A potentially dangerous Request.Form with ASP MVC - asp.net-mvc

I have recently upgraded a project of mine from one of the beta builds of MVC to the full version.
I am getting the yellow screen of death on one of my inputs "A potentially dangerous Request.Form yada yada".
So I tried edting the pages validateRequest attribute, that didnt work.
Then I tried adding
[ValidateInput(false)]
To the offending action, but when I try and build it says the attribute doesn't exist.
So what do I do?

Incidentally, a breaking change in MVC 2 / ASP.NET 4 means [ValidateInput(false)] won't work unless you add the following to the <system.web> part of your web.config file:
<httpRuntime requestValidationMode="2.0" />

It works at my site.
Can you try with a new plain website? I had some other strange behaviours (strongly typed views did not work), when I converted webs from beta to R1. Starting fresh and copying over the files to the new web always worked at the end.

Related

When upgrading from MVC 4 to 5 every razor call is beeing underlined and with an error message associated with it

When upgrading from MVC 4 to 5 every razor call is beeing underlined and with an error message associated with it.
The pages still works but it would be nice to have error messages removed and if the intellisense could start working again.
I'we read that using following could help but it don't.
<add namespace="System.Web.Optimization" />
There might be different reason such as versions of refrenced assemblies to setting in Web.config.
Make sure that you didn't miss a step from this tutorial:
http://www.asp.net/mvc/tutorials/mvc-5/how-to-upgrade-an-aspnet-mvc-4-and-web-api-project-to-aspnet-mvc-5-and-web-api-2
and this link also might help
http://ctsoftr.com/upgrading-from-asp-net-mvc-4-to-5/

How do I display a Web Forms page from an MVC 2 application?

The Report Viewer control apparently only works in a Web Forms page (I'm using MVC 2). So, I make one, add my report to it, and try making a link to it from one of the Views in my MVC 2 site. I consistently get the error "The resource cannot be found". I've tried every possible URL I can think of it get it to work. I even dragged and dropped a Hyperlink tool into the page and set it to link to the Web Form in question and got the same results.
The Web Form is in the /Views/MaintenanceReports folder. I've tried URLs such as ~/Views/MaintenanceReports/DriverList.aspx (with and without the *.aspx) and a few others. But, I'm very sure this should be the URL.
I also added this page route to the Global.asax file in hopes that it would do something magical routes.MapPageRoute("DriverListing", "MaintenanceReports/DriverListing", "~/Views/MaintenanceReports/DriverListing.aspx");
I also tried adding, per the suggestion of one of my fellow programmers, an iframe to an MVC View that had the Web Form in question as its source. This also gave me the same error.
I've got the book Pro ASP.NET MVC 2 on hand and it doesn't give me anything that helps. It basically says that there shouldn't be an issue.
The server runs IIS 7 and has the .NET 4 framework installed.
Normally I'd spend more time looking for an answer, but I'm quite pressed for time currently. This is my last day here (internship) and I'd like to get this last thing done before I leave.
Thank you for all your help.
Try using the StopRoutingHandler. I think the issue is you need to tell MVC to ignore those urls.
routes.Add(new Route("MaintenanceReports/{*resource}",
new StopRoutingHandler()));
Update
It looks like the above doesn't work for routing within the Views folder. The simple solution is to move the WebForms out of the Views folder, and the WebForms work out of the box alongside MVC.
You can also add this line into to display a .asxp page
<httpHandlers>
<!-- see below -->
<clear />
<add path="*.aspx" verb="*" type="System.Web.UI.PageHandlerFactory"/>
<add path="*" verb="*" type="System.Web.HttpNotFoundHandler" />
</httpHandlers>

Getting 404 error on MVC web-site

I have an IIS7.5 web-site, on Windows Server 2008, with an ASP.NET MVC2 web-site deployed to it. The website was built in Visual Studio 2008, targeting .NET 3.5, and IIS 5.1 has been successfully configured to run it as well, for local testing.
However, whenever I try and navigate to a page running in IIS7, I get a 404 error.
I have checked the following things:
There is no corresponding 404 log entry in IIS logs.
Actually, there are 404 entries in the IIS log.
The application pool for the web-site is set to use the Integrated pipeline.
The "customErrors" mode is set to off.
.NET 3.5 SP1 is installed
ASP.NET MVC 2 is installed
I've used MVC Diagnostics to confirm all MVC DLLs are being found.
ASP.NET is enabled in IIS, which we've demonstrated by running the MVC Diagnostics page.
KB 2023146 did highlight that HTTP Redirection was off, so we've turned it on, but no joy.
EDIT
Ok, so we've installed the world's simplest MVC application (the one which is created when you create a new MVC2 project in Visual Studio), and we are still getting 404s on any page we try and access - e.g.
<my_server>/Home/About will generate a 404.
Any ideas will be greatly appreciated!
This is quite often caused by the following missing from the web.config:
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
Do you have a problem with just 1 page or the whole site is not working?
A) 1 page
You can use RouteDebugger to verify if the route is matched correctly
B) Whole site
I assume you're using Windows Server - check if ASP.NET is enabled in IIS - it's disabled by default, I believe.
You can use MvcDiagnostics page to check if all dlls are deployed properly.
Are you running in IIS7 integrated mode? Classic mode of IIS7 does not automatically map extensionless URLs to ASP.NET (much like IIS6)
Make sure your Web.config tag is configured correctly.
We finally nailed this issue by exporting the IIS configuration of a working server, and comparing it to ours.
It was a really obscure setting which had been changed from the default.
IIS ROOT → request Filtering → Filename Extensions Tab → Edit Feature Settings → Allow unlisted file name extensions
This should be ticked.
This can be set at the IIS level, or the site-level.
Glad that fixed your problem. Others researching this issue should take note of the extensionless URL hotfix: http://support.microsoft.com/kb/980368
If none of the other solutions here solved your issue, check that you have the
Global.asax
file in your website. This solved the issue for me.
Checkout if KB 2023146 applies to your scenario. Also try requesting directly a controller action: /yoursitename/home/index
Apparently this can have many different causes.
For us, the problem was that the DNS entry was configured for two IP addresses, but the IIS configuration would only listen to one of them. So we got unpredictable results, sometimes it would work, sometimes a few files (css, etc) would not load, and sometimes the whole page would not load.
For me it was all about installing .NET Framework 4.6.1 on the server (my app was targeting that version)
You'll also get this if your bindings aren't correct. If you don't have www or a subdomain it'll return a 404.
I had this problem when running my MVC4 site with an app pool set to ASP.NET 4.0 and the Classic pipeline, even though the extension handlers were set in my web.config and were showing correctly in IIS. The site worked in Integrated Pipeline so I knew it was a configuration issue, but I couldn't nail it down. I finally found that ASP.NET 4 was disabled for the server in the ISAPI and CGI Restrictions settings. I enabled ASP.NET 4.0 and it worked.
In addition to checking if you're running in integrated pipeline mode, make sure your application pool is set to use .NET! I recently ran into this problem, and when I went in to check the app pool settings, I found that somehow it had been set to "No Managed Code." Whoops!
My Hosting company fixed this for me by doing this (I removed the original password value of course).
<system.webServer>
<security>
<authentication>
<anonymousAuthentication password="<password>" />
</authentication>
</security>
</system.webServer>
Typically I encounter this issue when there is a Routing problem. I compare a working vs non-working to resolve it.
Today however I accidentially created a Virtual Directory in IIS.
It has to be an Application, right click on the Virtual Directory (with a folder icon) -> Convert to Application:
Don't use runAllManagedModulesForAllRequests. You want to let IIS handle resources such as images.
<system.webServer> <!-- Rather do NOT use this -->
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
Instead add the MVC routing module
<system.webServer>
<modules>
<remove name="UrlRoutingModule-4.0" />
<add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="" />
</modules>
</system.webServer>

Facebook C# SDK on ASP.NET MVC 3, Potentially dangerous request

The standard "Potentially dangerous request" is expected, resolve it with [ValidateInput(false)] or something more granular if you wish.
In my case, it happens when I make a call to FbApp.Session. I have a BaseController that all Controllers derive from. In there is an override OnActionExecuting call. Pretty common scenario.
Inside of OnActionExecuting, I use the Facebook C# SDK to manage my use membership. Using if (FbApp.Session != null) is how I check if the user is authenticated.
While running the debugger, it points to the call to FbApp.Session as the source of the exception stating "A potentially dangerous request...", due to HTML in one of the posted request vars - even though the actual action I'm posting to has [ValidateInput(false)] attribute.
What is going on inside the Facebook C# SDK that would cause this behavior? How can this be resolved?
Edit: looks like this could be a bug in ASP.NET MVC 3 RC2 (I haven't upgraded to full release yet). I'll upgrade and report my findings.
The answer is, make sure you're on ASP.NET MVC3 RTM, and have <httpRuntime requestValidationMode="2.0" /> in web.config.

ASP.NET: This method cannot be called during the application's pre-start initialization stage

I'm trying to get an ASP.NET MVC 3 site running on IIS 6.0.
Currently when I request a page from the server it gives the following error:
Parser Error Message: This method cannot be called during the application's pre-start initialization stage.
on this line:
<add name="MyMembershipProvider" type="NS.MyMembershipProvider" connectionStringName="MyDatabase" applicationName="/MySite"/>
I'm completely stumped and don't have much of a clue about the ASP.NET application lifecycle, let alone the differences between 6.0 and 7.0. Reading through the MSDN pages on it hasn't seemed to help much.
Does anyone have any insight or any good links for investigation? :)
Add this in your web.config (in the appSettings section):
<add key="enableSimpleMembership" value="false"/>
<add key="autoFormsAuthentication" value="false"/>
EDIT:
For the ones who ask why, it is a known issue described in the mvc 3 release notes
More details here
After upgrading some of my applications from ASP.NET MVC3 to MVC4 I was getting this error. It was a result of the WebMatrix assemblies (WebMatrix.WebData.dll and WebMatrix.Data.dll). I removed those references and assemblies from the /bin directory and that took care of the issue.
#Ek0nomik is right. We migrated from the MembershipProvider to the new ExtendedMembershipProvider allowing us to take advantage of some of the new functionality offered in the WebMatrix namespace. By default Simple Membership is enabled for some reason so we had to disable it explicitly since we didn't want to go as far as using the SimpleMembershipProvider.
All we had to do was add this to the web.config:
<add key="enableSimpleMembership" value="false"/>
Having Simple Membership enabled caused the Provider initialisation code to execute before the Application_Start handler. Our app structure requires App_Start to be the first thing to execute. Personally I would always expect this but Simple Membership changes this behaviour. Beware.
Well, I just got this error, and it resulted from having accidentally copied a .cshtml into the root of my project. It wasn't even included in the project. Deleted that and the error went away. This was with MVC3 on IIS7. I imagine some of the people getting this problem are in the same boat.
This is caused by any of a number of Reflection calls being made too early in an Application. It just so happens the Web.Config suggestions in other answers prevented one such Reflection call from being made. In my case however:
I'm using Entity Framework, and ran update-database. I got:
This method cannot be called during the application's pre-start initialization phase.
As it turns out we had code that used a library which was recently modified to get all code in all namespaces/projects. Specifically, it called:
System.Web.Compilation.BuildManager.GetReferencedAssemblies()
Kaboom. That caused this obscure error. EF Migrations run in a weirdo zone where the application is half running and half not, meaning the above method can never be called by any code Migrations would call on.

Resources