Microsoft Content Management Server - Re: Isn't it dangerous to turn validateRequest to false?

This is Interesting: Free IT Magazines  
Home > Archive > Microsoft Content Management Server > October 2005 > Re: Isn't it dangerous to turn validateRequest to false?





You are viewing an archived Text-only version of the thread. To view this thread in it's original format and/or if you want to reply to this thread please [click here]

Author Re: Isn't it dangerous to turn validateRequest to false?
bonset

2005-10-24, 10:39 am

Hello Stefan

thank you very much for your answer. But I cannot resolve this. My problem
lays with the Woodgrove Net Sample site.

It seems that if I don't change validateRequest property to false on the
Web.config file:
<pages validateRequest="false" smartNavigation="false"/>
I can´t edit even existing content. This means that when I am trying to save
an existing page even without making any changes, I go a security error.

Whenever the parser finds a <p> I get:

potentially dangerous Request.Form value was detected from the client
(Placeholderhtmlcontrol4:AuthoringModeCo
ntrolsContainer:ActiveXAuthoringControl=
"<P>Woodgrove Bank an...").

I created a new template as well, with new HTML placeholders that can accept
mark-up content and still if I don’t change the value of the validateRequest
I can’t make it accept any changes.

Your help is needed and would be appreciated!

Thank you for your time

"Stefan [MSFT]" wrote:

> Hi Bonset,
>
> MCMS expects html content.
> This basic rule is to protect you if you don't expect html content in post
> data.
> So if you only have MCMS placeholder controls on your template then it is
> perfectly save to set disable this validation as MCMS knows how to handle
> html content savely.
>
> Cheers,
> Stefan
>
> --
> This posting is provided "AS IS" with no warranties, and confers no rights
>
> New to MCMS?
> Check out this book: Building Websites Using MCMS: http://tinyurl.com/6zj44
> ----------------------
>
>
> "bonset" <bonset@discussions.microsoft.com> wrote in message
> news:00E630AC-45BE-4200-B562-2EE28EAD435E@microsoft.com...
>
>
>

Sponsored Links






Free braindumps | Software forum | Database administration forum

Copyright 2003 - 2008 webservertalk.com