ValidateRequest="false" Doesn't Work In 4?
Apr 20, 2010I have a form at which I use ckeditor. This form worked fine but now doesn't work in Asp.Net 4. I have ValidateRequest="false" directive.
View 3 RepliesI have a form at which I use ckeditor. This form worked fine but now doesn't work in Asp.Net 4. I have ValidateRequest="false" directive.
View 3 RepliesWhy when a control does contain value but it's set to .Enable=False that all controls become disable (that's ok) but why that the ViewState doesn't retain the data on the next post back? If I get the UserControl without modifing its Enable state, the ViewState work between post back.
How can we disable a UserControl that all its control become disable (this part work) but all of them KEEP use the ViewState (this doesn't work)?
Clarification:
1)In the aspx.cs click button EDIT:
myControl.Enabled = false;
//This produce to have all controls in myControl to be disabled.
2)In the asp.cs: click Save to leave the EDIT state:
myControl.Enabled = true;
//This produce that all controls inside myControl are blank : no viewstate!
Other postback works because we do not put myControl.Enable to false.
In CreateUserWizard I have set:
DisableCreatedUser="True"
LoginCreatedUser="False"
but the user is logged on after it is created.and also for sending a verification email I have added:
<MailDefinition BodyFileName="~/EmailTemplates/NewAccountTemplate.htm" From="info@test.com" IsBodyHtml="True" Subject="Registration">
</MailDefinition>
but no email is sent and even OnSendingMail is not fired.
tell me the use of Validaterequest False?
View 4 RepliesI'm using FreeTextBox HTML editor in some webforms in my asp.net project . if I do not set ValidateRequest property to false I get this error :
A potentially dangerous Request.Form value was detected from the client
It's OK in admin folder though , Because only authorized users have access to work with it . But how about public pages like sections where every users have access to leave comments(using FreeTextBox for collecting users comment ) ? Isn't risky for XSS Attack ? If the answer is not Yes , So what's ValidateRequest property for?
FYI I am using .NET 4.0 / MVC 3. In my controller, the following is my code:
[HttpPost]
[ValidateInput(false)]
public ViewResult Edit(ContentTemplateView contentTemplateView, FormCollection collection)
Everything works fine when I don't enter HTML, so I know the proper controller is being fired. Also, I have following set properly in my web.config files:
<httpRuntime requestValidationMode="2.0"/>
I only get this problem when I include the FormCollection (which is needed for this particular Controller). So what exactly am I doing wrong? [I have done what was proposed on the following questions, and they work as long as there is no FormCollection. None of them offer a solution with an included FormCollection] Why is ValidateInput(False) not working? Asp.Net MVC Input Validation still firing after being disabled ValidateInput Attribute Doesn't Seem To Work in ASP.NET MVC
Is it possible to send a html text entered in asp.net text box without making validaterequest to false.
View 1 RepliesI have a textbox and i want the user to be able to submit a youtube embed code.
Is this possible without setting 'ValidateRequest' to false?
I just want to add some client side (JQuery Javascript) validation in a web user control. I put an OnClientClick handler and the function gets called. BUT, even if I return "false", the OnClick method always get fired. What am I doing wrong ?
I'm with VS 2010, targeting the 4.0 framework with JQuery 1.4.2. and JQuery UI 1.8.4.
Here's a sample code :
<td style="text-align:right"><asp:Button ID="btnAddSave" OnClientClick="return ValidateMail();" OnClick="btnAddSave_Click" runat="server" Text="Submit" /></td>[code]...
If I put a breakpoint in the Page_Load event, I see that I get in and the btnAddSave_Click event is also executed.
I'm using a php script to http post some xml files to a .net URL.
When I submit I get the response:
A potentially dangerous Request.Form
value was detected from the client
(<?xml version="...UTF-8"?> <!DOCTYPE
cXML SYSTE...").
Description: Request Validation has detected a potentially dangerous client input value, and
processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.
As I'm not using .NET I can't set ValidateRequest="false" in web.config.
Do I need to sanitize my xml before submitiing? How can I do this?
I have an app that was originally running fine in ASP.Net 3.5, using the ValidateRequest set to false to allow HTML to be saved from a rich text box. However, after converting the app to 4.0, I am getting the Potentially Dangerous message, even though both the page and web.config have the value set to false.
I went into the page and created a PagesSection object and checked its value and then set the value to false. Everytime the page is hit (postback or new) the value is always returned as true, until I set it to false. Not sure why it is reverting to true.
When I set fckEditor to Some Value like
fckDescription.Value = "Description Text";
It creates problems such as Update Panel not doing Async PostBack for DropDownList control and gives error when DropDownList selection changes:Sys.WebForms.PageRequestManagerServerErrorException: An unknown error occurred while processing the request on the server. The status code returned from the server was: 500
But when I Comment out these lines
// fckDescription.Value = "Description Text";
It Works Fine... I am wondering why it is so !!?!!
Also, fckEditor is outside UpdatePanel and DropDownList Control is inside UpdatePanel.
Do sites like Stackoverflow or asp.net use validateRequest= "false" at their page directive? If "Yes" then how they are checking the user input and if "NO" then how they are able to postback the data ?
View 1 RepliesI use fckedit 2.6.6 control in asp.net 4.0 (FCKeditor_2.6.6 and FCKeditor.Net_2.6.3)
somebody told me I should add ValidateRequest="false" to aspx,
but my aspx works well without add ValidateRequest="false",
I'm wanting to allow users to enter HTML in only a single textbox. I understand it's possible to change ValidateRequest in the Page directive to false in order to remove protection.I'm guessing that this allows HTML to be entered in any textbox on the page. Is there anyway to apply ValidateRequest=False on only a single control?
View 3 Replies(ASP.NET 4.0 C#)
I have my <httpRuntime requestValidationMode="2.0" /> in the webconfig. AndI have my validateRequest="false" in page directories.On one page, I send some data (html) from a ckeditor (textarea) to a database. Works fine.On another page I fill the ckeditor with data from a database, then I update it (send it back), and I get the famous "A potentially dangerous Request.Form value was detected from the client."
Makes me very confused. The only difference is that on the second page the data gets dynamically inserted into the textarea, where on the first page the textarea is empty on pageload. Am i missing something here? Im pretty sure Encoding/decoding doesnt mean anything, as the framework stops it before I can even start messing with it on the backend.
I understand I can use validateRequest="false" to by pass ASP.NET security. I'd like to know what security issues setting this flag may cause. Can I be 100% sure there won't be any issue as long as I encode the input using a XSS library?
View 3 Replieswhy the ValidateRequest dose not work when html tags had sent by __doPostBack method in javascript.
[Code]....
why the ValidateRequest dose not work when html tags had sent by __doPostBack method in javascript.
<script>
[Code]....
</script>
i'm trying to make this work for several days but it just doesn't work.
this is my code:
aspx page:
[Code]....
webservice:
[Code]....
this was downloaded from this website.
the problem is that the page loads fine but no autocomplete occurs.
I have a Wizard which has a FileUpload in one of the steps. It also has an "Upload" button. When the user browses to a file, and clicks Upload, I upload the file into SQL.
There seems to be some synchronization problem for very large files, and I would like to disable the Wizard's Next button until the Upload of the file to SQL completes. It can take a while, especially on a wireless PC.
In my OnClick event for the Upload button, I am trying to disable the Next button. The code, which is below, appears to be correct, but the Next button doesn't actually disable until the Query completes. Can I get the Next button to disable immediately instead of after the SQL Update completes?
Here is my code:
Protected Sub JustificationDocUploadButton_Click(ByVal sender As Object, ByVal e As EventArgs) Handles JustificationDocUploadButton.Click
If RequestJustificationAttachment_FileUpload.HasFile Then
Dim obj As Object = Wizard1.FindControl("StepNavigationTemplateContainerID")
Dim startButton As Button = obj.FindControl("StepNextButton")
startButton.Enabled = False
SqlDataSourceJustificationAttachment.Update()
End If
End Sub
I am a new to WCF. I have written ajax to use a web service before, but on this project I am trying to use ajax to WCF.After I build the project and wcf using ajax, I receive the return successfully. But, 10 or more minutes later I don't get a return, the ajax calls the error function, and the fiddler returns nothing.
If I rebuild the project without any source modifying, I receive the return successfully again.
I have been using gridveiw to show uploaded files after that I have already put the new column to download these files. If I will put EnableEventValidation="true" and EnablePartialRendering="true"(ToolkitScriptManager), it is didn't work and error messages apperar like this:
Server Error in '/POV2' Application. Invalid postback or callback argument. Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.ArgumentException: Invalid postback or callback argument. Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page nableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation. Source Error:
[Code]....
Stack Trace:
[Code]....
[ArgumentException: Invalid postback or callback argument. Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.] System.Web.UI.ClientScriptManager.ValidateEvent(String uniqueId, String argument) +173 System.Web.UI.Control.ValidateEvent(String uniqueID, String eventArgument) +72 System.Web.UI.WebControls.HiddenField.LoadPostData(String postDataKey, NameValueCollection postCollection) +46 System.Web.UI.WebControls.HiddenField.System.Web.UI.IPostBackDataHandler.LoadPostData(String postDataKey, NameValueCollection postCollection) +13 System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad) +346 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1743
If I will put "false", it is okay, I can download but updatepanel is didn't work. So my page refreshed when I click any events.
I am not sure if I am posting this on the appropriate forum but I will give a try.
I have the following code:
[Code]....
[Code]....
[Code]....
what wrong with these validators.
[Code]....
Button1 works fine, it causes the validator to work. Button2 works fine, it doesn't cause the validator to work because it's CauseValidation=false But, Button3 in Repeater1 items doesn't work as I want, it still fire the validation of the validator.