Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

ValidateRequest in Razor syntax

I have the following header of ASP.Net MVC page:

<%@ Page Title="" Language="C#" MasterPageFile="~/Views/Shared/Admin.Master" Inherits="System.Web.Mvc.ViewPage<NEOGOV_Ideas.Models.SubIdeaAdminPage>"
ValidateRequest="false" %>

I need to move this page to Razor syntax. How should I set ValidateRequest? Thanks

like image 492
Oleg Sh Avatar asked Sep 19 '11 09:09

Oleg Sh


People also ask

What is the Razor syntax?

Razor syntax is a simple programming syntax for embedding server-based code in a web page. In a web page that uses the Razor syntax, there are two kinds of content: client content and server code.

What is ValidateRequest?

As you know, ValidateRequest is a security feature which has been available since . NET Framework 2.0 in WebForms. This feature prevents users from entering html content in input fields to keep the application away from different kind of XSS injection attacks.

How can you specify comments by using Razor syntax?

Comments Razor View Engine has two types of comments, one is single-line and another is multiline. Razor uses the syntax "@* .. *@" for the comment block but in a C# code block we can also use "/* */" or "//".

How do you span multiple code lines in Razor view engine?

You can write multiple lines of server-side code enclosed in braces @{ ... } . Each line must ends with a semicolon the same as C#.


3 Answers

Decorate your action method with ValidateInput attribute

[HttpPost]
[ValidateInput(false)]
public ActionResult index()
{
    return view();
}
like image 149
Amir Ismail Avatar answered Oct 21 '22 06:10

Amir Ismail


You shouldn't need that line in the view, instead use the ValidateInput(false) attribute on the controller method.

Make sure you've got this in your web.config if you're using ASP .net 4.0 (which I presume you are if you're using MVC 3)

<httpRuntime requestValidationMode="2.0"/>

Martin

like image 24
Martin Booth Avatar answered Oct 21 '22 07:10

Martin Booth


From MVC 4 we can allow html content only for property of model class, not for the whole request. Just need to mark property by attribute AllowHtml

public class EditorialPixlocateRequestViewModel
{
    [AllowHtml]
    public string Xml { get; set; }
}
like image 2
Oleg Sh Avatar answered Oct 21 '22 07:10

Oleg Sh