Answers.Body: <p>Wordfence uses knockout.js for data binding. I see Mosaico adds <code>data-bind</code> attribute to the HTML input which is considered prone to XSS attack by knockout and 403 error is shown by wordfence.</p>
  
  <p>I've disabled XSS in the Wordfence setting and the mailing is working correctly for now. Happy to look for answer if there is a way to avoid XSS attack in mosaico template builder?</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-20T13:48:09.570Z
Answers.LastActivityDate: 2018-03-20T13:48:09.570Z
Answers.UserDisplayName: jitendra - fuzion
Answers.Body: <p>I also had a similar problem - I solved by whitelisting the specific url using Wordfences Live traffic view (Wordfence -> tools) to locate the blocked connection and then whitelist param from firewall. </p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-19T22:04:49.010Z
Answers.LastActivityDate: 2019-08-19T22:04:49.010Z
Answers.UserDisplayName: Luke Stewart
Answers.Body: <p>I had a similar issue, but just using one of the standard sample mailing templates (not Mosaico). Disabling the XSS option in Wordfence also worked, although I'd like to keep the XSS check.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-10-07T18:10:53.513Z
Answers.Text: Just an update... I could never find the URL/param I needed to whitelist. Perhaps it's because I don't have the Wordfence Premium. Instead, I was able to turn on Learning Mode just long enough to execute a "save" in Mosaico and then return to Protected Mode. The URL/param was captured in the whitelist.
Answers.UserDisplayName: Mark Westergaard
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-26T02:09:24.667Z
Answers.LastActivityDate: 2018-05-26T02:09:24.667Z
Answers.UserDisplayName: Mark Westergaard
Body: <p>We get a 403 error by Wordfence Security on a wordpress site while creating a Mailing using Mosaico.</p>
  <p>On little investigation - I see the error is due to the addition of <code>data-bind</code> attribute in the HTML. For eg. if the template html is -</p>
  <pre><code>&lt;p style=&quot;color: #aaaaaa; font: 14px/18px Frutiger, 'Frutiger Linotype', 'Helvetica Neue', Helvetica, Arial, sans-serif; ; margin: 0 0 10px 0; padding: 0; text-align: center;&quot; data-bind=&quot;virtualAttrStyle: 'color: #AAAAAA; '+'font: '+('14px/18px '+$root.content().sansFace())+'; '+'margin: 0 0 10px 0; '+'padding: 0; '+'text-align: center;'+''&quot;&gt;
    Don't want to receive any more email from us?
    &lt;br /&gt;
    Simply 
    &lt;a style=&quot;color: #e0e0e0;&quot; 
      href=&quot;https://domain_name/wp-content/plugins/files/civicrm/extensions/uk.co.vedaconsulting.mosaico/packages/mosaico/templates/tedc15/*|UNSUB|*&quot; 
      target=&quot;_blank&quot; 
      data-bind=&quot;virtualAttrStyle: 'color: #E0E0E0;'+''&quot;&gt;
      unsubscribe
    &lt;/a&gt; from our list.
  &lt;/p&gt;
  </code></pre>
  <p>The error in the console pops up not letting the template to be saved.</p>
  <blockquote>
  <p>403 Forbidden</p>
  <p>A potentially unsafe operation has been detected in your request to this site, and has been blocked by Wordfence.</p>
  </blockquote>
  <p>If I remove the <code>data-bind</code> attribute from the anchor tag - the mailing is saved without any errors.
  Also, if the Wordfence plugin is disabled - the 403 error is not shown - but this might not be the solution.</p>
  <p>Any thoughts on why this error might be arising and ways to fix it?</p>
  
Tags: <wordpress><templates><mosaico>
Title: Mosaico returns 403 error due to data-bind attribute in template html
ThreadText: # Mosaico returns 403 error due to data-bind attribute in template html
  
  (Asked by: username_0 on 2018-03-20)
  
  We get a 403 error by Wordfence Security on a wordpress site while creating a Mailing using Mosaico.
  
  On little investigation - I see the error is due to the addition of `data-bind` attribute in the HTML. For eg. if the template html is -
  
  ```
  <p style="color: #aaaaaa; font: 14px/18px Frutiger, 'Frutiger Linotype', 'Helvetica Neue', Helvetica, Arial, sans-serif; ; margin: 0 0 10px 0; padding: 0; text-align: center;" data-bind="virtualAttrStyle: 'color: #AAAAAA; '+'font: '+('14px/18px '+$root.content().sansFace())+'; '+'margin: 0 0 10px 0; '+'padding: 0; '+'text-align: center;'+''">
    Don't want to receive any more email from us?
    <br />
    Simply 
    <a style="color: #e0e0e0;" 
      href="https://domain_name/wp-content/plugins/files/civicrm/extensions/uk.co.vedaconsulting.mosaico/packages/mosaico/templates/tedc15/*|UNSUB|*" 
      target="_blank" 
      data-bind="virtualAttrStyle: 'color: #E0E0E0;'+''">
      unsubscribe
    </a> from our list.
  </p>
  
  ```
  
  The error in the console pops up not letting the template to be saved.
  
  > 403 Forbidden
  >
  > A potentially unsafe operation has been detected in your request to this site, and has been blocked by Wordfence.
  
  If I remove the `data-bind` attribute from the anchor tag - the mailing is saved without any errors.
  Also, if the Wordfence plugin is disabled - the 403 error is not shown - but this might not be the solution.
  
  Any thoughts on why this error might be arising and ways to fix it?
  
  **Tags:** wordpress, templates, mosaico
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2018-03-20. Score: 2 | Accepted answer
  
  Wordfence uses knockout.js for data binding. I see Mosaico adds `data-bind` attribute to the HTML input which is considered prone to XSS attack by knockout and 403 error is shown by wordfence.
  
  I've disabled XSS in the Wordfence setting and the mailing is working correctly for now. Happy to look for answer if there is a way to avoid XSS attack in mosaico template builder?
  
  
  ---
  
  ### Answer by username_1 on 2019-08-19. Score: 2
  
  I also had a similar problem - I solved by whitelisting the specific url using Wordfences Live traffic view (Wordfence -> tools) to locate the blocked connection and then whitelist param from firewall.
  
  
  ---
  
  ### Answer by username_2 on 2018-05-26. Score: 0
  
  I had a similar issue, but just using one of the standard sample mailing templates (not Mosaico). Disabling the XSS option in Wordfence also worked, although I'd like to keep the XSS check.
  
  > **Comments:**
  > **username_2**: Just an update... I could never find the URL/param I needed to whitelist. Perhaps it's because I don't have the Wordfence Premium. Instead, I was able to turn on Learning Mode just long enough to execute a "save" in Mosaico and then return to Protected Mode. The URL/param was captured in the whitelist.  
  
  ---
  
  