Last post Aug 04, 2008 05:58 PM by Peter Bucher
Aug 01, 2008 03:54 PM|jkirkerx|LINK
It is possible to add ValidateRequest="false" to the page tag in OnInit or something
Aug 02, 2008 08:56 PM|Joël Hébert|LINK
you can disable validation of the form etc at the page declaration level
I would think that this is done at a httpmodule level therefore before your handler to the aspx is fired...so do it at the page declaration level.
Aug 03, 2008 03:26 PM|jkirkerx|LINK
Got an Object not set to an Instance of an object. Added the System.Web.Configuration to my references. I don't have a clear understanding of the Httpmodule level, so I tried it first in OnInit.
I have a control that generates HTML Code automatically so the user can copy and paste it into their website code. Like YouTube Movie Links.
Protected Overrides Sub OnInit(ByVal e As System.EventArgs)
Dim cs As ClientScriptManager = Me.Page.ClientScript
Dim rsType As Type = Me.GetType()
Dim vr As PagesSection ' As New Something - Perhaps I need to add As New Something, need to figure this out
Dim Validate As Boolean = False
Validate = vr.ValidateRequest
If Validate = True Then vr.ValidateRequest = False
Aug 04, 2008 01:03 PM|Peter Bucher|LINK
The web.config setting is good, but it affects to all sites, that makes not really sense.
You are trying to set "ValidateRequest" from a Control _to_ a Page in a Control-Level, right?
Thats AFAIK not possible because the Init-Event from Page fires earlier, see:
I think its the best, when you are working on HttpModule-Level.
A approach may be (i know, some kind of dirty) to wireupin the Init-Event of the current HttpHandler (if typeof(Page)), go throught all controls and see if there is a control that needs ValidateRequest="false".
If so, set the Page Property to false, done.
Aug 04, 2008 05:45 PM|jkirkerx|LINK
I need to look into that - the HttpModule-Level.
Your right, the web.config setting is too global. I can already see in the event log, bad folks trying to inject bad code into my forms on a hourly basis.
I just need to make sure via my controls, that when needed, the validate request is set to false. I tried removing the form tag on the master page, but the script manager needs it.
Will read the article, thanks Peter for the help
Aug 04, 2008 05:58 PM|Peter Bucher|LINK
As i wrote, i would use a HttpHandler or Global.asax for that (One possible aproach posted above).
The Output can without problems displayed by a Page / Control or whatever by getting the Data from a medium where the HttpModule saved the Output in.