YouTube video embeds in rich text field not saving

Question

When adding a YouTube video to a rich text field the video embed appears as expected. The entry then fails to save with no error (if I make other changes at the same time they don't save either).

Strangely, this only happens on the live server (my local MAMP setup saves the entry as expected) so I'm thinking it might be a server config thing?

I have unchecked the 'Clean up HTML' and 'Purify HTML' options for the field. It's in a Matrix field if that makes any difference.

Here's my Redactor config (added everything to allowedTags to try to figure it out):

{
  "buttons": ["html","formatting","bold","italic","unorderedlist","orderedlist","link","image","video"],
  "plugins":["fullscreen","video"],
  "toolbarFixed": true,
  "pastePlainText": true,
  "allowedTags": ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "blockquote", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "dd", "del", "dfn", "div", "dl", "dt", "em", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "map", "mark", "menu", "nav", "ol", "optgroup", "option", "p", "picture", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "small", "source", "span", "strong", "sub", "summary", "sup", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"],
  "replaceDivs": false,
  "formatting": ["p"],
  "formattingAdd": {
    "heading": {
      "title": "Heading",
      "args": ["h2", "class", "h2", "toggle"]
    },
    "subheading": {
      "title": "Subheading",
      "args": ["h3", "class", "h3", "toggle"]
    }
  }
}

@LukePearce Yeah – when I submit with the YouTube embed it hits a 403 so I think it's some kind of security/server config issue. — samlester, Jun 01 '16 at 10:34

score 4 · Accepted Answer · answered May 31 '16 at 18:55

4

My guess is you're running into one of two issues.

You're bumping into your php.ini file's max_intput_vars and/or post_max_size limitations.
Your server has something like Suhosin or mod_security installed and the content you're trying to save in the Rich Text field is triggering one of their security rules.

answered May 31 '16 at 18:55

Brad Bell

67,440
6
73
143

The test content I'm trying to submit is just a few words and then the YouTube embed so I don't think it's max_input_vars or post_max_size (these are currently set to 1000 and 24M which seems ok). – samlester Jun 01 '16 at 10:45
The logs do show a 403 so I'm going to investigate the security stuff further. – samlester Jun 01 '16 at 10:47
Turns out it was a mod_security issue – thanks for your help! – samlester Jun 01 '16 at 12:47
mod_security strikes again! – Brad Bell Jun 02 '16 at 05:25
Is there any way to allow inserting iframe's into rich text fields without disabling HTML purifier? I want Youtubes, but don't want to compromise security. – certainlyakey Nov 19 '16 at 17:29

YouTube video embeds in rich text field not saving

1 Answers1