HTML/JS stripped from templates

Question

I'm trying to update template code on a EE site I inherited and whenever I save the template, after making my changes, the HTML formatting gets all screwed up and the JS is completely stripped out. For example, almost all of the HTML carrots are turned into:

< and >

And the JS is just:

[removed]

Even if I don't make any changes to the code and just save the template in the inline editor this happens - new to EE and trying to figure out what's causing this. EE version 2.2.1, Wygwam 2.3.2... no other obvious add-ons that might cause issues to me. I found the protect_js config option and set it to 'y' (wasn't previously included) but it doesn't seem to make a difference. If I inspect the actual editor element I see a bunch of classes for markItUp - is that normal?

Answer 1

This sounds very similar to another post, Characters are being re-encoded in control panel.

Check in your system/expressionengine/config/config.php file. Do you have $config['global_xss_filtering'] set to TRUE?

It should look like this in your config file:

/*
|--------------------------------------------------------------------------
| Global XSS Filtering
|--------------------------------------------------------------------------
|
| Determines whether the XSS filter is always active when GET, POST or
| COOKIE data is encountered
|
*/
$config['global_xss_filtering'] = FALSE;

Answer 2

From the source shot, it looks like MarkItUp may be the issue, trying to turn the template editor into a wysiwyg

Answer 3

You mention Wygwam which means an entry, not a template... can you confirm exactly where you are seeing this behavior?

If you're doing this via the Control Panel - then can you try making those template updates via FTP? I suspect that there is some server thing, similar to mod_security (or mod_security itself, though that is usually has different symptoms).

If you can make your template updates via FTP, then look at form submissions and server security for sure. You'll need to save templates as files before you can try this.