<p>I contacted the host and they found that it was mod_security, and disabled the rule that was causing this.</p>

CC BY-SA 3.0
2016-05-17T17:18:50.287Z
2016-05-17T17:18:50.287Z
user5149
<p>There are a couple possible explanations for this.</p>

<ol>
<li><p>You have Suhosin installed, a PHP extension that enhances security by placing some pretty drastic restrictions on what data can be sent to the server. To find out, visit /admin/utils/phpinfo and search the page for "suhosin". If you see any references to it, you have it installed. Ask your host to uninstall it, or possibly just configure it to be allow this specific use case (and expect to have similar requests in the future).</p></li>
<li><p>Your server (Apache or nginx) may be configured to deny traffic to the request URI. Check your server logs for recent forbidden/403 activity.</p></li>
</ol>

CC BY-SA 3.0
2016-05-17T15:39:50.987Z
Hi Brandon. I can't find a reference to "suhosin" on that list. I'll ask my host if it's installed to double-check.
user5149
CC BY-SA 3.0
2016-05-17T15:50:20.887Z
@user5149 Could also be your server config. Just updated my answer.
Brandon Kelly
CC BY-SA 3.0
2016-05-17T16:13:41.090Z
I'm confused about what you mean because the URI is the same whether it fails or succeeds, so I have various entries with the same URI, but when it fails, it gives a 403.

"POST /admin/entries/videos/221-interviews HTTP/1.1" 403
"POST /admin/entries/videos/221-interviews HTTP/1.1" 302
"GET /admin/entries/videos/221-interviews HTTP/1.1" 200
user5149
CC BY-SA 3.0
2016-05-17T16:23:33.253Z
@user5149 Talk to your host. They should be able to offer more insight. This is occurring before the request ever makes it to Craft; otherwise you would have more information than just the word "Forbidden".
Brandon Kelly
CC BY-SA 3.0
2016-05-17T17:02:06.433Z
@user5149 mod_security is another extension that causes behavior like this.
Brad Bell
CC BY-SA 3.0
2016-05-17T15:33:47.163Z
2016-05-17T15:50:06.807Z
2016-05-17T15:50:06.807Z
Brandon Kelly
<p>I have a matrix field which the user can paste YouTube etc. embed code into, which is working fine with YouTube, but SoundCloud embed code causes it to return a page which simply says "Forbidden".</p>

<p>I've tried every combination of plain text, rich text, purify &amp; clean HTML etc.</p>

<p>Trial and error has shown the problematic part of the embed to be this:</p>

<pre><code>width="100%" height="166"  
</code></pre>

<p>However I can't seem to pin down which part of this is actually the problem.</p>

<p>I tried a few variations to try to see what's going on...</p>

<p>The following fragments are saved fine:</p>

<pre><code>%" h  
w="100%" h  
w="100%" h=  
w="100%" h="  
"100%" h  
100% 166  
width="100%"  
width="100" height="166"  
width=100% height=166  
</code></pre>

<p>The following are not saved and return Forbidden:  </p>

<pre><code>width="100%" height="166"  
w="100%" h="166"  
w="100%" h="1  
100%" h="1  
"100%" "166"  
width="1%" height="1"  
</code></pre>

<p>I've tried pasting the same SoundCloud embed into various other fields across the site, it's fine everywhere else.</p>

<p>Curious!</p>

<matrix>
"Forbidden" response when saving entry with HTML code in matrix field
# "Forbidden" response when saving entry with HTML code in matrix field

(Asked by: username_0 on 2016-05-17)

I have a matrix field which the user can paste YouTube etc. embed code into, which is working fine with YouTube, but SoundCloud embed code causes it to return a page which simply says "Forbidden".
I've tried every combination of plain text, rich text, purify & clean HTML etc.
Trial and error has shown the problematic part of the embed to be this:
width="100%" height="166"  

However I can't seem to pin down which part of this is actually the problem.
I tried a few variations to try to see what's going on...
The following fragments are saved fine:
%" h  
w="100%" h  
w="100%" h=  
w="100%" h="  
"100%" h  
100% 166  
width="100%"  
width="100" height="166"  
width=100% height=166  

The following are not saved and return Forbidden:  
width="100%" height="166"  
w="100%" h="166"  
w="100%" h="1  
100%" h="1  
"100%" "166"  
width="1%" height="1"  

I've tried pasting the same SoundCloud embed into various other fields across the site, it's fine everywhere else.
Curious!

**Tags:** matrix


---

## 2 answers

### Answer by username_1 on 2016-05-17. Score: 4 | Accepted answer

There are a couple possible explanations for this.

1. You have Suhosin installed, a PHP extension that enhances security by placing some pretty drastic restrictions on what data can be sent to the server. To find out, visit /admin/utils/phpinfo and search the page for "suhosin". If you see any references to it, you have it installed. Ask your host to uninstall it, or possibly just configure it to be allow this specific use case (and expect to have similar requests in the future).
2. Your server (Apache or nginx) may be configured to deny traffic to the request URI. Check your server logs for recent forbidden/403 activity.

> **Comments:**
> **username_0**: Hi Brandon. I can't find a reference to "suhosin" on that list. I'll ask my host if it's installed to double-check.  
> **username_1**: @username_0 Could also be your server config. Just updated my answer.  
> **username_0**: I'm confused about what you mean because the URI is the same whether it fails or succeeds, so I have various entries with the same URI, but when it fails, it gives a 403.  "POST /admin/entries/videos/221-interviews HTTP/1.1" 403 "POST /admin/entries/videos/221-interviews HTTP/1.1" 302 "GET /admin/entries/videos/221-interviews HTTP/1.1" 200  
> **username_1**: @username_0 Talk to your host. They should be able to offer more insight. This is occurring before the request ever makes it to Craft; otherwise you would have more information than just the word "Forbidden".  
> **username_2**: @username_0 mod_security is another extension that causes behavior like this.  

---

### Answer by username_0 on 2016-05-17. Score: 4

I contacted the host and they found that it was mod\_security, and disabled the rule that was causing this.


---

