Hi,

i am using richttexteditor and i am getting this error

A potentially dangerous Request.Form value was detected from the client (Editor="<p style="direction:...").

while running:

            Editor editor = new Editor(System.Web.HttpContext.Current, "Editor");
            editor.ClientFolder = "/Scripts/richtexteditor/";
            string content = Request.Form["Editor"];

i woul dlike to know how can i updat the editor to send encoded html to the controller.

i prefer not to allow html into the controller by updating the application by adding this to the we.config"

validateRequest=true"

thank you

Ori

Dear oslasi,

please try to add the following code above your controller class.

 [ValidateInput(false)]

Regard,

Jeff

Hi Jeff,

when you allow html into your contoller you are open to javascript attaks, sql injection attaks, ext... all that you need to handle in the back end of your code.

I prefer to block it and not allowing any html code into the back-end.

I think we need to find a solution on the view. the editor needs to send encoded html back to the controller.

is there any other solution?

Thank You

Ori

Hi oslasi,

Please set Editor1.EncodeHiddenValue = true;

Regards,

Ken

Hi,

I tried doing this (in my ASP.NET MVC 4 web app), but my text is getting all garbled.  I entered this in the editor:

      This should be bold - would it?

But this is what arrives in the controller:

      #3nb#7p;Thi#7 #7h#5uld b#9 #1#7tr#5ng#2b#5ld#1/#7tr#5ng#2 - w#5uld it? 

Is there anything obvious I'm doing wrong?

Thanks,

Dirk 

Hi flashiedirk,

I think you just did not use the correct method to get the editor content. Refer to the output_xhtml demo page. you can set the EncodeHiddenValue property for it and test it. the demo will output the correct code in the page. If it works for you too, please use the same way to get the editor content.

Regards,

Ken 

Hi,

Yes, it works now - directly in the model binder.  I find it a bit weird that I need to use an instance of the editor to retrieve the text but it does work.