-1

I am trying to update (using PUT operation) a sitecore item with a 'Rich Text' field with the Sitecore ItemWebApi 1.2. I am running in to an issue with the server saying

"A potentially dangerous Request.Form value was detected from the client"

I could do the validationRequest=false in the web.config. But that will disable the validation for all requests which is not ideal. Is there a way to save html text using ItemWebApi without using the validationReques=false? Seems for aspx pages you could use @Page. Not sure where something like that could be configured in this case.

RobertoBr
  • 1,781
  • 12
  • 22
Kalyan
  • 488
  • 6
  • 17
  • validationRequest=false is a good idea, you don't want to show a error page if a custommer submit a form of whatever and use without evil intentions a potentially dangerous string. ofcourse don't allow XSS, escape html karakters. – Jan Bluemink Mar 02 '15 at 14:12

2 Answers2

2

May be you have already figured out the answer for yourself, but in interest of our fellow community I posting answer here.

Actually myself get struck into this similar issue from last week, but because of your question i found the solution. By Default Sitecore nowdays comes with

<pages validateRequest="false">

but it is not effective until or unless we do following

<httpRuntime requestValidationMode="2.0"/>

It is also indicated in Sitecore KB article and in another stack overflow answer.

Regards Vishal Gupta

Community
  • 1
  • 1
Vishu
  • 55
  • 4
  • 11
0

I did double escaping on client before sending to server and double unescaped with a custom item web api processor to essentially achieve the same effect for this one ajax call. This way, I did not have to turn off validation application wide and had to add the validateRequest=true on all pages. Turning of default html validation would also mean every other developer on our team needs to be aware that html validation is turned off and they have to add special xml on top to enable it. Someone missing that will make our site insecure.

Kalyan
  • 488
  • 6
  • 17