Workflow Soluiton

I'm trying to create a form that will allow a user to modify some xml and then submit it.  When I use the Multiline text box I get errors like "System.Web.HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (l2b="<?xml version="1.0" ...")." in the Workflow logs as soon as I have even the most simple of tags present.

This is the same sort as errors as covered here: http://www.symantec.com/connect/forums/html-tag-singlemultiline-text-box-causes-error

The difference is I actually want users to be able to type in or paste content with html or xml style tags and be able to submit them.

I have tried the htmleditor component but this is ugly as it defaults to show the formatted content (I want the html source) and I can't disable the toolbar without also disabling the "Show View Html Button" option as well.

Does anyone have any suggestions?

The error message is originating from .Net (not Workflow), so one way is to tackle that directly:

edit the web.config file in your workflow project and tell .Net that you don't want to validate the data at all.

<configuration> 
  <system.web> 
    <pages validateRequest="false" /> 
  </system.web> 
</configuration>

http://codingstill.com/2013/01/avoiding-the-a-potentially-dangerous-request-form-value-was-detected/

If this works for you, remember to still validate the input in Workflow with - for example -  the ("Find Pattern In String" Component) and some regular expressions, just in case someone decides to feed malicious SQL or something into your form (at least if your input is fed to any kind of database engine)

First I did think of this as well:

1. Allow user to write XML into the multiline text box component and submit the form
2. Then catch the unavoidable .Net exception so that user thinks everything is still OK
3. Then pass the XML to wherever you want (a file on a server of a database table)

But alas, because this is a .Net validation error, we cannot catch it with exception triggers.

Edited by user MHope.

Thanks for the great response MHope.  I noticed you posted a solution regarding javascript elements but then must have edited it out.  Did you ever get this working?  I had a few attempts at this but couldn't quite get what I needed.

Right, I realized that my script did not do what I expected and edited it out.

When I added the custom Javascript to the form buider's body_onLoad section, it did have some effect to the html editor box (which is actually Karamasoft's Ultimate Editor, I believe?) but then I realized that the script only affected the appearance of the html editor, not the functionality. So even though - when the form loads - the editor looks like it has switched to html view, but in reality it still handles the input in design view.

So apparently this script does not affect the behavior but only the way the tool looks. It goes to the form builder's Body Custom Event's onLoad:

document.getElementById("MyHTMLEditorHTMLTab").className = "EditorTabOn";
document.getElementById("MyHTMLEditorDesignTab").className = "EditorTabOff";

And the script above requires that you give your "Html Editor" component the Control ID MyHTMLEditor

If you're interested in trying to reverse engineer the solution for this, debug or publish a web forms project with a Html Editor component in it and then open the source code of the web page. The class names and elements can be found there. Then just begin your "success though trial and error" loop....

Edit: fixed a typo.

Changing the behavior of the Html Editor starts to look a little complicated.

If you look at the html source of the actual browser page, below is the part of the initialization of the html editor's tabs and I'm not sure if you can get to between them and the form loading....

The last boolean variable seems to define whether the tab is selected or not:

            new Array(
                new UltimateEditorTab(
                    "MyHTMLEditorDesignTab",
                    EDIT_MODE_DESIGN,
                    true,
                    true),
                new UltimateEditorTab(
                    "MyHTMLEditorHTMLTab",
                    EDIT_MODE_HTML,
                    true,
                    false)
                )
            )

These initialization values are probably either in the UltimateEditor.js located on your workflow server or encoded into the actual Html Editor Component dll... in either way, it would require much more studying or previous knowledge in order to not cripple all the other workflow projects on your server that might depend on the Html Editor.

Edit: and you lose all the modifications when you update your Workflow Solutions to the next version.

Did disabling the .Net validation work? Or are you looking for some other type of solution?

Edited by user MHope.

Unfortunately no - the validation didn't work.  I changed web.config in the Resources tab in the project properties and still get the same error message in debug.  The multiline text box is in a sub-dialog component in case that matters.  

I tried adding this tag: <httpRuntime requestValidationMode="2.0"/> as per the link but this just caused the debug to hang.

Ok. I'm guessing your environment is WF 7.6 and .Net 4.* (since you tried the requestValidationMode="2.0")?. My test server runs WF 7.5.3* and has .Net 3.5.1 role service installed.

Do you debug on a client workstation or on the workflow server? What about if you publish your workflow with the modified web.config? Does it make a difference to the behavior of the workflow?