Welcome Guest! To enable all features please Login or Register.

Notification

Icon
Error

YouTube Embed Code
bobsts
#1 Posted : Monday, 9 November 2009 2:42:48 PM(UTC)
Rank: Member

Joined: 19/04/2009(UTC)
Posts: 8
Location: Ohio

I cannot get the YouTube embed code to work. It seems to be due to the security issue with Request Validation. I went to the administration guide and it says:

You can enable HTML input on the Membership - User Settings page in the Site admin area, as seen here:

In the user guide it shows antoher check box for Java Script but I don't see that. I also don't see the boxes that contain the allowed tags. However, if I hover over the question mark, then I see that info.

But, when I check the box then try to use the embed code it still throws an exception.

Is this what I should see?

Thanks,
Bob

Oh...
I"m getting this error:
A potentially dangerous Request.Form value was detected from the client (ctl00$mainContent$gallery1$ctl00$txtExternalHtmlSource="<object width="425" ...").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (ctl00$mainContent$gallery1$ctl00$txtExternalHtmlSource="<object width="425" ...").

Roger Martin
#2 Posted : Monday, 9 November 2009 11:39:22 PM(UTC)
Roger Martin

Rank: Administration

Joined: 3/08/2007(UTC)
Posts: 3,301
Location: Fort Atkinson, WI

You have request validation enabled, which is the default in a ASP.NET web app. In GSP I turn it off in web.config:

<pages theme="" styleSheetTheme="" validateRequest="false">

You can do the same, or you can do it on the .aspx page that hosts the gallery.
Roger Martin
Creator and Lead Developer of Gallery Server Pro
bobsts
#3 Posted : Tuesday, 10 November 2009 11:08:38 AM(UTC)
Rank: Member

Joined: 19/04/2009(UTC)
Posts: 8
Location: Ohio

Roger this works, but is it a safe thing to do? Thanks,
Bob
Roger Martin
#4 Posted : Tuesday, 10 November 2009 1:08:00 PM(UTC)
Roger Martin

Rank: Administration

Joined: 3/08/2007(UTC)
Posts: 3,301
Location: Fort Atkinson, WI

It is safe as long as you have a smart programmer checking all the input. This *has* to be turned off in any ASP.NET app where you want to be able to enter HTML in a textbox, so we don't really have a choice. But rest assured I am diligent about validating all the input and am confident it is secure.

You will notice that even with this setting disabled you are still severely restricted as to the HTML that can be entered for an external object. To enter a YouTube snippet, you will have to add a few tags to a couple settings in the Site admin area. Go ahead and try it and follow the directions in the error message.

Also note that you cannot enter *any* HTML for album/media object captions (there is a setting to turn this on, though).

To learn more about how GSP filters HTML input read this blog entry.
Roger Martin
Creator and Lead Developer of Gallery Server Pro
mk1 black limited
#5 Posted : Wednesday, 22 September 2010 3:10:59 AM(UTC)
Rank: Member

Joined: 7/08/2010(UTC)
Posts: 16
Location: Norway

Just a quick note about .NET 4: You also need to add this to web.config:

<httpRuntime requestValidationMode="2.0" />
Roger Martin
#6 Posted : Wednesday, 22 September 2010 7:14:09 AM(UTC)
Roger Martin

Rank: Administration

Joined: 3/08/2007(UTC)
Posts: 3,301
Location: Fort Atkinson, WI

Thanks for letting me know about that. I'll make sure it is in the .NET 4 versions of web.config in the next release.
Roger Martin
Creator and Lead Developer of Gallery Server Pro
Rss Feed  Atom Feed
Users browsing this topic
Guest
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.