Question

I am using TinyMce on a custom module.
on Save I get the potentially dangerous Request.Form Error.

I know why and what it means, but don’t know, what the recommended solution is.

I already found

 <httpRuntime requestValidationMode="2.0"/> 

in web.config of my Orchard-root

Is this safe to use

[ValidateInput(false)]
public class AdminController : Controller {

on top of my Controller?

How is this solved on other Orchard Modules that use TinyMce, like Blog-Types?

Thnx
Reinhard

Answer 1

Look at the AdminController in Orchard’s core module. Full type is Orchard.Core.Contents.Controllers.AdminController.

It has the attribute that you mentioned…

[ValidateInput(false)]

So, as long as you’re careful about what you accept and what you do with it, you can be safe to go that route.

I should mention though, that it’s rare to need a new controller in Orchard. It also sounds like you should just use the BodyPart for what you’re building. BodyPart can use many flavors.. plain text, html, markdown, and anything you would like to implement yourself.