search

Automattic / jetpack

Security, performance, marketing, and design tools — Jetpack is made by WordPress experts to make WP sites safer and faster, and help you grow your traffic.
https://jetpack.com/
Other
1.59k stars 799 forks source link

Slideshow Breaks When Bad Characters are Blocked via .htaccess #13249

Open jjbte opened 5 years ago

jjbte commented 5 years ago

Steps to reproduce the issue

  1. Install and activate Jetpack and All In One WP Security & Firewall plugins.
  2. In the WP Security plugin, under Firewall > Additional Firewall Rules, enable the Advanced Character String Filter.
  3. In the WP Security plugin, under Firewall > 6G Blacklist Firewall Rules enable the 6G Firewall Protection.
  4. Go to any post or page and add a Jetpack Slideshow block. Create and add a gallery to the block.

What I expected

A slideshow to appear, both in the block editor and on the front end.

What happened instead

In the editor, an error message appears: "The Swiper library could not be loaded."

On the front end, the slideshow images appear in a vertical stack, with slideshow navigation buttons side by side at the bottom of the stack.

Additional Information

F12 Developer Tools revealed the following console errors: Failed to load resource: the server responded with a status of 403 () for plugins/jetpack/_inc/blocks/vendors~swiper.cf8591a6825782c29597.js

Failed to load resource: the server responded with a status of 403 () for plugins/jetpack/_inc/blocks/vendors~swiper.cf8591a6825782c29597.css

The swiper library files have filenames containing the ~ character, which is blocked by the aforementioned WP Security filters/firewall settings. Disabling these filters (or modifying them to eliminate references to the ~ character) allows the slideshow to work as expected. However, it would be better if the swiper library filenames were modified to eliminate the ~ character.

See WordPress forum discussions of this issue here and here.

stale[bot] commented 4 years ago

This issue has been marked as stale. This happened because:

No further action is needed. But it's worth checking if this ticket has clear reproduction steps and it is still reproducible. Feel free to close this issue if you think it's not valid anymore — if you do, please add a brief explanation.