osCommerce Admin with HTML rich Products & Categories

Free Modsecurity rules - Comodo Web Application Fi
#1

When making changes in Admin, to Products and Categories, a string of XSS errrors occur.
This happens if there are hex coded CR+LF, spaces and other entities, CSS and/or internal/external links. In short, a mess.
The following needed to be disabled:

212010’COMODO WAF: XSS Filter - Category 2: Event Handler Vector’
212280’COMODO WAF: Cross-site Scripting (XSS) Attack’
212640’COMODO WAF: Cross-site Scripting (XSS) Attack’
212650’COMODO WAF: Cross-site Scripting (XSS) Attack’
212660’COMODO WAF: Cross-site Scripting (XSS) Attack’
212750’COMODO WAF: XSS Attack Detected’
212800’COMODO WAF: XSS Attack Detected’
212900’COMODO WAF: IE XSS Filters - Attack Detected.’
213020’COMODO WAF: IE XSS Filters - Attack Detected.’
213070’COMODO WAF: IE XSS Filters - Attack Detected.’
213070’COMODO WAF: IE XSS Filters - Attack Detected.’

#2

We had received your feedback via cPanel, all FPs will be fixed in next update.

#3

Additional problematic rules, related to the above:
211720
211570

#4

Reply from support:

if osCommerce admin panel placed in /admin/ folder it shouldn't happen.

If ANYONE can make sense or inference from this then please enlighten me. I read it to mean that osCommerce admin panel should be installed in /admin/ folder (sic) ((it’s a subdirectory!)). Which is total rubbish.