consider investigating and submitting a patch

thanx

lobo

I was getting this error, and I don't use any WYSIWYG.  After an upgrade to 3.2.2 from 3.2.1, I deleted ConfigIDS.ini and let CiviCRM rebuild it.  Then the error went away.  Just FYI.

joemaine ,

CkEditor in CiviCRM somehow strips out the closing ">" from any code entered in the content

hey  joemaine, can  just apply the below patch , should solve your above problem.
 
Index: branches/v3.2/packages/HTML/QuickForm.php
===================================================================
diff -u -N -r29285 -r29759
--- branches/v3.2/packages/HTML/QuickForm.php (.../QuickForm.php) (revision 29285)
+++ branches/v3.2/packages/HTML/QuickForm.php (.../QuickForm.php) (revision 29759)
@@ -1989,7 +1989,7 @@
                 
                 // hack to fix extra <br /> injected by CKEDITOR, we should remove this code
                 // once the bug is fixed and is part of release https://dev.fckeditor.net/ticket/5293
-                if ( is_a( $this->_elements[$key], 'HTML_QuickForm_CKeditor' ) ) {
+                if ( is_a( $this->_elements[$key], 'HTML_QuickForm_CKeditor' ) && $value[$fldName] == '<br />' ) {
                     $value[$fldName] = rtrim( CRM_Utils_Array::value( $fldName, $value ), '<br />');
                 }
                 
or

https://fisheye2.atlassian.com/viewrep/CiviCRM/branches/v3.2/packages/HTML/QuickForm.php?r1=29285&r2=29759

Hth

Regards,
Rahul.

Ok, it is two years since this issue was discussed here at least.  I am using CiviCRM 4.2.2 on Wordpress 3.4.2.  I have created a custom "Note" field which when I set to use RichTextEditor, I get the following error if I do any HTML formating in the field:

{"IP":"xxx.xxx.x.xxx","error_code":"IDS_KICK","level":"security","referer":"http:\/\/www.mysite.org\/wp-admin\/admin.php?page=CiviCRM&q=civicrm\/contact\/view\/cd\/edit&tableId=637&cid=637&groupID=8&action=update&reset=1","reason":"XSS suspected","is_error":1,"error_message":"There is a validation error with your HTML input. Your activity is a bit suspicious, hence aborting"}

However, when I set this to "TextArea" everything works fine.  I have another Note field on the same form, also using RichTextEditor, yet that field does not throw an error.
ps:  I first noticed this using CiviCRM 4.2.1 and thought it would resolve with the next update, but I have now updated to 4.2.2 and issue persists.