0

Using Orchard 1.9 from GitHub, if I attempt to force a page validation exception by navigating to

~/Users/Account/LogOn?ReturnUrl=<script%20src%3Dhttp%3A%2F%2Flocalhost%2Fj%20

the end result is a yellow-screen-of-death rather than the Orchard custom exception message.

What is the recommended Orchard way to handle this? Ideally I would like to show the Orchard error page.

FYI I notice that the GET LogOn action (AccountController) does not have a ValidateInput attribute but the POST action does.

Potential Solution:

I set the customErrors element in the web.config to have the attribute defaultRedirect="Error.html" where Error.html is a new file. This of course does not meet my original goal of displaying the Orchard error page.

This does not seem right as modifying the Orchard core (even though it's just the web.config) does not feel right, especially when thinking ahead to updating the Orchard version by pulling the latest Orchard code from the GitHub repository.

Lance H
  • 61
  • 6

1 Answers1

0

The ReturnUrl property does looks a bit strange, this might cause an exception regarding request validation.

If you are in a controller just return a new HttpUnauthorizedResult if authorization fails.

Ropstah
  • 17,538
  • 24
  • 120
  • 194