Question

My model contains a string field called “longdescription” which gets the value of the tinymce editor’s content

Public class ArticleModel:BaseModel{
            [StringLength(8000, ErrorMessage = "Long description must be in 8000 characters or less"), AllowHtml]
    public string LongDescription { get; set; }
}

Here is my controller code

[HttpPost]
public ActionResult AddEdit(ArticleModel model)
{
    string buttonName = Request.Form["Button"];
    if (buttonName == "Cancel")
        return RedirectToAction("Index");

    // something failed
    if (!ModelState.IsValid)
    {

     }

    // Update the articles
  }

My problem is when I use Request.Form to access the post value, it’s working fine without throwing “A potentially dangerous….” error, but when I use Request.Params[“Button”], it threw that errors. Is something I am missing?

Thanks

Updated

Sorry the answer Adam gave doesn’t really answer my question. Can anyone give more suggestion?

Answer 1

It is the HttpRequest.Params getter that is throwing this exception. This getter basically builds and returns a key/value pair collection which is the aggregation of the QueryString, Form, Cookies and ServerVariables collections in that order. Now what is important is that when you use this getter it will always perform request validation and this no matter whether you used the [AllowHtml] attribute on some model property or if you decorated the controller action with the [ValidateInput(false)] attribute and disabled all input validation.

So this is not really a bug in the AllowHtml attribute. It is how the Params property is designed.

As @Adam mentioned in his answer you should avoid accessing request values manually. You should use value providers which take into account things such as disabled request validation for some fields.

So simply add another property to your view model:

public class ArticleModel: BaseModel
{
    [StringLength(8000, ErrorMessage = "Long description must be in 8000 characters or less")]
    [AllowHtml]
    public string LongDescription { get; set; }

    public string Button { get; set; }
}

and then in your controller action:

[HttpPost]
public ActionResult AddEdit(ArticleModel model)
{
    string buttonName = model.Button;
    if (buttonName == "Cancel")
    {
        return RedirectToAction("Index");
    }

    // something failed
    if (!ModelState.IsValid)
    {

    }

    // Update the articles
}