I am trying to set up input validation using regular expressions, but I keep getting this error when I enter "<test>" in a textbox:
A potentially dangerous Request.Form value was detected from the client
I have this in the web.config:
<system.web>
<httpRuntime requestValidationMode="2.0" />
I also have this in the web.config:
<system.web>
<pages controlRenderingCompatibilityVersion="3.5"
clientIDMode="AutoID"
validateRequest="false">
...
</pages>
and I have this in the page directive of the view in question:
ValidateRequest="false"
Nothing seems to help. I have seen this question on this site and usually the posters leave out the httpRuntime tag in the web.config ... but I have included that and I still get the exception. Any ideas?
OK, I found the answer: [ValidateInput(false)] before the controller or action code! (I didn't go far enough in reading previous questions!)
Related
I upgraded Kentico site into version Kentico version 11. I am getting error of
Session state can only be used when enableSessionState is set to true, either in a configuration file or in the Page directive. Please also make sure that System.Web.SessionStateModule or a custom session state module is included in the \ section in the application configuration.
I performed solution for that:
I applied in web.config
sessionState cookieless="UseCookies" mode="InProc"
sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes"
stateConnectionString="tcpip=127.0.0.1:42424" timeout="20"
but not working.
I also added in page tag in web.config
pages enableSessionState="true" validateRequest="false" clientIDMode="AutoID"
controlRenderingCompatibilityVersion="4.0"
but not working.
I also start ASP.Net services but not working.
My .Net framework is 4.6
Correction on my last post now that i have a normal web.config in front of me.
Default Session State is:
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="20" />
Nothing else on the pages part. Try that. Emphasis on the cookieless="false" as that is different than your configuration.
at your web.config add the following
<modules runAllManagedModulesForAllRequests="true">
.
.
.
.
</modules>
Edit: showed my exact web.config code.
I have a MVC3 project that works fine on my box, but when I upload it to the web server, it gives an error on a certain page. I am trying to determine the exact error, but it keeps redirecting to the "Error/ShowError" action. I tried modifying the web.config file to say showcustomerrors=false, but it still redirects. I really need to see the actual error in order to troubleshoot the problem.
In firebug, it shows that the error is a 500 internal server error. I haven't been able to get any more detailed than that.
Also, if I run the page from my local box, but use the remote database, I don't get an error. This makes me think it's related to directory permissions.
Here is in my web.config section:
<compilation debug="true" targetFramework="4.0">
Here is in my web.debug.config section:
<customErrors mode="Off">
Thanks!
See if these changes will help.
<configuration>
<system.webServer>
<httpErrors errorMode="Detailed" />
</system.webServer>
<system.web>
<customErrors mode="Off"/>
<compilation debug="true"/>
</system.web>
</configuration>
If not, make sure that AspNet is properly installed.
C:\Windows\Microsoft.Net\Framework..\v.....\aspnet_regiis.exe -i
Edit:
You can try to log the exception message using the following method in Global.asax.cs
protected void Application_Error(object sender, EventArgs e) {
var exception = Server.GetLastError();
// Log the exception
}
Edit:
Well, this will be a lot to do, but I suggest you to add Elmah to your project to log unhandled exceptions. See the first step on Logging in MVC Part 1- Elmah
Elmah is available on NuGet Gallery.
Turn off customErrors in web.config and you will be able to see what the error is. then fix it. Turn the Custom Error on
<customErrors defaultRedirect="Error.aspx" mode="Off"/>
Here are the options you have for custom errors:
<customErrors defaultRedirect="url"
mode="On|Off|RemoteOnly">
<error. . ./>
</customErrors>
I think your issue is that you're using 'false' instead of 'Off'.
Good luck, hope this works for you.
Reference: MSDN link for CustomErrors section
I have a strange error I have never run into before.
I secured a controller with:
[Authorize(Roles = "admin")]
public class LoggingController : Controller
When a non-admin user tries to access any protected content, they are redirected to:
http://localhost:50501/Account/Login?ReturnUrl=%2flogging
note: account/login and NOT account/logon
The AccountController.Login action does not exist.
web.config has:
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
I can of course implement the Login action and redirect to Logon.
I am just puzzled and would like to know why this happens.
Search your project for login - it has to be specified somewhere. Is there any other web.config value overriding this (maybe looking at a child root and the parent value is being used)
Also is there any redirect that is happening? Are there any defaults set in your machine's web.config?
Is your default url on the project set to be a /login?
Install glimpse route debugger to see which route is being used for this page as well.
EDIT:
A little more research yields a known issue.
Check out this link:
ASP.NET MVC issue with configuration of forms authentication section
Theres a bug in mvc 3 beta - are you running the beta bits?
Also notice the mentioned item in the above url for RTM bits:
<add key="loginUrl" value="~/LogOn" />
Also check out
http://forums.asp.net/p/1616153/4138366.aspx
EDIT 2
Below is a solid comment about a potential source of this from #santiagoIT (upvote his comment please if the specifics help you)
Today I discovered the root of this problem: I had added 'deployable dependency' on 'ASP.NET Web Pages with Razor Syntax'. This adds a reference to: WebMatrix.Data.dll This assembly has a class with a static constructor that does the following: static FormsAuthenticationSettings(){ FormsAuthenticationSettings.LoginUrlKey = "loginUrl"; FormsAuthenticationSettings.DefaultLoginUrl = "~/Account/Login";} That explains!
This worked for me and I'm using MVC 3
<appSettings>
<add key="loginUrl" value="~/Account/LogOn" />
</appSettings>
<system.web>
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" name=".ASPXFORMSAUTH" />
</authentication>
</system.web>
Also I found that adding the followinf part to the web config (only during debugging the config) helped speed up my debugging as had to authenticate for ANY page.
<authorization>
<deny users="?" /> <!-- remove after debugging -->
</authorization>
Just simply remove the WebMatrix dll if they are present in your deployed bin folder.
I fixed it this way
1) Go ot IIS
2) Select your Project
3) Click on "Authentication"
4) Click on "Anonymous Authentication" > Edit > select "Application pool identity" instead of "Specific User".
5) Done.
(This is cross-posted to the ASP.NET forms)
I'm working on the WebGit .NET project, and we are close to a "1.0" release. However, I'm having trouble getting my "Browse" controller (which pulls files out of the repository) to serve-up ".cshtml" files.
I originally had trouble with ".config" and ".cs" files as well, but I fixed that with this in the web.config:
<location path="browse">
<system.webServer>
<security>
<requestFiltering>
<fileExtensions allowUnlisted="true">
<clear />
</fileExtensions>
<hiddenSegments>
<clear />
</hiddenSegments>
</requestFiltering>
</security>
</system.webServer>
</location>
The routing that should be handling this request (that is successfully routing everything else) is:
routes.MapRoute(
"View Blob",
"browse/{repo}/blob/{object}/{*path}",
new { controller = "Browse", action = "ViewBlob", path = UrlParameter.Optional });
Now, whenever I try to access a URL that ends in ".cshtml", it gives a 404, even though my request should have been handled by the "Browse" controller. The files I'm serving-up do not exist on disk, but are instead pulled from a git repository as blobs. Every other file extension that I have tried works just fine.
How can I fix this behavior?
EDIT: I have tried disabling WebPages like so:
<appSettings>
<add key="webpages:Enabled" value="false" />
</appSettings>
But that appears to have no effect.
As a quick workaround, you can put a temporary browse.cshtml file at your application root and put this inside your web.config,
add key="webpages:Enabled" value="false"
This is a known bug in ASP.NET WebPages, which gets implicitly loaded when you are using MVC 3. I don't think there is a straightforward way of disabling this behavior. The only workaround is to use a different extension (specifically, one that is not listed via WebPageHttpHandler.GetRegisteredExtensions())
This will be fixed in MVC 4, however. Sorry for the inconvenience.
I am trying to disable output caching in a MVC3 app when in debug. I am specifying output caching in the controllers (via the attribute) but don't want to have to #if DEBUG all over my code. I expected this to work:
// In Web.config.debug
<system.web>
<caching>
<outputCache enableOutputCache="false"
xdt:Transform="Replace" />
</caching>
But this seems to be ignored. Any other ideas how to do it system wide without nasty global.asax code or #if DEBUGs everwhere?
The web.config.debug file is used only when you build a deployment package. If you run your site locally in Cassini for example it is completely ignored. So you may try disabling cache in your web.config:
<system.web>
<caching>
<outputCache enableOutputCache="false" />
</caching>
</system.web>
and in your web.config.release enable the cache. Note though that if you don't use the web deployment package feature those files are completely ignored.
I would think that would work as well. You may want to also try setting enableFragmentCache to false. Per this link:
the EnableFragmentCache property is
set to false, no page is cached on the
server, regardless of the settings in
# OutputCache directive or caching
profile used by the page. For more
information, see
OutputCacheSettingsSection and
OutputCacheProfile.
If you use IIS version > 7
You should:
<system.webServer>
<caching enabled="true"/> //false in webconfig.debug
</system.webServer>