I have always been able to turn off request validation on IIS and cassini when I need to post HTML from an HTML Editor. Problem is I can't seem to do so on IIS express. Have tried the following:
<%@ Page Language="C#" ValidateRequest="false"
<system.web>
<pages validateRequest="false">
I have a wizard style MVC 2.0 application, when I move forward I want client side validation to kick in and validate the form, but when I hit the back button I want the data entered by the user posted back to the server so I can save what they have entered, but without any client validation.
View 4 RepliesRecently I was looking at a set of 3rd party controls. One of these controls turned the background of a textbox red when a required field validation failed and then turned the background back to its original color when validation succeeded.I would like to add similar functionality to when using the asp.net 2.0 controls, but I have no idea how this was accomplished.
View 2 Repliesi have a view model with a property like this one :
[RegularExpression(@"^d+$", ErrorMessageResourceType = typeof(Resources.Validation), ErrorMessageResourceName = "NumberValidationMsg" )]
public int? Number {get; set;}
NumberValidationMsg resource is set to "Only numbers allowed !".
but when I try to enter something like 'test' into Number field on form, ModelState displays the ErrorMessage with content similar to :
"The value 'test' is not valid for Number."
can this message be turned off, customized? (or maybe the best solution would be just to replace int? with string)
I've got an ASP.NET 4 site on which I want to allow people to put '<' in their password. However, .NET gets in the way by blocking (what it sees as) an attempt to put HTML in a form field. I know I can turn off input validation entirely, but I only want to turn it off for this one field. Does anyone know an easy way to do that?
View 2 RepliesI have some code where I need two separate required field validators for one control, both in separate validation groups which are then validated by two separate buttons.This approach works well when the buttons are clicked but both validators show if I enter a value in the textbox and then remove it.
Is there a way to turn this"lost focus" validation off? I only need it to validate when the buttons are clicked.
EDIT,Unfortunately, if I set EnableClientScript=false then I dont have any client notifications. What I want is for the dynamic error message to show (effectivly in the OnClientClick event of the button) but not the "lost focus" of the textbox.Is there some way I can disable or "unhook" the lostfocus client event?
EDIT,A combination dDejan's answer and womp's answeer here sorted the problem perfectly.
My final code looks like this (for anyone else with a similar situation)...
Javascript...
<script type="text/javascript">
$(document).ready(function() { [code]....
So, now there is no validation until a user clicks either the "Get Email Confirmation Code" button or the "Register" button. If they click the "Get Email Confirmation Code" button all of the controls validate apart from the textbox where the user is to input the email validation code and we only see one validator message.
If they click the "Register" Button then all of the controls validate and we only see one validation message.If either button is pressed, the user goes back, adds and then removes some text then we only see one validator. Before this change you used to see both messages saying the same thing.
Is there a way to disable request validation on an action without having to add the line <httpRuntime requestValidationMode="2.0"/> to Web.config? I'm currently posting XML to a controller action and get the "A potentially dangerous Request.Form value..." error. Is disabling request validation the only way to get the post to work, or is there some way I can intercept and encode the value that contains XML between the view and the controller action?
View 1 Replieshow can i validate a textbox with 5 number only are allow to fill in and first number must number 3. For example like 3XXXX,3YYYY (X and Y are number).
View 2 RepliesI have a GridView and I need update some data inserting HTML CODE; I would need this data been stored encoded and decoded on request.
I cannot in any way disable globally "Request Validation" and not even at Page Level, so I would need a solution to disable "Request Validation" at Control Level.
At the moment I am using a script which should Html.Encode every value being update, butt seems that "Request Validation" start its job before event RowUpdating, so I get the Error "Page A potentially dangerous Request.Form ... ".
void GridView1_RowUpdating(object sender, GridViewUpdateEventArgs e)
{
foreach (DictionaryEntry entry in e.NewValues)
{
e.NewValues[entry.Key] = Server.HtmlEncode(entry.Value.ToString());
}
PS I USE Wweb Controls not MVC
When I fire a get request to a view in my application for some reason my model validation messages are displaying immediately on the page even before a form submit.
View 5 RepliesI read that I need to turn the validation to version of 2.0 to make the validateRequest="false" attribute working. Well, but how to allow requests containing html in 4.0? How can I keep the 4.0 validation scheme and allow such request to come in, say for particular web page?
I don't understand why I should lower the security of other requests like web services . So what's the 4.0 way of doing that, really?
I created a little web service to minify JavaScript, and everything was nice, with all my tests passing. Then I noticed a bug: if I tried to minify alert('<script>');, it would throw a HttpRequestValidationException.
So that's easy enough to fix. I'll just add [AllowHtml] to my controller. But what would be a good way to unit test that this doesn't happen in the future?
The following was my first thought:
[TestMethod]
public void Minify_DoesntChokeOnHtml()
{
try
{
using (var controller = ServiceLocator.Current.GetInstance<MinifyController>())
{
return controller.Minify("alert('<script></script>');");
}
}
catch (HttpRequestValidationException)
{
Assert.Fail("Request validation prevented HTML from existing inside the JavaScript.");
}
}
However, this doesn't work since I am just getting a controller instance and running methods on it, instead of firing up the whole ASP.NET pipeline.
What would be a good unit test for this? Maybe reflector on the controller method to see if the [AllowHtml] attribute is present? That seems very structural, and unlikely to survive a refactoring; something functional might make more sense.
When a user presses Button1 on the Webpage, I would like to copy slightly modified string from txt1 (Text) into txt2 (Text).
The problem is sometimes I get an error "a potentially dangerous request.form value was detected from the client validaterequest". I get this error when special symbols llike "<" or ">" are in txt1.Text.I've read about that problem. That error is to prevent from hackers who can input scripts into the txt1.All I did is:
1) Put validateRequest="false" into <%@ Page Language="VB" validateRequest="false" at Default.aspx.
2) Default.aspx.vb contains now:
sHTMLEncodedString = Server.HtmlEncode(txt1.Text))
[code]....
Now it works and allows to take any data from txt1, slightly modify it and put into txt2.So, my question is: Did a level of security was reduced after I wrote validateRequest="false" ? Any code should be added to keep the good level of security? Or, I'd better use another way to copy txt1 to txt2?
I have a form that I have been getting submissions that have punctuation and special characters that trigger the potentially dangerous Request.Form value error. I have been trying use the httpUtility.htmlencode and Server.htmlencode method to sanitize textboxes and textareas.All my tests do not fire because the built-in request validation of the 4.0 framework prevents the code-behind from executing to perform the sanitization. I have included the ValidateRequest in the page header but no matter what I set it too it still does the same thing.
This is the code I have so far.
Session("RequestID") = Server.HtmlEncode(txtRequestID.Value)
Session("FirstName") = Server.HtmlEncode(txtInstFirstName.Text)
Session("LastName") = Server.HtmlEncode(txtInstLastName.Text) [code]....
What can I do to make this work? According to all the websites I have visited it should work.
I have a username textbox on a form, that has a few validation rules applied to it via the DataAnnotation attributes:
[Required(ErrorMessage = "FTP login is required")]
[StringLength(15, ErrorMessage = "Must be 15 characters or fewer")]
[RegularExpression(@"[a-zA-Z0-9]*", ErrorMessage = "Alpha-numeric characters only")]
public string FtpLogin { get; set; }
I also have a button next to this text box, that fires off a jQuery ajax request that checks for the existence of the username as follows:
<button onclick="check(this);return false;" id="FtpLoginCheck" name="FtpLoginCheck">Available?</button>
I'm looking for a way of tieing the two together, so that the client-side validation is performed before the call to the "check(this)" in the onclick event.
Edit: To be more clear, I need a way to inspect or trigger the client-side validation result of the textbox, when I click the unrelated button beside it.
Edit: I now have the button JS checking for $("form").validate().invalid, but not displaying the usual validation messages.
I know the question has been submitted previously. I am a newbie to those tools. If I access to the database by way of management studio both under the windows integrated authentication and sqlserver authentication, everything works like wonder, but VWD just pop up a warming when I tried to log in the DB, you know, I was not allowed to sign in under sqlserver mode. then it alarmed me that it failed in connecting to the default DB file with my windows account.
View 2 RepliesI have been using VWD2010 Express for a website that I am working on. Due to a delay in implementing the 4.0 framework at the hosting service that I use, I need to finish up with VWD2008 Express. Is there a simple way to save my project so that it is compatible with 2008?
View 2 RepliesI'd like to learn more about MS Business Intelligence Development Studio. I'm doing this on my own, so I'd like to keep my software costs down. It's my understanding that BIDS comes with the download for SQL Server, but is used in Visual Studio (by creatign a BIDS project). Is this accurate? My question is - Is it possible to get a working copy of BIDS by downloading SQL Server Express and Visual Studio Express?
View 2 RepliesI am using one datalist control for uploading multiple images.I hv used one Asp:FileUplaod Control and one button in one itemtemplate.I am using reqired field validator and regular expression validator for file upload cntrl I am assigning validation group for both of them on ItemDataBound event of my datalist so that each upload cntrl hv same validaton group as required field and regular expression validator.Now what i want to do is - i want to show my error message in validation summary which is right at the top of the page.I want one know how to write javascript that will assign validation group of my control in datalist on which i click ?
View 1 RepliesAfter I installed Visual Studio 2008 Standard edition, then I upgrade "SQL Server Express 2005" to "SQL Server Express 2008 SP2". Process upgrading SQL Server Express 2008 was going succesfully (none of the process was fail).
But when I create a New Website I could not add a new item "SQL Server Database" into my website file. Because Visual Studio always rejected any new "SQL Server Database" by giving message below (underline):
This server version is not supported. Only servers up to Microsoft SQL Server 2005 are supported.
I've wrote the comprehensive post within my blog: [URL] In brief words everything is simple:
1. I've downloaded free Visual Studio C# 2010 Express and Visual Studio Web Developer 2010 Express
2. I've successfully installed these versions.
3. I've tried registration online - and got the appropriate keys which I've used for registration.
Finally all the keys I've got are not valid for the system - and after 30 days evaluation (for free version?) period all these products are not running anymore because all the keys I am providing from online registration are invalid.
I started working on a website using 2010 Express. However, the hosting company that I am using hasn't fully implemented .NET 4.0. I'm wondering if there is a way that I can save my website for compatability with 2008 express. Then I can finish and publis using 2008 Express.
View 1 RepliesI am trying to create a pop-up box that looks like a caption of a cartoon which is basicaly a square or rectangle with rounded corners all except for the bottom left.I don't want to use a graphic if possible, and am trying to use CSS to do it but can't quite get it. can use the border-radius for three of the corners that round off, but the left bottom corner that would be protruding out I can't get.
View 2 RepliesI'm trying to edit the template of my login control. By default it presents a button, what must I do to make it an image?
<asp:Button ID="LoginButton" runat="server" CommandName="Login" Text="Log In"
ValidationGroup="ctl18$Login1" />
I have a dropdownlist, filled with countries (from xml file).When you choose a country, you can use the autocomplete for a textbox.This autocomplete has postal codes from the choosen country.Now I want to set the autocomplete off right after the dropdownlist.change eventfor preventing that the autocomplete (filled with postal codes) for 1 country also work for another country. But how do you turn it off?Code:
//when changing country, other postcodes will load
$('[id$=landenDropDown]').change(function () {
//autocompletes removal
[code]...