Re: Isn't it dangerous to turn validateRequest to false?
Web Server forum
Back To The Forum Home!Search!Private Messaging System

Web Server Talk Web Server Talk > Web Servers reviews > Microsoft Content Management Server > Re: Isn't it dangerous to turn validateRequest to false?




  Last Thread   Next Thread Next
  Show Printable Version Email this Page Subscribe to this Thread      Post New Thread    Post A Reply      

    Re: Isn't it dangerous to turn validateRequest to false?  
bonset


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
10-24-05 03:39 PM

Hello Stefan

thank you very much for your answer. But I cannot resolve this. My problem
lays with the Woodgrove Net Sample site.

It seems that if I don't change validateRequest property to false on the
Web.config file:
<pages validateRequest="false" smartNavigation="false"/>
I can´t edit even existing content. This means that when I am trying to sav
e
an existing page even without making any changes, I go a security error.

Whenever the parser finds a <p> I get:

potentially dangerous Request.Form value was detected from the client
 (Placeholderhtmlcontrol4:AuthoringModeCo
ntrolsContainer:ActiveXAuthoringCont
rol="<P>Woodgrove Bank an...").

I created a new template as well, with new HTML placeholders that can accept
mark-up content and still if I don’t change the value of the validateReque
st
I can’t make it accept any changes.

Your help is needed and would be appreciated!

Thank you for your time

"Stefan [MSFT]" wrote:

> Hi Bonset,
>
> MCMS expects html content.
> This basic rule is to protect you if you don't expect html content in post
> data.
> So if you only have MCMS placeholder controls on your template then it is
> perfectly save to set disable this validation as MCMS knows how to handle
> html content savely.
>
> Cheers,
> Stefan
>
> --
> This posting is provided "AS IS" with no warranties, and confers no rights
>
> New to MCMS?
> Check out this book: Building Websites Using MCMS: [url]http://tinyurl.com/6zj44[/url
]
> ----------------------
>
>
> "bonset" <bonset@discussions.microsoft.com> wrote in message
> news:00E630AC-45BE-4200-B562-2EE28EAD435E@microsoft.com... 
>
>
>





[ Post a follow-up to this message ]



    Sponsored Links  




 





   All times are GMT. The time now is 02:38 PM.      Post New Thread    Post A Reply      
  Last Thread   Next Thread Next


Most Popular forums 

Forum Jump:
Rate This Thread:

Forum Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is OFF
vB code is ON
Smilies are ON
[IMG] code is OFF
 
Medical and Health forum | Computer Games Reviews | Graphics design forum

Back To The Top
Home | Usercp | Faq | Register