Hi JoomShaper Team,After updating Helix Ultimate to version 2.2.9 on Joomla 5, entering custom JavaScript inside Template Options $\rightarrow$ Custom Code (Before </head> or Before </body>) automatically inserts a hyphen into the JavaScript opening tag upon saving (converting s c r i p t to s - c r i p t).
This prevents the JavaScript from executing on the front end and renders raw text output on the page. Please advise if a hotfix will be issued for the framework sanitizer.Thanks!
@Selwynn @Justion In 99% cases it's caused by default RSFirewall settings. We even have info inside our documenation, as well as RSJoomla.
RSFirewall changes two popular tags to <i-frame> and <s-cript> to block code injections. To stop this, add your IP to the safelist in settings, create an exception for the specific component, or adjust the active scanner settings. That's all.
Hi there,
Thank you for reaching out, and I apologize for any inconvenience caused by this oversight. I have checked it my local environment and it works fine.
Best regards,
Toufiqur Rahman (Team Lead, Support)
Hi Toufiq,
Thank you for testing this so quickly! The issue seems to occur specifically on live server environments where active security filters like the one am currently using, RSFirewall inspect POST requests. When saving through Template Options -> Custom Code, those security layers intercept the raw script tags and sanitize them to s-cript before saving to the database.
I am using Stratos templete, if this helps.
In this case you need to contact your RSFirewall support. Ask them how to bypass it. Thanks
@Selwynn, did you sort this out? I'm running into the same issue ... even after uninstalling RSFirewall I'm still running into a glitch where template settings are lost, including custom code.
Thanks Paul,
I believe disabling 'Enable Active Scanner in the /administrator section' in the Active Scanner tab of the Firewall Configuration does indeed solve the issue.
Mark topic as solved. You're welcome.
