Umbraco & ASP.NET Request validation

Question

I have a problem with my Umbraco ( v4.7.2 ).

Currently I can't publish content from Umbraco interface because of ASP.NET request validation. When its turn off everything is working like a charm.

I was looking for some kind of solution for this because I worry about disabling request validation for my application. So I decided to turn off the validation programmatically for some time while it's needed.

My first solution was to subscribe to umbraco.cms.businesslogic.web.Document events. For example I can disable validation on Document.BeforePublish event and then turn on validation on Document.AfterPublish event. Example:

public UmbracoPublishHandler()
{
  Document.BeforePublish += Document_BeforePublish;
  Document.AfterPublish += Document_AfterPublish;
}

private void Document_BeforePublish(Document sender, PublishEventArgs args)
{
  //Turn off validation here
}

private void Document_AfterPublish(Document sender, PublishEventArgs args)
{
  //Turn on validation here
}

But this didn't work because request validation provides validation before Document.BeforePublish event took place.

The second solution was to implement custom UsersMembershipProvider and turning off validation after user has successfully pass authentication. But the problem is - I can't catch any appropriate event to turn on validation when user for example signs out from Umbraco.

Example:

public class CustomUsersMembershipProvider : umbraco.providers.UsersMembershipProvider
{
    public override bool ValidateUser(string username, string password)
    {
        var success = base.ValidateUser(username, password);

        if (success)
        {
           //Turn off validation here 
        }

        return success;
    }
}

Can you please advise something on this? What is best practice to make request validation work with Umbraco?

Answer 1

You may need to set the correct version of the .NET request validation. Umbraco works with version 2.0:

<httpRuntime requestValidationMode="2.0">

Answer 2

I guess I solve my problem by adding directive EnableEventValidation="false" to Umbraco/editContent.aspx page. By default it also has ValidateRequest="false" .

So the thing I was worry about – disabling request validation on application level seems to be not try.

Having the requestValidationMode=2.0 will only restrict validation for .aspx pages but wont disable it at all. Also it making possible usage of page directives.

Answer 3

We can encode the html string data using jQuery before passing to codebehind(asp.net C#) For example -

jQuery('<div />').text('Some text with <div>html</div>').html()

and the output will look like -

"Some text with <div>html</div>"

Then Decode data to show HTML(without HTML tag show) -

jQuery('<div />').html('Some text with &lt;div&gt;html&lt;/div&gt;').text()

output will look like -

"Some text with <div>html</div>"