Answers

• airmaster Posts: 72Questions: 15Answers: 2

  November 2019

  I did try the [AllowHtml] tag on the field, but this is bypassed. Maybe datatables calls the validation routine separately.
• allan Posts: 63,535Questions: 1Answers: 10,475 Site admin

  November 2019

  In .NET Framework you can use the UnvalidatedRequestValues values. You access that from the Request object using request.Unvalidated.

  Allan
• airmaster Posts: 72Questions: 15Answers: 2

  November 2019

  Okay, for MVC I did this: var request = HttpContext.Request.Unvalidated.Form;

  Although given the quite limited access to my tool, I am unlikely to have any security issues...am I potentially exposting myself to any issues doing this? Also, why didn't the [AllowHtml] tag not work?
• airmaster Posts: 72Questions: 15Answers: 2

  November 2019

  Am I correct, looking at the actual DB entries, that Datatables takes care of this automatically?

  I did take a look at the documentation, but I didn't know about the Unvalidated option.
• allan Posts: 63,535Questions: 1Answers: 10,475 Site admin

  November 2019

  Also, why didn't the [AllowHtml] tag not work?

  The reflection we use in Editor doesn't currently look for that attribute. I actually wasn't aware of it! I've added it to the list.

  Am I correct, looking at the actual DB entries, that Datatables takes care of this automatically?

  Yes it should. However, the Microsoft XSS protection is quite aggressive so if you want to be certain the data is not transformed us the Field.Xss() method - see here.

  Allan
• airmaster Posts: 72Questions: 15Answers: 2

  November 2019

  I am not sure how to use the Field.Xss method. Is that server or client side? The link to the .NET side is dead.
• allan Posts: 63,535Questions: 1Answers: 10,475 Site admin

  November 2019

  Sorry - its server-side. The API reference for it is here.

  You'd use something like:

  var editor = new Editor(...)
    .Model<...>()
    .Field(
      new Field('myField').Xss(false)
    );
  

  Allan