Do sites like Stackoverflow or asp.net use validateRequest= "false" at their page directive? If "Yes" then how they are checking the user input and if "NO" then how they are able to postback the data ?
View 1 Repliestell me the use of Validaterequest False?
View 4 RepliesI'm using FreeTextBox HTML editor in some webforms in my asp.net project . if I do not set ValidateRequest property to false I get this error :
A potentially dangerous Request.Form value was detected from the client
It's OK in admin folder though , Because only authorized users have access to work with it . But how about public pages like sections where every users have access to leave comments(using FreeTextBox for collecting users comment ) ? Isn't risky for XSS Attack ? If the answer is not Yes , So what's ValidateRequest property for?
FYI I am using .NET 4.0 / MVC 3. In my controller, the following is my code:
[HttpPost]
[ValidateInput(false)]
public ViewResult Edit(ContentTemplateView contentTemplateView, FormCollection collection)
Everything works fine when I don't enter HTML, so I know the proper controller is being fired. Also, I have following set properly in my web.config files:
<httpRuntime requestValidationMode="2.0"/>
I only get this problem when I include the FormCollection (which is needed for this particular Controller). So what exactly am I doing wrong? [I have done what was proposed on the following questions, and they work as long as there is no FormCollection. None of them offer a solution with an included FormCollection] Why is ValidateInput(False) not working? Asp.Net MVC Input Validation still firing after being disabled ValidateInput Attribute Doesn't Seem To Work in ASP.NET MVC
Is it possible to send a html text entered in asp.net text box without making validaterequest to false.
View 1 RepliesI have a textbox and i want the user to be able to submit a youtube embed code.
Is this possible without setting 'ValidateRequest' to false?
I'm using a php script to http post some xml files to a .net URL.
When I submit I get the response:
A potentially dangerous Request.Form
value was detected from the client
(<?xml version="...UTF-8"?> <!DOCTYPE
cXML SYSTE...").
Description: Request Validation has detected a potentially dangerous client input value, and
processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.
As I'm not using .NET I can't set ValidateRequest="false" in web.config.
Do I need to sanitize my xml before submitiing? How can I do this?
I have an app that was originally running fine in ASP.Net 3.5, using the ValidateRequest set to false to allow HTML to be saved from a rich text box. However, after converting the app to 4.0, I am getting the Potentially Dangerous message, even though both the page and web.config have the value set to false.
I went into the page and created a PagesSection object and checked its value and then set the value to false. Everytime the page is hit (postback or new) the value is always returned as true, until I set it to false. Not sure why it is reverting to true.
When I set fckEditor to Some Value like
fckDescription.Value = "Description Text";
It creates problems such as Update Panel not doing Async PostBack for DropDownList control and gives error when DropDownList selection changes:Sys.WebForms.PageRequestManagerServerErrorException: An unknown error occurred while processing the request on the server. The status code returned from the server was: 500
But when I Comment out these lines
// fckDescription.Value = "Description Text";
It Works Fine... I am wondering why it is so !!?!!
Also, fckEditor is outside UpdatePanel and DropDownList Control is inside UpdatePanel.
I use fckedit 2.6.6 control in asp.net 4.0 (FCKeditor_2.6.6 and FCKeditor.Net_2.6.3)
somebody told me I should add ValidateRequest="false" to aspx,
but my aspx works well without add ValidateRequest="false",
I'm wanting to allow users to enter HTML in only a single textbox. I understand it's possible to change ValidateRequest in the Page directive to false in order to remove protection.I'm guessing that this allows HTML to be entered in any textbox on the page. Is there anyway to apply ValidateRequest=False on only a single control?
View 3 Replies(ASP.NET 4.0 C#)
I have my <httpRuntime requestValidationMode="2.0" /> in the webconfig. AndI have my validateRequest="false" in page directories.On one page, I send some data (html) from a ckeditor (textarea) to a database. Works fine.On another page I fill the ckeditor with data from a database, then I update it (send it back), and I get the famous "A potentially dangerous Request.Form value was detected from the client."
Makes me very confused. The only difference is that on the second page the data gets dynamically inserted into the textarea, where on the first page the textarea is empty on pageload. Am i missing something here? Im pretty sure Encoding/decoding doesnt mean anything, as the framework stops it before I can even start messing with it on the backend.
I have a form at which I use ckeditor. This form worked fine but now doesn't work in Asp.Net 4. I have ValidateRequest="false" directive.
View 3 RepliesI understand I can use validateRequest="false" to by pass ASP.NET security. I'd like to know what security issues setting this flag may cause. Can I be 100% sure there won't be any issue as long as I encode the input using a XSS library?
View 3 Replies Do i have to validate cokkies, userinput, qurystring,database out for xxs , when my page is set to
ValidateRequest="true" ??
how can validate the checkbox is true or false...
View 6 RepliesI've created an httpModule to handle URL remappings, and it works great on my test system. A request for www.mydomain.com/Some_Fancy_URL gets rewritten to www.mydomain.com/some.aspx?fancy=23 and so on.When I deploy to the actual web site, I'm getting the default IIS 404 page though.After doing some research online, it would seem that I need to setup "Wildcard Mapping" in IIS 6 to get the request past IIS and in to my httpModule. The problem is that the site is hosted on a shared server, so it may not be possible to get the ISP to make that change. My question is, can't I use an httpHandler to tell IIS how I want these requests handled? For example:
<httpHandlers>
<add path="*.aspx" verb="GET,POST" type="System.Web.UI.PageHandlerFactory" validate="false"/>
</httpHandlers>
It would seem like adding this to my Web.Config should tell IIS to stop validating the existence of .aspx files, and just pass the request along for me to process. It doesn't work though.
I have an approve button.on clicking on this button it should show that an inactive value is present .Onclicking yes conformation it should save the data or else clicking on no conformation should return false; how i will do that?After alert it always submit the data.
protected void ibtApprove_Click(object sender, ImageClickEventArgs e)
{
string otherAffiliateName = txtRequestedAffiliate.Text;
int inActiveAffiliates = new BLRating().InActiveAAffiliateChecking(otherAffiliateName);
if (inActiveAffiliates > 0)
[code]...
This is the code i used.how i wiil stay back on Confirm 'no' click?
My ASP.NET page contains "ValidateRequest = true". However, there is one textbox in the page for which I don't want ASP.NET to validate. Is there a way to make it false for that one control? If there isn't, is there a way to ignore the "Potential Threat" error, assuming it comes from that particular control?
View 1 RepliesIn the notes for Step 1 in the "How To: Prevent Cross-Site Scripting in ASP.NET" it is stated that you should "not rely on ASP.NET request validation. Treat it as an extra precautionary measure in addition to your own input validation."
View 2 RepliesWhat is the difference between enableEventValidation and validateRequest? Although the former is on postback/callback caused by a control (Server side only I assume?, the latter is on every request, which is caused by a control posting back anyway? Or would validateRequest kick in by a standard html link being clicked?
View 2 RepliesI've got a ajax page with 2 panels on it. On Panel1 there is a next button. On that panel there is a pref. button and a next button. But if i put the pref. button he should do an action, but thats not possible because there are requestedfieldvalidators on that page. So i need to fill the page first, and then i can go back.
But on the next i want the validators. How can i make this possible?
What is the difference between validateRequest (which validates form and querystring values) and also enableeventvalidation, which works on post/call backs? In specific, what confuses me is that validateRequest can only be possible by a postback as this is how form values etc will be picked up?
View 1 RepliesHere's the situation. I have an aspx page that is designed to receive a POST request with some XML values, parse the XML, grab the relevant items, and write them to the page. The problem arises when I try to launch the page using the POST request. When I launch using Fiddler, building the request manually and just pasting the XML in the body of the request everything works fine and dandy. When I launch the page from a basic HTML form, however, things don't go so great. The HTML form that I'm using looks like this:
[Code]....
When the page loads I get the error:
A potentially dangerous Request.Form value was detected from the client Everything I've read so far has told me that the solution is to add ValidateRequest="false" to the page directive in the top of the .aspx file, or in the pages element of the web.config file. But neither of these work. Afterwards, I still get the same error. Any idea what I need to do to make this work?
I just updated my project to ASP.NET 4. All of a sudden, some of my HttpHandlers are giving ValidateRequest errors. This is because the user HAS to be able to put an XML string in the querystring.I know how to disable ValidateRequest on a page, but how do I do it on an HTTPHandler?
View 1 Replies