Hi Ad,
Thank you for sending the new logs, they were exactly what I needed.
The first fix solved the block editor's REST save. But when an editing screen has classic meta boxes, as Modern Events Calendar does, the block editor sends a second request to save them. The firewall was still checking the post content in that second request, found the image tag, blocked the save and added your IP to the dynamic blacklist. That is why you were still getting blocked.
Instead of patching one more screen, I've changed how the firewall treats trusted users. The XSS filter is no longer applied to content sent from your own site by users who are allowed to publish unfiltered HTML in WordPress (administrators and editors). That covers the block editor, meta boxes, the classic editor and custom field plugins. WordPress already lets these users publish any HTML, so filtering it only caused false positives. You're still protected in these cases:
- Requests coming from other websites are filtered as before.
- URL parameters are always filtered.
- The SQL injection, LFI and the rest of the filters are always applied.
- The new "Do not apply the XSS filter to trusted users" option in Firewall Configuration > Exceptions > XSS turns this behaviour off if you prefer the strict mode. It's enabled by default.
This update also includes:
- Field exceptions. If a legitimate field is ever blocked again, select the entry in the Firewall Logs and click "Add field exception". That filter will stop applying to that single field of that URL for users who can edit content, so you won't have to wait for a new release. You can review these exceptions in Firewall Configuration > Exceptions > Fields.
- URL exceptions fixed. Exception lists with more than one comma-separated value never matched any URL. They now work, and each value is compared with the beginning of the URL path, so please review them if you have any.
The version number is still 2.4.3, so please download and install the zipped file again.
If anything is still blocked after updating, please send me the Firewall Logs export again and I'll look at it right away.
Thanks again for your patience and for reporting this in such detail.
Regards,
Jose
