Server Validation failure issue in HTML Editor

Using Server Validation from CSS Form builder or Form Toolkit on an HTML Editor instance, when validation fails, the HTMLEditor content will be encoded.


to fix the issue, edit the webassist/form_validation/wavt_validatedform_php.php file. change:

return str_replace("<","&lt;",str_replace(">","&gt;",str_replace('"',"&quot;",$retVal)));

to:

return htmlspecialchars($retVal);

It should also be noted that you should change the same line of code in the wavt_validatedform_php.php file located in the configuration folder under \Shared\WebAssist\FormValidations\Scripts\ as well so that it (A) doesn't overwrite the existing files and (B) adds the correct code for any new instances.

Not necessarily Andrew.


That code was implemented to prevent Cross Site Scripting attacks. by removing it from all future instances of using the Server Validations would make your forms vulnerable to Cross Site Scripting.

This change should only be made for administration forms where you trust the person filling the form in.

It should not be implemented for public forms where you do not know who is filling the form.

  That code was implemented to prevent Cross Site Scripting attacks. by removing it from all future instances of using the Server Validations would make your forms vulnerable to Cross Site Scripting.  

Fair enough.. for my purposes these all sit in the administrative zone, as such, I have changed that main file.

That's fine, but I wanted to caution others from taking your advice if they are creating public facing forms.

Public facing forms should not have this modification applied.

Originally Said By: Jason Byrnes

  That's fine, but I wanted to caution others from taking your advice if they are creating public facing forms.

Public facing forms should not have this modification applied.  

Even if they change this file ONLY within the local site, all of the forms using HTML Editor on that site will reference this modified file.

It should be noted that the reality is: Whether or not you change the main file, the one you did change (local to the site) will make your public forms less secure on these sites.

All HTMLeditor instances reference this file - public and private - unless you specifiy a different version of the file for each type of location (public / private), which is not the default and must be hand coded.

All the more reason that this should be quickly moved up on the 'things to fix' list - this is now a security issue, which is cause for concern.

the engineering team is looking into correcting the problem.

I updated the initial post for this sticky to use:

return htmlspecialchars($retVal);

which will prevent the security issue, and correct the problem.

Thanks Mate!

Originally Said By: Jason Byrnes

  Using Server Validation from CSS Form builder or Form Toolkit on an HTML Editor instance, when validation fails, the HTMLEditor content will be encoded.


to fix the issue, edit the webassist/form_validation/wavt_validatedform_php.php file. change:

php:

return str_replace("<","&lt;",str_replace(">","&gt;",str_replace('"',"&quot;",$retVal)));

to:

php:

return htmlspecialchars($retVal);

  

Hi I created a large form for a client and bound it to a mysql database in CS3 & Windows 8. My software was freezing when I tried to validate the form. So I purchased CS6, Data Bridge, and now hen I try to validate the form from CS6 I get the following alert.

While exectuting onLoad in spryValidation Textfield.htm, the following JavaScript error(s) occured
At line 132 of file C:\Configuration\Shared\Spry\DesignTime\EditingUtils.js:WA_getDocumentDOM is not defined

I am assuming that WA stands for Web Assist so there seems to be a conflict between DW Spry and Data Bridge configuration. How can I fix this

As stated I am using Windows 8, in DW CS6 (but the form was originally set up and bound in CS3) and Databridge. I know that there is no issue CS3 since when I make a new form in CS6 I get the same alert. But when I use the formbuild presets in Data Bridge the Spry validation works. This form is large, and so is the DB. I don't really want to start the form process again and besides the conflict needs to be resolved. Please can someone advise

Tony Tanner
PS I get the same alert after I disabled Data Bridge