I'm working with a ASP.Net App but having an issue with a popup window whose url contains quotation marks.
In the code the url is something like http://www.example.com?a=7&b='misc'&c=23
The code uses escape clauses to generate the url so that the string parameter looks like: "http://www.example.com?a=7&b=//'misc//'&c=23"
The problem is that when this popup is triggered on our dev and QA web servers IE11 just displays a # and the message
"Internet Explorer has modified this page to prevent Cross Site
Scripting".
This does not occur when I run the code locally. In this case the popup opens up as expected.
If I type the popup url directly into the browser ie (http://www.example.com?a=7&b='misc'&c=23)
it opens locally but not on the two servers.
Why will it open locally but not on the Web Servers and how can I resolve this issue so that it runs on all of them?
Related
I am working on a system that has a WPF WebBrowser that is displaying dynamically generated HTML.
This contains links to files, using file:///servername/filename.ext addresses.
This should have worked in times gone by when this was first developed, but does not seem to behave now.
What I can see:
White click on the generated file in the browser of being an HTML file: File is served from about:blank and in the Internet Zone. Clicking a link does nothing.
What I have done:
I have added about:blank to the Trusted Zone, and have set the security for the Trusted Zone to Low. Clicking a link still does nothing.
Created an HTML file and hosted it on my local IIS. Browse to this file in IE. The file contains a link to a file:/// address. Nothing happens on click.
Added http://127.0.0.1 to the Trusted Zone. The above test still fails.
Changed the generated HTML to be a link to http://www.google.com. This works.
What I think is happening:
The WPF WebBrowser is IE underneath. Did IE have a security update that stopped access to file:/// paths?
What I cannot do due to technical restrictions with deployment:
Have the generated HTML and the files linked to served by a web server so everything is within an http(s) environment.
What I can do:
Update browser settings
Update our code
Update - additional information:
The HTML is being displayed on the WPF by binding to a string that contains the HTML (effectively <html><body>Look! Stuff!<br />Whatever</html>)
file:///foo/whatever.txt exists and I have access to it
That file is generated by a process on a server and the client is generating the link to the file. This is a historic design, I didn't come up with it, I'm just maintaining it. I can't do massive code overhauls.
I cannot install any additional services anywhere
All Browsers have updated to prevent interesting stuff happening on local HTML files. Because you could do interesting stuff in the past it meant interesting exploits could be utilized too.
I've had a recent issue where I created a HTML in code and wanted to display it in CEFSharp (much better than WebBrowser by the way) with a link to CSS and JavaScript Files.
How I fixed it was to run a LocalHost and did this using this code which works really well: An HTTP file server (130 lines of code) in VB.Net
For testing your HTML outside of code you could run this batch file to start your LocalHost:
ECHO OFF
ECHO "Launching Localhost:8080"
py -3 -m http.server
ECHO "Loading HTML.."
start chrome localhost:8000
This batch file assumes you have Python 3+ installed. You can verify this in the Command Prompt with:
python --version
I've solved this by cheating a little.
I've got the VM to write the HTML out to a file, and then pass the file name to the browser in the view. This means that I am displaying the created content from file:////foo.htm, and that is fine for links to file:///server/bar
So just like uTorrent gets magnet links and opens them,
How can I setup my WinForm app to get a URL from Default Browser (in this case my default is Chrome) and open that URL in EO.WebBrowser within my app?
I don't have any code for this yet, as I don't know where to start.
Is this something that would be assigned as a Registry Key?
I know there are Registry keys for uTorrent to handle Magnet links in HKEY_CLASSES_ROOT\Magnet\shell\open\command.
What I have is WhatsApp Web open in EO.WebBrowser, and when I click on a URL starting with https://web.whatsapp.com or https://api.whatsapp.com it would open that link. The thing is the link should be changed to web.whatsapp.com, instead of api.whatsapp.com
I am aware
System.Diagnostics.Process.Start("https://www.facebook.com");
Goes to facebook but i want a button for a handy shortcut to the networks Intranet.
I obviously cant just put
System.Diagnostics.Process.Start("intranet");
Which is what i normally put in the browser, so how do i direct the button click here?
When you type "intranet" into the browser's address bar, the browser silently adds http://. When you copy the address from that address bar (after your intranet has loaded), you will get the full URL.
Try and use that in your Process.Start.
I've got an ASP.NET site which allows users to view/open files from a shared network folder via links which call response.redirect passing in the full location of the relevant file (using a mapped drive value on appserver, not specific server name).
This works fine in IE7 but now w're doing a Win7 upgrade it isn't working in IE9 (or Chrome). For IE9 it displays basic "Internet Explorer cannot display the webpage" message.
I've tried changing it to pass in the path using server instead of mapped drive but that's worse, is tries to start at root of application directory and then acts as if server is a folder within it (and displays "The page cannot be found").
The site probably shoudln't have ever been designed in this way but I need a dirty workaround, no time for complete redesign. Any ideas? If the cause is how newer browsers handle the redirect response is it possible to alter an advanced setting to mimic previous version? I've tried adding site as trusted and also compatibility view.
Sample code:
Response.Redirect("R:\SharedFolder\indexedEmail.msg"); //Where R is mapped to netshare
Try using using the file:// URL prefix. The newer browsers may not be assuming that the URL is pointing to the local file system.
I need to launch a browser, do some work and then make the browser navigate to a URL (in that order).
The first part is of course simple and I have a Process object. I am at a loss as to how to later direct it to the target page?
How do I treat the Process as a browser and make it navigate to the desired page?
Any help, pointers, code snippets appreciated.
Instead of launching the browser & then navigating to the page, just tell the OS that you want to run the URL. Windows will pick the correct browser, and navigate the user to the given URL.
System.Diagnostics.Process.Start("http://www.StackOverflow.com");
If you don't need to do this in production, you could use a testing library such as WatiN to do this:
using WatiN.Core;
//Placeholder page to launch initial browser
IE ie = new IE("http://www.google.com");
DoSomeWork();
//Now navigate to the page you want
ie.GoTo("http://stackoverflow.com");
My first instinct for this question was DDE, but it appears that has been decommissioned in Windows Vista so that is no good. Shame, as it was the only consistent mechanism in Windows for Interprocess Communication (IPC)...oh how I miss Arexx on the Amiga.
Anyhow, I believe the following will work but unfortunately, due to the way it works, it launches Internet Explorer irrespective of the configured browser.
If your application has a Form, then create a WebBrowser control on it. Set this to non-visible as we are only making use of its as a launching device rather than to display the web page.
In code, at the point where you want to show a web page, use the following code:
webBrowser1.DocumentText = "window.open('How to launch a browser and later direct it to a page?', 'BananasAreOhSoYummy');";
What this does is to tell the WebBrowser control, which is just the IE in disguise, to open a new window called 'BananasAreOhSoYummy'. Because we have given the window a name, we can use that line repeatedly, with different URLs, to change the page in that particular browser window. (A new window will be opened if the user has happened to close it.)
I will have a think about an approach that honours the user's default browser choice.
If you don't need the actual instance of IE, you can use the System.Windows.Forms.WebBrowser control.
I think instead of sending the browser a url you could send it javascript that would run and direct the browser to a site.
Not sure if this would work but I see no reason why it wouldn't