Answers.Body: <p>Despite getting a Tumbleweed award for this, I have submitted a fix</p>
  
  <p>See <a href="https://issues.civicrm.org/jira/browse/CRM-17030" rel="nofollow">https://issues.civicrm.org/jira/browse/CRM-17030</a>
  and <a href="https://github.com/civicrm/civicrm-core/pull/6508" rel="nofollow">https://github.com/civicrm/civicrm-core/pull/6508</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-15T15:29:09.620Z
Answers.LastActivityDate: 2015-08-15T15:29:09.620Z
Answers.UserDisplayName: Lionel Smith-Gordon
Body: <p>A long time ago, I raised an item in the old forum about an issue I was experiencing with Event Confirmation emails sent to the Email Activity Processor being rejected with this message:</p>
  
  <pre><code>Failed Processing: Registration Confirmation - [event name]. Reason: Illegal characters in input (potential scripting attack)
  </code></pre>
  
  <p>See my original posting here:  <a href="https://forum.civicrm.org/index.php?topic=29606.0" rel="nofollow">https://forum.civicrm.org/index.php?topic=29606.0</a></p>
  
  <p>I have finally diagnosed and fixed this problem.</p>
  
  <p>The common SocialNetworks.tpl template is used to load a block of HTML to add social network buttons.  This is used on web pages and in email confirmations.  It contains a call to include a Google APIs script and it is this that is causing the IDS attack alert.</p>
  
  <p>My simple resolution is to move this script inclusion from line 27 to line 45 so that it is inside an IF clause that only applies to web pages.</p>
  
  <p>Sorry - this isn't really a question, so let me make it one.  Do you agree with my diagnosis and should I apply a patch?</p>
  
Tags: <civievent><templates>
Title: Potential fix to long term issue with IDS errors on Event Confirmation emails through ActivityProcessor
ThreadText: # Potential fix to long term issue with IDS errors on Event Confirmation emails through ActivityProcessor
  
  (Asked by: username_0 on 2015-08-08)
  
  A long time ago, I raised an item in the old forum about an issue I was experiencing with Event Confirmation emails sent to the Email Activity Processor being rejected with this message:
  
  ```
  Failed Processing: Registration Confirmation - [event name]. Reason: Illegal characters in input (potential scripting attack)
  
  ```
  
  See my original posting here: <https://forum.civicrm.org/index.php?topic=29606.0>
  
  I have finally diagnosed and fixed this problem.
  
  The common SocialNetworks.tpl template is used to load a block of HTML to add social network buttons. This is used on web pages and in email confirmations. It contains a call to include a Google APIs script and it is this that is causing the IDS attack alert.
  
  My simple resolution is to move this script inclusion from line 27 to line 45 so that it is inside an IF clause that only applies to web pages.
  
  Sorry - this isn't really a question, so let me make it one. Do you agree with my diagnosis and should I apply a patch?
  
  **Tags:** civievent, templates
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2015-08-15. Score: 2
  
  Despite getting a Tumbleweed award for this, I have submitted a fix
  
  See <https://issues.civicrm.org/jira/browse/CRM-17030>
  and <https://github.com/civicrm/civicrm-core/pull/6508>
  
  
  ---
  
  