The viewstate or application's pages are already encrypted but looking at the Burp output of the response from a POST to the Telerik.UI.DialogHandler (ImageMananger) it seems the Telerik view state in the response appears not to be. See attached image.
Burp output
We've generated and specified the DialogParametersEncryptionKey, ConfigurationEncryptionKey, and ConfigurationHashKey keys in the site level web.config as described in article https://docs.telerik.com/devtools/aspnet-ajax/controls/editor/functionality/dialogs/security. This didn't change the viewstate.
The machine key in IIS is set for auto-generation.
I'm only assuming the Telerik viewstate can be encrypted because what I've read seems to imply that, but I haven't found a clear example so I'm not sure.
Can you please change the TargetFramework of the application to 4.5 or above and test again:
> <compilation debug="false" targetFramework="4.8" />
> <httpRuntime targetFramework="4.8" />
> <pages viewStateEncryptionMode="Always" enableViewStateMac="true">
> <controls>
> <add tagPrefix="telerik" namespace="Telerik.Web.UI" assembly="Telerik.Web.UI" />
> </controls>
> </pages>
> <httpHandlers>
It is also a must to set viewStateEncryptionMode="Always" enableViewStateMac="true" in the page directive or the web.config.
Check out this product forum thread for more information: https://www.telerik.com/forums/can-the-rad-editor-viewstate-be-encrypted.
I am receiving an error that ends with:
Trace requires that...
How can we turn off trace for the whole web application? Here is the full error message:
Multiple controls with the same ID 'x$x$xxxYyyyyZzzzzzzz$ctl00$ctl01' were found. Trace requires that controls have unique IDs.
We only need to disable tracing if it was enabled in the first place.
<configuration>
<system.web>
<trace enabled="true" pageOutput="false" requestLimit="40" localOnly="false"/>
</system.web>
</configuration>
I.e. change the above to enabled="false" and we're done.
See also: https://msdn.microsoft.com/en-us/library/0x5wc973%28v=vs.140%29.aspx
I am in the process of adding RequiredFieldValidators into my form and just tested it on the web and received this error
Error
WebForms UnobtrusiveValidationMode requires a ScriptResourceMapping for 'jquery'. Please add a ScriptResourceMapping named jquery(case-sensitive).
I added the solution which was this in the web.config file:
<appsettings> <add value="None" key="ValidationSettings:UnobtrusiveValidationMode"></add> </appsettings>
But that prompted this error
Error
HTTP Error 500.19 - Internal Server Error
This last error is saying something is wrong with the solution I inputted above.. Has anyone else ever run into this and have a solution?
Hope you have set targetFramework to 4.5 . The full config should look like this.
<configuration>
<appSettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="None"></add>
</appSettings>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
</configuration>
If this key value is set to "None" [default], the ASP.NET application will use the pre-4.5 behavior (JavaScript inline in the pages) for client-side validation logic. If this key value is set to "WebForms", ASP.NET uses HTML5 data-attributes and late bound JavaScript from an added script reference for client-side validation logic.
Reminder: <appSettings> parent in the web.Config file should be the root element, that is <configuration>.
Helpful links - http://www.codeproject.com/Articles/465613/WebForms-UnobtrusiveValidationMode-requires-a
http://msdn.microsoft.com/en-us/library/system.web.ui.unobtrusivevalidationmode.aspx -- This says it a feature of v4.5, you should have to specify targetFramework = 4.5 in cofig to make it work.
I a trying to add New Master Page in fresh project throw 'Add new Items" while adding i have this Error "Data at the root level is invalid. Line 1. Position 1"
How to solve this please ?
my web.config
<?xml version="1.0"?>
<!--
For more information on how to configure your ASP.NET application, please visit
http://go.microsoft.com/fwlink/?LinkId=169433
-->
<configuration>
<system.web>
<compilation debug="false" targetFramework="4.0" />
</system.web>
</configuration>
Okay, I can reproduce your error in my environment.
The problem is occured if you have an invalid XML file in your project. Probably the web.config.
Can you confirm that the XML files in your project is well formed? Try to open the XML file using IE and ensuring that there are no errors.
I made a web.config (full file, it doesn't show XML errors)
<?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
<configSections>
...
<location path="." inheritInChildApplications="false">
<connectionStrings>
<add name="ElmahLog" connectionString="data source=~/App_Data/Error.db" />
<add name="database" connectionString="w" providerName="System.Data.EntityClient"/>
</connectionStrings>
</location>
...
with a transform file (web.Staging.config)
<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
<connectionStrings>
<add name="database"
connectionString="c"
providerName="System.Data.EntityClient"
xdt:Transform="SetAttributes" xdt:Locator="Match(name)" />
</connectionStrings>
<system.web>
<compilation xdt:Transform="RemoveAttributes(debug)" />
<customErrors defaultRedirect="error.aspx"
mode="RemoteOnly" xdt:Transform="Replace">
</customErrors>
</system.web>
</configuration>
I am publishing in Staging mode (right click website > Publish > Method: File System ...)
------ Build started: Project: Drawing, Configuration: Staging Any CPU ------
Drawing -> D:\Project\bin\Staging\Drawing.dll
------ Build started: Project: MySystem, Configuration: Staging Any CPU ------
MySystem -> D:\Project\bin\Staging\MySystem.dll
...
But when I look at the web.config in the output folder it isn't changed.
I found the following on the Build log:
D:\Project\Web.Staging.config(3,2): Warning : No element in the source document matches '/configuration'
D:\Project\Web.Staging.config(3,2): Warning : No element in the source document matches '/configuration'
D:\Project\Web.Staging.config(3,2): Warning : No element in the source document matches '/configuration'
Transformed web.config using Web.Staging.config into obj\Staging\TransformWebConfig\transformed\web.config.
What could be the problem? Am I doing this right?
Answering late but perhaps I can save someone a headache. In Visual Studio 2013, there are two places to select configuration for your build and deploy. The Configuration Manager and then again with Publish Web where the third step in the Wizard entitled Settings allows you to select Config you want to use. If you don't select your new configuration it will use the transform for the selected configuration instead of yours.
I found out two things:
You cannot set a namespace on the <configuration> tag (ex: for <location path="." inheritInChildApplications="false">)
You have to watch for the correct hierarchy in the transform file.
Like
<configuration>
<location>
<connectionStrings>
Instead of
<configuration>
<connectionStrings>
Ensure that in the properties of the Web.Config file Build Action is set to Content.
If the build action is set to None, it will not be transformed, even if it is being copied to the output directory.
Make sure to include InsertIfMissing if the section you are trying to add does not already appear in the output.
<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
<location>
<system.webServer>
<security xdt:Transform="InsertIfMissing">
<requestFiltering allowDoubleEscaping="true" />
</security>
</system.webServer>
</location>
</configuration>
Don't forget to copy all the other attributes of "configuration" from the original "web.config", as it seems that VS2012 doesn't do it automatically and of course there will be no match...
Answering late as well, but this may help someone.
I realized that if you have two websites in the same solution, when you try to publish one of them the transformation might not work if you have one only configuration for both projects.
One of my websites was always transforming, but the other sometimes was and sometimes wasn't.
For example, I had the configuration "Auto" in the solution, and had web.Auto.config for both websites.
I resolved that by creating a new configuration with a different name - "AutoAdmin" - creating also its web.AutoAdmin.config file for the second project, and when I published it again the transformation finally occurred.
I followed the below steps to fix this issue. Thanks, #michaelhawkins for pointing in the right direction. You need to make sure you change the configuration to release in two places.
And right click on your project and select "Properties". IF not working try selecting x86 in CPU Architecture
#Karthikeyan VK your post resolved my issue. Although I was selecting Production configuration in my publish profile, in configuration manager it was set to dev therefore It didn't transform my settings.
Microsoft needs to fix this bug. Once you pick a configuration in the publishing profile it should automatically update the configuration manager as well.