Sign in Register
Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Patrick 16 posts 36 karma points
    Nov 25, 2009 @ 10:55
    Patrick
    0

    setting ValidateRequest in umbraco

    Hi

    I've got an ascx that needs people to be able to put in a list of email addresses.  ( eg "Jim" <[email protected]>, "Bob" <[email protected]> ) However when the user submits this form the A potentially dangerous Request.Form value was detected from the client error occurs. Usually I set ValdateRequest="false" on the aspx page, but as I'm using umbraco is there a way I can do this from the usercontrol?  I've tried this but it hasn't worked:

        protected void Page_Init(object sender, EventArgs e)
        {
            ((umbraco.UmbracoDefault)this.Page).ValidateRequest = false;
        }

     

    Copy Link
  • adrianfriend 67 posts 68 karma points
    Nov 25, 2009 @ 11:24
    adrianfriend
    0

    Just a thought - it maybe the way you are entering the data i.e. ASP.NET maybe detecting it as a XSS injection. Have you tried escaping the data before saving?

    Would be safer than turning the Validation off

    Adrian

    Copy Link
  • Patrick 16 posts 36 karma points
    Nov 25, 2009 @ 12:49
    Patrick
    0

    That is an option, I suppose by using javascript to html encode the textbox value before submitting and then decoding it server-side? However, if the user doesn't have javascript that wouldn't be possible.  Is there any other way?

    Copy Link
  • adrianfriend 67 posts 68 karma points
    Nov 25, 2009 @ 13:15
    adrianfriend
    0

    This is happening because <> in <[email protected]>

    Try using HttpUtility.HtmlEncode

    to Encode the data - basically converts the <> to &lt; and &gt;

    Hope that helps

    Copy Link
  • Patrick 16 posts 36 karma points
    Nov 25, 2009 @ 15:52
    Patrick
    0

    Hi Adrian

    Thanks for your suggestion but I'm not sure at what point I can do that.  For example imagine my front end code is as such:

    <asp:TextBox TextMode="MultiLine" runat="server" ID="recipient_list" Rows="4" cssclass="recipient_list" />
    <asp:Button runat="server" ID="btnSendEmail" OnClick="btnSendEmail_Click" Text="Send Email" />

    Then the user enters the list of email addresses and clicks submit, the exception would occur before the btnSendEmail_Click function would be called so I wouldn't have a chance to modify the text of the textbox server-side or am I missing something here?  Ideally I would like to just disable the Request validation for the page from the usercontrol or failing that disabling request validation from the template or site.

     

    Copy Link
  • Patrick 16 posts 36 karma points
    Dec 14, 2009 @ 12:07
    Patrick
    0

    Ah well. I've had to go for the nuclear option and disable request validation for the whole site in web.config. It's a shame you can't disable it at a more precise level.

    web.config:

    <pages validateRequest="false" />

    Copy Link
  • Dave Woestenborghs 3325 posts 11170 karma points MVP 5x admin c-trib
    Dec 14, 2009 @ 12:46
    Dave Woestenborghs
    2

    You can add this to your template to disable the validateRequest : 

    <umbraco:DisableRequestValidation runat="server"/>

    Or add this to the code of your usercontrol : 

     ((umbraco.UmbracoDefault)this.Page).ValidateRequest = false;

     

    Copy Link
  • Patrick 16 posts 36 karma points
    Jan 22, 2010 @ 11:42
    Patrick
    0

    Thanks for your suggestion. I've finished that project now but I'll try the validateRequest tag in the template next time I come across this issue.  The usercontrol code unfortunatly did not work.

    Copy Link

  • This forum is in read-only mode while we transition to the new forum.

    You can continue this topic on the new forum by tapping the "Continue discussion" link below.

Please Sign in or register to post replies