issue with active content

[ochicaud]

Hello,
I encounter a big issue with my DNN site.
I use the 9.10.2 version
I've used DNN for 15 years !

My problem : with html module, I can't create an active content. test is forbidden
Both in html windows and using the riche text editor. With the riche text editore, I can create a link, but I can't save !

I also use a paid component : componentbuilder, from dnngo, And I have the same problem.

I've used both for years without any problem. What can it be ?

Thanks

Olivier C.

[valadas]

Do you have any errors in the browser console (F12 in most browsers) or in the Event log or in the logs located at /Portals/_default/logs ?

[ochicaud]

Hello,
i see my request was not clear. My html was interpreted in the post.
So , an "< a " tag is accepted by the html module is not accepted if there is a href property
without the href, it works. I can save

same thing with onclick property

My html posted looks being filtered. It os refused if it cantains dynamic stuff. Even a link !

In the log, a lot of errors, but nothing happening when I try to save the html in the module.

In the browser windows, YES. 2 errors
1 -
ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5 POST https://cic.chu-limoges.fr/portail/fr-fr/increase_old/ctl/Edit/mid/462?popUp=true 500 (Internal Server Error)
executeRequest @ ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5
executeRequest @ ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5
invoke @ ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5
_onFormSubmit @ ScriptResource.axd?d=ct1HG-wRSUKebRbhos_vcYLiA7S2wc8NPIYFLKEPtvYuCYJZk6sSndK6Gl3nYjf_v1Uf-W5XNYL4AAee-qpYufwmuL0T3Jr6icRGFuLJjhBNuokYb0Vr9i1bSr_kRbCCO9yl7cVG2gbNxM_l0&t=49337fe8:5
_doPostBack @ ScriptResource.axd?d=ct1HG-wRSUKebRbhos_vcYLiA7S2wc8NPIYFLKEPtvYuCYJZk6sSndK6Gl3nYjf_v1Uf-W5XNYL4AAee-qpYufwmuL0T3Jr6icRGFuLJjhBNuokYb0Vr9i1bSr_kRbCCO9yl7cVG2gbNxM_l0&t=49337fe8:5
(anonymous) @ ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5
(anonymous) @ VM14231:1
ScriptResource.axd?d=ct1HG-wRSUKebRbhos_vcYLiA7S2wc8NPIYFLKEPtvYuCYJZk6sSndK6Gl3nYjf_v1Uf-W5XNYL4AAee-qpYufwmuL0T3Jr6icRGFuLJjhBNuokYb0Vr9i1bSr_kRbCCO9yl7cVG2gbNxM_l0&t=49337fe8:5

2 -
Uncaught Sys.WebForms.PageRequestManagerServerErrorException: Sys.WebForms.PageRequestManagerServerErrorException: Une erreur inconnue s'est produite lors du traitement de la demande sur le serveur. Le code d'état retourné à partir du serveur était : 500
at Error.create (https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5:2736)
at Sys.WebForms.PageRequestManager._createPageRequestManagerServerError (https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=ct1HG-wRSUKebRbhos_vcYLiA7S2wc8NPIYFLKEPtvYuCYJZk6sSndK6Gl3nYjf_v1Uf-W5XNYL4AAee-qpYufwmuL0T3Jr6icRGFuLJjhBNuokYb0Vr9i1bSr_kRbCCO9yl7cVG2gbNxM_l0&t=49337fe8:5:11490)
at Sys.WebForms.PageRequestManager._onFormSubmitCompleted (https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=ct1HG-wRSUKebRbhos_vcYLiA7S2wc8NPIYFLKEPtvYuCYJZk6sSndK6Gl3nYjf_v1Uf-W5XNYL4AAee-qpYufwmuL0T3Jr6icRGFuLJjhBNuokYb0Vr9i1bSr_kRbCCO9yl7cVG2gbNxM_l0&t=49337fe8:5:25554)
at Array. (https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5:307)
at https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5:51370
at Sys.Net.WebRequest.completed (https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5:89758)
at XMLHttpRequest._onReadyStateChange (https://cic.chu-limoges.fr/Portail/ScriptResource.axd?d=dyDTs7gNF_naLzz5yrHd6AX0Rr5Tvfr-wRrv1cSE1shssABiJxro1t5-J8joklQk5Oiyr1XZEX15ZhrV09f_wB0gyCaVigI1mlX9e1e5SHb8l_o5yUBPloUi5lasChxrj32Qbg2&t=49337fe8:5:84357)

[valadas]

So part of this issue is that the editor should strip anything you would not be able to do using the toolbars. Another part is security avoiding users to inject scripts or having even hooks for HTML events which could allow for cross site scripting hacks.

For the editor part, you can most of the time get away with it by not using the editor at all (Setting the dropdown to Basic Text Box) and then using either the HTML or Raw modes. This will allow you to do anything you want, bypassing the Editor. But as soon as a new edit is done in the Editor, those "special things" get stripped away again. So you need to be careful and usually it is best to avoid doing code in content anyway...

[ochicaud]

Ok for the js,
but here ,

is refused
while

is accepted

so active content with "a href" is refused

[valadas]

Your example works for me. That may totally depend on your toolbar configuration though. Are you have to create links using the toolbar ?

[ochicaud]

I finally found where the issue came from.
From my IT dpt !

• My server is now behind a reverse proxy.
• The certificate is now on the reverse proxy and not the server. The security gourou says it's better.
• A firewall or another security monster is between the reverse proxy and my server. It filters the decoded content. The javascript, but also the active content like "a href"