Potentially dangerous value, error wont go away - asp.net

"A potentially dangerous Request.Form value was detected from the client"
I know the reason why I am getting this error screen, and I have read thru all the other questions asked here, and most answers along with the suggestion on the error screen says to put:
<httpRuntime requestValidationMode="2.0" />
and
<pages validateRequest="false" />
in the Web.Config file, which I have done, as you can see here:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<httpRuntime requestValidationMode="2.0" /><pages validateRequest="false" />
<compilation debug="true" targetFramework="4.0"><assemblies><add assembly="System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /></assemblies></compilation>
<customErrors mode="Off" />
</system.web>
<system.data>
<DbProviderFactories>
<remove invariant="System.Data.SqlServerCe.4.0" />
<add invariant="System.Data.SqlServerCe.4.0" name="Microsoft® SQL Server® Compact 4.0" description=".NET Framework Data Provider for Microsoft SQL Server Compact" type="System.Data.SqlServerCe.SqlCeProviderFactory, System.Data.SqlServerCe, Version=4.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91" />
</DbProviderFactories>
</system.data>
</configuration>
I am using asp.net in Webmatrix 2.0 if that is of any help. I have searched everywhere to find a different solution but every one is saying the validation mode and validate request thing, and still it's not working, does anyone know any other possible reasons as to why?

With Web Pages you can switch Request Validation off for an individual form field using the Request.Unvalidated() method.
Read the "HTML Input And XSS Attacks" chapter of this good Mike Brind's article: WebMatrix - Protecting Your Web Pages Site.

Related

Spurious pathname for ASP.Net graph

I'm generating a graph in an ASP.Net application. To this end I have included the chart control in the ASPX file like this:-
<asp:Chart ID="ourChart"
runat="server"
Height="500px"
width="520px"
BackColor="Black"
ImageLocation="~/GraphTempFiles/ChartPic_#SEQ(300,3)"
ImageStorageMode="UseImageLocation"
ImageType="Bmp">
and have added what I believe to be the requisite features to the web.config:-
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<modules runAllManagedModulesForAllRequests="true"/>
<handlers>
<add name="ChartImg"
verb="*" path="ChartImg.axd"
type="System.Web.UI.DataVisualization.Charting.ChartHttpHandler, System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</handlers>
</system.webServer>
<appSettings>
<add key="ChartImageHandler"
value="storage=file;timeout=20;Url=~/GraphTempFiles;" />
</appSettings>
The result of all this is that the page displays with a server error in the application:-
Could not find a part of the path
'\MyDisk\MyDirectory\MyProgram\(S(32rdrd5zxhvc3rhq2szdxv2w))\GraphTempFiles\ChartPic_000001.bmp'.
Does anyone know what the matter is? (Presumably I am not supposed to create a directory (S(32rdrd5zxhvc3rhq2szdxv2w)) at any point; the number in the brackets varies each time I run it.)
I am using Visual Studio 2013 on Windows 8.1, with Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.34248, as it says at the bottom of the page.
Most probably this error occurs since ASP.NET Cookieless Feature is enabled in web.config file like this:
<sessionState mode="InProc" cookieless="UseUri" timeout="60" />
According Understand How the ASP.NET Cookieless Feature Works to :
UseUri: The cookieless feature will always be used.
In that case Url may look like this: http://mysite/MyWebApp/(S(XXXX))/home.aspx
There are at least two options available to resolve it:
Option 1, disable Cookieless Feature, use, for example, default settings for sessionState element:
<sessionState mode="InProc" customProvider="DefaultSessionProvider">
<providers>
<add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection"/>
</providers>
</sessionState>
Option 2, specify the relative physical path for ImageLocation property of Chart control, for example:
<asp:Chart ID="ourChart"
runat="server"
Height="500px"
width="520px"
BackColor="Black"
ImageLocation="GraphTempFiles/ChartPic_#SEQ(300,3)"
ImageStorageMode="UseImageLocation"
ImageType="Bmp"/>

•Request filtering is configured for the Web server and the file extension for this request is explicitly denied

HTTP Error 404.7 - Not Found
The request filtering module is configured to deny the file extension.
I am using Visual studio 2013 web express. When I running Defalt.aspx its running fine but when i run materpage.master it throw me this error. I tried a lots of solution and its still not working( i tried to change the web.conf). Anyone know what can I do for this issues>?
code for web.conf
<configuration>
<connectionStrings>
<add name="ConnectionString" connectionString="Provider=MSDAORA;Data Source=XE;Password=1234;User ID=System"
providerName="System.Data.OleDb" />
<add name="databaseString" connectionString="Provider=OraOLEDB.Oracle.1;Data Source=XE;Persist Security Info=True;Password=1234;User ID=system"
providerName="System.Data.OleDb" />
<add name="SOConnectionString" connectionString="Provider=OraOLEDB.Oracle.1;Data Source=XE;Persist Security Info=True;Password=1234;User ID=so"
providerName="System.Data.OleDb" />
</connectionStrings>
<system.web>
<compilation debug="true" targetFramework="4.5.1" />
<httpRuntime targetFramework="4.5.1" />
</system.web>
You don't directly access master pages. You access a content page (.aspx) that references a master page.

ASP.Net Does NOT accept <appsettings> tag

I am new to ASP.NET. I added following code to solve Validation Controls problem:
<appsettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="WebForms">
</add></appsettings>
But creating new bugs with adding this. Getting Error "HTTP Error 500.19" with this information:
The requested page cannot be accessed because the related configuration data for the page is invalid.
The configuration section 'appsettings' cannot be read because it is missing a section declaration.
Error Code: 0x80070032
My web.config content is simply this:
<?xml version="1.0"?>
<!--
For more information on how to configure your ASP.NET application, please visit
http://go.microsoft.com/fwlink/?LinkId=169433
-->
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
<appsettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="WebForms">
</add></appsettings>
</configuration>
I searched the web and didn't find a specific solution for this issue. And as I saw in related articles such errors may have many reasons. I don't know which one causing mine.
XML is case sensitive. You are looking for <appSettings>, not <appsettings>:
<appSettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="WebForms" />
</appSettings>
You can make the add element self-closing, but that is just a little nice syntactic sugar that isn't required.
More documentation about the appSettings element can be found on MSDN.
Your add tag should be self-terminating, but as vcsjones points out, your issue is likely case sensitivity of <appSettings> (not <appsettings>)
<appSettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="WebForms"/>
</appSettings>

Should I remove unused bits out of Web.config?

My current WebMatrix web site is very basic - it simply shows mostly static context, photos, and contains a few links. Many things are referenced in Web.config that I don't use in this site, such as support for SqlServerCe. Should I remove those things references, for performance purposes, or does it not matter to leave them in? I don't think I'm using the OAuth stuff, either (not deliberately, anyway), and I don't know about "WebGrease," etc.
I also wonder about removing StarterSite.sdf
You can delete almost everything from it. Mine looks like this:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<compilation targetFramework="4.5">
<assemblies>
<add assembly="System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
<add assembly="System.Net.Http.WebRequest, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
<add assembly="System.Data.SqlServerCe, Version=4.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91" />
</assemblies>
</compilation>
<httpRuntime targetFramework="4.5" />
</system.web>
</configuration>
Your assemblies can differ or miss.

Deploying website: 500 - Internal server error

I am trying to deploy an ASP.NET application. I have deployed the site to IIS, but when visiting it with the browser, it shows me this:
Server Error
500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.
After fiddling around with the web.config, I got:
The page cannot be displayed because an internal server error has occurred.
How can I see the actual issue behind this server error?
First, you need to enable and see detailed errors of your web messages, because this is a general message without giving information on what's really happening for security reasons.
With the detailed error, you can locate the real issue here.
Also, if you can run the browser on the server, you get details on the error, because the server recognizes that you are local and shows it to you. Or if you can read the log of the server using the Event Viewer, you also see the details of your error.
###On IIS 6
<configuration>
<system.web>
<customErrors mode="Off"/>
<compilation debug="true"/>
</system.web>
</configuration>
###On IIS 7
<configuration>
<system.webServer>
<httpErrors errorMode="Detailed" />
<asp scriptErrorSentToBrowser="true"/>
</system.webServer>
<system.web>
<customErrors mode="Off"/>
<compilation debug="true"/>
</system.web>
</configuration>
Note: You can avoid the Debug=true. You only need to close the custom errors for a while and get the detailed error page.
This can help: How to enable the detailed error messages (from IIS).
I was pulling my hair out over this issue. Making sure the following entry was in the root web.config file fixed it for me:
<configuration>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
</system.webServer>
</configuration>
Remember that you have to add this to the existing XML elements, if they're already there. You can't just add at the end of the file, because you can't have multiple copies of any element.
For me, the following code in the web.config was the culprit. When I removed it, the web site worked fine.
<staticContent>
<mimeMap fileExtension=".mp4" mimeType="video/mp4" />
</staticContent>
I finally solved this "500 Internal server" error when deploying the ASP.NET MVC 3.0 application on godaddy.ocm shared hosting.
somehow there were discrepancies on the version of DLL files referenced and version mentioned in file web.config.
I tried all the options mentioned in various forum. Nothing helped, although everyone suggested the same kind of fix, but somehow it didn't work in my scenario. Finally after banging my head for two days.
I decided to delete all DLL file reference and delete web.cofig (make a local copy) from the project and let the application throw the error and then add the DLL files one by one making copy to local=true.
After all the DLL files were added, I created a new ASP.NET MVC application and copied the web.config of new application to my actual application.
So my actual application now has a new web.config, and then I copied the connectionstring and other references from the local copy of web.config that I saved.
I just compiled the application and published to a local folder
and FTP the published folder to goDaddy.
It worked and finally my problem was solved.
In my case, I put a mistake in my web.config file. The application key somehow was put under the <appSettings> tag. But I wonder why it doesn't display a configuration error. The error 500 is too generic for investigating the problem.
My first attempt to publish and then run a very simple site serving only HTML produced "The page cannot be displayed because an internal server error has occurred."
The problem: I had the site set to .NET 3.5 in Visual Studio (right click web site project -> Property Pages -> Build), but had the Web Site in Azure configured as .NET 4.0. Oops! I changed it to 3.5 in Azure, and it worked.
In addition to the other suggestions, make sure to change the existingResponse attribute of the httpErrors node to Auto from Replace, or to remove that property entirely.
<httpErrors existingResponse="Replace" />
^^^^^^^ not going to work with this here
Server Error 500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed. Goddady. Hosting - Web - Economy - Windows Plesk
In my case, I replace this code:
<configuration>
<system.webServer>
<httpErrors errorMode="Detailed" />
<asp scriptErrorSentToBrowser="true"/>
</system.webServer>
<system.web>
<customErrors mode="Off"/>
<compilation debug="true" targetFramework="4.0"/>
</system.web>
</configuration>
Then change framework 3.5 to framework 4. It shows my detailed error. I delete code in:
<httpModules></httpModules>
It solved my problem.
IIS also reports status code 500 without any event log hints if there are insufficient permissions on the physical home directory (i.e. IIS_IUSRS has no access).
For IIS 10 There is a extra step to do other than changing the customErrors=Off to show the error content.
<system.web>
<customErrors mode="Off" />
</system.web>
<system.webServer>
<httpErrors existingResponse="PassThrough" errorMode="Detailed"/>
</system.webServer>
Raul answered the question in this link Turn off IIS8 custom errors by Raul
Probably your web.config file is wrong or is missing some tag. I solved my problem using the correct config tags for .NET 4.
<system.web>
<compilation debug="true" strict="false" explicit="true" targetFramework="4.0">
<assemblies>
<add assembly="System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
<add assembly="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
<add assembly="System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
<add assembly="System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
<add assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
<add assembly="System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
<add assembly="System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
<add assembly="System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
<add assembly="System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
</assemblies>
</compilation>
<pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID">
<namespaces>
<clear/>
<add namespace="System"/>
<add namespace="System.Collections"/>
<add namespace="System.Collections.Specialized"/>
<add namespace="System.Configuration"/>
<add namespace="System.Text"/>
<add namespace="System.Text.RegularExpressions"/>
<add namespace="System.Web"/>
<add namespace="System.Web.Caching"/>
<add namespace="System.Web.SessionState"/>
<add namespace="System.Web.Security"/>
<add namespace="System.Web.Profile"/>
<add namespace="System.Web.UI"/>
<add namespace="System.Web.UI.WebControls"/>
<add namespace="System.Web.UI.WebControls.WebParts"/>
<add namespace="System.Web.UI.HtmlControls"/>
</namespaces>
</pages>
<authentication mode="None"/>
</system.web>
I realized the permissions for the files and folders in your server also matter. I uploaded my files from a linux operating system and usually the permissions are limited for read and write. So when uploaded, the permission are still same as in the local machine.
I had the same error and i just changed the permissions for the folder i had uploaded and the error was gone.
Hope it helps someone.
500 Internal Error
Windows Hosting Error
Godaddy Hosting issue
I have been facing the same issue, but now my issue has been resolved. Always use in this hosting this it works.
I will also recommend you all to do whatever changes you are looking to make in your web.config file. Please do it one by one and test the same on the live domain so that you can find the exact problem or the features that your hosting provider does not allow you to use.
<?xml version="1.0"?>
<configuration>
<system.web>
<trust level="Medium"/>
<compilation debug="true" targetFramework="4.5">
<assemblies>
<add assembly="System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
</assemblies>
</compilation>
<httpRuntime targetFramework="4.5" />
<sessionState mode="InProc" cookieless="false" timeout="90" />
<authentication mode="Forms">
<forms loginUrl="default.aspx"
defaultUrl="default.aspx"
protection="All"
cookieless="UseCookies"
slidingExpiration="false"
timeout="30"
name="aeon.corpusjuris.in" />
</authentication>
<customErrors
mode="Off"
defaultRedirect="errorpage.aspx">
<error statusCode="403" redirect="errorpage.aspx"/>
<error statusCode="404" redirect="errorpage.aspx"/>
</customErrors>
<!-- <httpModules>
<add name="HTTPCaching" type="HTTPCaching"/>
</httpModules>
-->
</system.web>
<runtime>
<performanceScenario value="HighDensityWebHosting" />
</runtime>
<system.webServer>
<!-- <modules runAllManagedModulesForAllRequests="true">
<add name="HTTPCaching" type="HTTPCaching"/>
</modules>
-->
<defaultDocument>
<files>
<clear />
<add value="default.aspx" />
</files>
</defaultDocument>
<httpErrors errorMode="Detailed" />
<asp scriptErrorSentToBrowser="true"/>
<staticContent>
<clientCache cacheControlCustom="public"
cacheControlMaxAge="60:00:00"
cacheControlMode="UseMaxAge" />
</staticContent>
</system.webServer>
<system.web.extensions>
<scripting>
<webServices>
<jsonSerialization maxJsonLength="90000000">
</jsonSerialization>
</webServices>
</scripting>
</system.web.extensions>
</configuration>
If you're using a custom HttpHandler (i.e., implementing IHttpModule), make sure you're inspecting calls to its Error method.
You could have your handler throw the actual HttpExceptions (which have a useful Message property) during local debugging like this:
public void Error(object sender, EventArgs e)
{
if (!HttpContext.Current.Request.IsLocal)
return;
var ex = ((HttpApplication)sender).Server.GetLastError();
if (ex.GetType() == typeof(HttpException))
throw ex;
}
Also make sure to inspect the Exception's InnerException.
500 internal server error can arise due to several reasons. First reason might be that web.config file is not properly created, means you have missed some tag in the web.config file. Secondly this error can be due to some code problem. To check which component of the web application is causing this error you can check Application setting in web.config file. The detail of solving and tracing 500 internal server error with diagram is given here:
Make sure your account uses IIS 7. For more information, see Customizing IIS Settings on Your Windows Hosting Account.
Follow the instructions in Changing Pipeline Mode on Your Windows IIS 7 Hosting Account. Select Integrated Pipeline Mode.
In your Project References section, set Copy Local to True for the following assemblies:
System.Web.Abstractions
System.Web.Helpers
System.Web.Routing
System.Web.Mvc
System.Web.WebPages
Add the following assemblies to your project, and then set Copy Local to True:
Microsoft.Web.Infrastructure
System.Web.Razor
System.Web.WebPages.Deployment
System.Web.WebPages.Razor
Publish your application.
Sometimes, the reason might be one of your .dll assemblies is not registered correctly on the server.
For example, you can successfully run a C# Excel web application on your local machine with Office installed, while getting the 500 error on server deployment, because there is no Office suite installed on the server, and thus you get the server error.
For those who have this possibility (VPS hosting not web hosting):
Connect to your hosting server via Remote Desktop. Open Web Browser from your remote desktop and you will see the detail description of the error.
You don't need to modify web.config or expose any details to anybody else.
If you are using IIS 8.5 it may be that you need to change the ApplicationPool ID setting from ApplicationPoolId to NetworkService
Right click the Application Pool in question, click on "Advanced Settings" and then scroll down to ID - it will probably be set to ApplicationPoolIdentity. Click the button (..) and select NetworkService from the dropdown list instead.
Also make sure that if it is a .NET 2.0 application that you are not referencing the 4.0 framework in your App Pool.
Before changing the web.config file, I would check that the .NET Framework version that you are using is exactly (I mean it, 4.5 != 4.5.2) the same compared to your GoDaddy settings (ASP.Net settings in your Plesk panel). That should automatically change your web.config file to the correct framework.
Also notice that for now (January '16), GoDaddy works with ASP.Net 3.5 and 4.5.2. To use 4.5.2 with Visual Studio it has to be 2012 or newer, and if not 2015, you must download and install the .NET Framework 4.5.2 Developer Package.
If still not working, then yes, your next step should be enabling detailed error reporting so you can debug it.
I recently got into same problem, the disk space was full on the server. Clearing some space has resolved the issue.
Try compiling in Debug mode (in Visual Studio). If you are in Release mode, a lot of URL Rewrite errors will not be available.
Image shows the Debug selection combobox in Visual Studio

Resources