• Resolved Josh Visick

    (@jvisick77)


    We have Wordfence setup on a site that heavily utilizes ACF flexible content fields for page layout. One thing that ACF does is use an ajax request to keep track of the state of content blocks being expanded or collapsed in the editor. We have had the firewall setup in learning mode and it does send a popup every time ACF sends an ajax request that we then set to whitelist. We can see the list of whitelisted actions in the dashboard. The problem is that each content block has a unique parameter and it seems as if it will only whitelist each specific iteration and not the general pattern. When we turn on the firewall any field that hasn’t been touched yet will trigger the whitelist popup box. We are trying to figure out how we can create a more general whitelist rule either by using a regex query or some other approach. What are our options for something like this?

    This is what the parameters logged look like:

    request.body[acf][field_580961289ffcd][row-1][field_580961529ffce]
    request.body[acf][field_580961289ffcd][row-2][field_580961529ffce]
    request.body[acf][field_580961289ffcd][row-3][field_58096421d49e9][row-2][field_5809705868a5f]
    etc…

    Is there a way to whitelist any requests that has [acf] starting in the body?

    Thank you for your help!
    Josh

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support WFAdam

    (@wfadam)

    Hello @jvisick77 and thanks for reaching out to us!

    You could try to whitelist:
    URL – /wp-admin/admin-ajax.php
    Param – request.body[acf]

    Not sure if this would work but the use of wildcards in the params isn’t a current feature.

    My best advice would be to run Learning Mode for a little while until all the actions are Learned.

    Let me know what you find!

    Thanks!

    Thread Starter Josh Visick

    (@jvisick77)

    Thanks for the response @wfadam

    I did try that whitelist rule and unfortunately it doesn’t work.

    It sounds like there is no option for wildcards in the params then.

    We have had learning mode going for a while and it continues to pick up every variation but I don’t believe it can tell that we want all ACF related calls to be ok. As soon as we turn off learning mode it will flag a new request on a page setting that hasn’t been touched.

    Unless you have any other suggestions I think there is no way WF can accommodate this scenario. It would be a great feature to have wildcards in whitelist rules!

    Thank you,
    Josh

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Whitelist ACF ajax requests with regex’ is closed to new replies.