ShowUsYour<Blog>

Irregular expressions regularly

validateRequest="no-way, never, go away!", and don't alter my Html source either!

Today I installed V1.1 of the framework.  It was great, I installed the PocketPC version of TaskVision, deployed it to the emulator and "poooof" - there it was, like magic, my first deployment of a PocketPC application {takes a majestic bow}.

After that magnificent victory I strode back to Mt. Doom to do battle with the Dark Forces of Sauron (a.k.a. CMS 2002) :-)  Guess what happened next?

> Server Error in '/Blah' Application.
> -----------------------------------------------------------
> A potentially dangerous Request.Form value was detected from the client 

Would you look at that... my app just broke.  Just when I finally thought that I'd worked out CMS2002, the rug got pulled out from under me ;-)

I haven't bothered to check as yet, but, I imagine that the validateRequest Page attribute must have existed in V1.0 and that its value was set to false by default in the machine configuration file and that V1.1 decided that we needed to have it.  I guess that I should go on record as saying that, "I don't believe that we needed to have it.".

To disable it, you can turn it off in the config file like so:

system.web>
    <pages validateRequest="false" />
FONT color=#800000>system.web>
Posted: May 05 2003, 07:12 PM by digory | with 4 comment(s)
Filed under:

Comments

G. Andrew Duthie said:

Darren,

Pet peeve here, but even if you don't like the feature...it's good to point out that this can also be disabled at the page level, rather than disabling it for the entire application. In fact, for most people, this is the smarter way to do it, since it enables you to allow HTML input on a specific page, while protecting you from inadvertent script vulnerabilities where you may not be filtering or encoding the input.

# May 4, 2003 7:02 PM

Darren Neimke said:

I plead temporary insanity ;-)
# May 4, 2003 9:44 PM

12 said:

<br>
# January 8, 2004 3:41 AM

QQ said:

<blockquote> blockquote </blockquote>
<script>
if(confirm('hide page?')) document.body.style.display = 'none';
</script>
# February 16, 2004 10:34 PM
Leave a Comment

(required) 

(required) 

(optional)

(required)