1

For an ASP.NET MVC 4 website hosted by SiteFinity, I can enter in a text box this text:

< input type="text" >

It passes the values to the MVC back-end with no issues. I was expecting to see the "potentially dangerous request" error but I am not getting it.

The only attributes on the action on the controller back end are: 

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]

I don't have [AllowHTML] I tried adding in [ValidateInput(true)] but it didn't do anything.

I have checked in my filterconfig file but that is just adding the [Authorize] attribute.

I have checked the web.config and the httpRuntime settings are here

   <httpRuntime maxRequestLength="102400" 
        maxUrlLength="102400" 
        maxQueryStringLength="10000"
     requestValidationType="Telerik.Sitefinity.Security.Claims.CustomRequestValidator, Telerik.Sitefinity" />

It doesn't have requestValidationMode="2.0" set and don't have validateRequest="false" set. I don't know what that Sitefinity CustomRequest Validator does, was a part of updating to Sitefinity 6.0 and is suspicious, but I have that setting set on prod and I do get the potentially dangerous errors.

I'm only finding pages telling me how to avoid getting this error. Anyone have an idea how I enable it? Any ideas on what else may be in the code that is disabling it?

Community
  • 1
  • 1
James Nelli
  • 1,119
  • 1
  • 8
  • 15
  • Sorry, should have mentioned in the question. This is a jQuery Mobile front end using Razor with a MVC 4 back end using Sitefinity as the Content Manager. Wanted to put in all the tags as right now I'm not sure if one of these technologies, or a conflict between these technologies, is causing the problem instead of just a stupid mistake on my part. – James Nelli Mar 25 '14 at 13:02
  • Please don't tag with things that aren't part of the question (tag-spam). Feel free to add the additional relevant parts to the question and then retag. However, I doubt that your client-side technologies, [tag:jquery-validate] or [tag:jquery-mobile], would have anything to do with your server side validation. – Sparky Mar 25 '14 at 19:41

0 Answers0