Changeset 1172

Timestamp:

2007-12-04 13:26:38 (8 months ago)

Author:

fredck

Message:

Fixed #294 : The HtmlEncodeOutput setting is enforced by the editor component, to avoid having to set ValidateRequest="false" on pages using the editor.

Location:

FCKeditor.Net/trunk

Files:

• FCKeditorConfigurations.cs (modified) (1 diff)
• FCKeditor.cs (modified) (2 diffs)
• _whatsnew.html (modified) (1 diff)

FCKeditor.Net/trunk/FCKeditorConfigurations.cs

@@ -70 +70 @@
                         }
 
+                        // To avoid the "A potentially dangerous Request.Form value was
+                        // detected from the client" error, forcing developers to set
+                        // validateRequest=false in their pages, we are forcing
+                        // HtmlEncodeOutput to "true", if not defined. (#294)
+                        if ( !_Configs.Contains( "HtmlEncodeOutput" ) )
+                        {
+                                if ( osParams.Length > 0 )
+                                        osParams.Append( "&" ) ;
+
+                                osParams.Append( "HtmlEncodeOutput=true" ) ;
+                        }
+
                         return osParams.ToString() ;
                 }

FCKeditor.Net/trunk/FCKeditor.cs

@@ -321 +321 @@
                 }
 
+                [Category( "Configurations" )]
+                public bool HtmlEncodeOutput
+                {
+                        set { this.Config[ "HtmlEncodeOutput" ] = ( value ? "true" : "false" ); }
+                }
+
                 #endregion
 
@@ -446 +452 @@
                 public bool LoadPostData(string postDataKey, System.Collections.Specialized.NameValueCollection postCollection)
                 {
-                        if ( postCollection[postDataKey] != this.Value )
-                        {
-                                this.Value = postCollection[postDataKey] ;
+                        string postedValue = postCollection[postDataKey] ;
+
+                        // Revert the HtmlEncodeOutput changes.
+                        if ( this.Config["HtmlEncodeOutput"] != "false" )
+                        {
+                                postedValue = postedValue.Replace( "&", "&" ) ;
+                                postedValue = postedValue.Replace( "&lt;", "<" ) ;
+                                postedValue = postedValue.Replace( "&gt;", ">" ) ;
+                        }
+
+                        if ( postedValue != this.Value )
+                        {
+                                this.Value = postedValue ;
                                 return true ;
                         }

FCKeditor.Net/trunk/_whatsnew.html

@@ -52 +52 @@
                         the <strong>FCKeditor.CreateHtml</strong> function, which returns the HTML needed
                         to create an editor instance in the page.</li>
+                <li>[<a target="_blank" href="http://dev.fckeditor.net/ticket/294">#294</a>] The HtmlEncodeOutput
+                        setting is enforced by the editor component, to avoid having to set ValidateRequest="false" on pages using the editor.</li>
         </ul>
         <p>