dnnsoftware / Dnn.AdminExperience

DNN (formerly DotNetNuke) Combined Admin Experience
MIT License
17 stars 39 forks source link

() Characters that are not illegal are considered illegal characters #1166

Closed aelibyary closed 5 years ago

aelibyary commented 5 years ago

This PR has been created instead of #1031 to re-target branch release/3.0.x

Fixes #1029

Summary

This issue is very obscure. The error message is misleading.

The URL is rejected because of a hidden host setting named AUM_ReplaceChars which has a default value of &$+,/?~#<>()¿¡«»!" (including a space at the beginning)

URLs are tested against the above characters. In a nutshell, the above characters are replaced with a hyphen when found in the URL.

The other aspect of this issue is that the validation logic returns a suggested modified URL to the front-end, which is completely ignored.

@daguiler Suggested:

I think the easiest way to fix this without introducing breaking changes is 1- to change the error message so that it doesn't specify which characters are "illegal", (Fixed) 2- and also, replace the user-provided URL with the suggested modified URL in case there were validation errors. (Fixed)

Fix Video