ValidateRequest="false"

Question

User-16411453 posted

 It is possible to add ValidateRequest="false" to the page tag in OnInit or something

Answer 1

User-1831161647 posted

 

you can disable validation of the form etc at the page declaration level

http://msdn.microsoft.com/en-us/library/system.web.configuration.pagessection.validaterequest.aspx

I would think that this is done at a httpmodule level therefore before your handler to the aspx is fired...so do it at the page declaration level.

joel

 

Answer 2

User-16411453 posted

 

Got an Object not set to an Instance of an object.  Added the System.Web.Configuration to my references.  I don't have a clear understanding of the Httpmodule level, so I tried it first in OnInit.

I have a control that generates HTML Code automatically so the user can copy and paste it into their website code. Like YouTube Movie Links.

Protected Overrides Sub OnInit(ByVal e As System.EventArgs)
		MyBase.OnInit(e)

		Controls.Clear()

		Dim cs As ClientScriptManager = Me.Page.ClientScript
		Dim rsType As Type = Me.GetType()

		Dim vr As PagesSection ' As New Something - Perhaps I need to add As New Something, need to figure this out
		Dim Validate As Boolean = False
		Validate = vr.ValidateRequest
		If Validate = True Then vr.ValidateRequest = False

 

Answer 3

User481221548 posted

Hi there

The web.config setting is good, but it affects to all sites, that makes not really sense.
You are trying to set "ValidateRequest" from a Control _to_ a Page in a Control-Level, right?

Thats AFAIK not possible because the Init-Event from Page fires earlier, see:

• http://www.aspnetzone.de/photos/peterbucher/images/182900/original.aspx

I think its the best, when you are working on HttpModule-Level.
A approach may be (i know, some kind of dirty) to wireupin the Init-Event of the current HttpHandler (if typeof(Page)), go throught all controls and see if there is a control that needs ValidateRequest="false".

If so, set the Page Property to false, done.

HTH

Answer 4

User-16411453 posted

I need to look into that - the HttpModule-Level.

Your right, the web.config setting is too global. I can already see in the event log, bad folks trying to inject bad code into my forms on a hourly basis.

I just need to make sure via my controls, that when needed, the validate request is set to false.  I tried removing the form tag on the master page, but the script manager needs it.

Will read the article, thanks Peter for the help

Kirker

Answer 5

User481221548 posted

Hi Kirker

Okay.
As i wrote, i would use a HttpHandler or Global.asax for that (One possible aproach posted above).
The Output can without problems displayed by a Page / Control or whatever by getting the Data from a medium where the HttpModule saved the Output in.