I have an Asp.Net Core 3.1 razor page app. I'm receiving HTML content from user and that will be displayed back in the browser. It's kind of blog like app where my end user will be given a WYSIWYG editor and then the HTML from user will be encoded and saved in database.
Now when the blog page is requested, I need to decode the HTML content back and display in browser. This make my site vulnerable to XSS attack.
Here is my HTML from user,
<p>blog 5</p><script>alert()</script>
I encode this and save in database,
<p>blog 5</p><script>alert()</script>
Now to render the same,
#Html.Raw(System.Net.WebUtility.HtmlDecode(Model.Blog.Content))
When the page gets rendered it shows javascript alert() box.
if I don`t decode then html string is displayed,
#Html.Raw(Model.Blog.Content)
as shown below,
<p>blog 5</p><script>alert()</script>
I'm confused. Am I doing something wrong here? Please assist and correct me. I need the html to be safe and also it has to display as html in browser than as html string output.
I would recommend using an HTML sanitizer library. One of the more popular ones for .NET is:
https://github.com/mganss/HtmlSanitizer
It is available on Nuget:
https://www.nuget.org/packages/HtmlSanitizer/
This will allow you to whitelist the tags that you want to allow. See the wiki for additional documentation and examples.
Hey guys I am building a website in which the sections of that website are in same html pages and they are given an id ,Now in this special case I want to make a url in django which can go to the specific id not the whole html page
Is this possible?
We've got a WordPress site and I've built a page that pulls from different sections of our site which I'd like to use as the content for a bi-weekly MailChimp newsletter. Is there anyway to automate pulling in a div on our site into the body of a MailChimp template?
All the tools I've found pull in the page as "an article" and just put an image and headline into the message body, rather than the full page verbatim.
Not adverse to doing some coding, but not sure how to start.
Thanks for any suggestions.
I can think of two different routes you might be able to try. The first is to generate an RSS feed for the content you're talking about and then use an RSS Campaign to send the email. Depending on how you have this data stored on your site, WordPress might already be generating an RSS feed for you for that content.
The second option involves more coding. If you create a template with an editable section you can then pass in the content of that section via the API. This is probably harder, since the campaign content APIs are pretty convoluted in v2.0. v3.0 should make that easier, but it's still in beta.
What if one would want to create a landing page/home page for opencart?
How does someone will supposed to do that?
A landing page or home page, using only opencart and no other means.
--
Clarification.
What I meant of Home Page is it's literal meaning in the context of Front-End WebDev. What I meant to say is, the page where user is redirected when they access my site's root domain.
I want to design and create a custom landing and home page. That landing page has no product content.
It shall only contain the folowing;
Main Navigation Menu with, Home, Online Shop, Blog links.
Site Name, Site Logo
Site Name with Tagline.
Banner Rotator with CTA button.
Footer, Footer Links to Privacy Policy, About Us and other common footer links.
This Home Page/Landing Page/Index Page, is a different page from the main store section. On this page, It has a home page link and a store page link. So on the main nav of this page, you shall see a Home link and a Store link. Clicking store link, shall take you to the main store section and the main nav shall show the categories, the store has.
To achieve what You are requesting:
It shall only contain the folowing:
1. Main Navigation Menu with, Home, Online Shop, Blog links.
2. Site Name, Site Logo
3. Site Name with Tagline.
4. Banner Rotator with CTA button.
5. Footer, Footer Links to Privacy Policy, About Us and other common footer links.
You would have to disable any module that is displaying on homepage (categories, featured, bestsellers, latest, specials, etc.) and enable only the carousel module (or install one of Your desire) and place it on the Content Top position.
In that case You would have these elements:
header (with site name, logo, main navigation)
Your desired carousel/banner rotator
footer (with additional links)
Is that what You are requesting?
Edit 1: I think the homepage You request is kinda nonsense... Why on earth You would like to have a homepage with a link to homepage and store? I would understand to have a website (presentation) with a blog and store that both run within u subdirectory, thus having a site www.site.com, with a blog at www.site.com/blog/ and a store at www.site.com/store/. In that case I would understand that within the main site (www.site.com) You would have a homepage with link to /blog/ and to /store/.
BUT if You are running only a store at Your domain (www.site.com) then having additional homepage is nonsense, as You could create a homepage described above (header + text and carousel as content + footer)...
Edit 2:
Yes, that's my main idea mydomain.com would be my landing page/index page/home page. mytdomain.com/store, is the store section and also with the blog section at mydomain.com/blog.
In that case You could create just a simple static HTML page that will contain static text and a javascript carousel (banner rotator/slider). After You have installed the blog and store to their subdirectories then just create a link to both of them within Your static homepage that lays in the root of the web folder and is called index.html.
Another way how to achieve this with slightly more effort is to have the desired blogging system installed in the root, editing it's homepage while having the main blog on a subpage and a store within a subdirectory. Many people run wordpress/drupal installation at www.site.com and an OpenCart installation at www.site.com/store/. Within a wordpress site You can then have a subpage /blog/ where You will post all of Your blog posts...
So is this the final solution?
The reason why someone would want to do that is for marketing purposes. Creating unique content is extremely important for SEO. The opencart default page does not have much area for landing pages or gateway pages. You may have to improvise to achieve this.
What I would recommend is just create your landing page and then use .htaccess file in /public_html folder to use whatever page you created, inside the landing page code use href links that take you to the products. This would be your best bet.
I am using facebook "like" as a iframe on my site. The data that the facebook button scraps from my sites url is not correct. How can we customize this data being sent or scraped?
i.e. I am using django, and hence have a base.html which has the meta tags of facebook. This base.html is extented throughout the site.
Now I cant understand how to customize these meta tags for each individual page that my site has.
Is there a way to give these attributes in the iframe itself ?
Is the question clear ? else please comment i will make the necessary changes.
Do you mean the open graph meta tags?
http://ogp.me/
I don't think it's valid to add meta tags anywhere in a page (i.e. outside the head tag) in order to customise their contents on each of your pages but I think it's valid in html 5 to have meta tags outside the head tag so I would suggest trying it first and then if you're able to, try and set it up so that in your base.html the meta tags are holding a variable and then on each of your pages that use the base.html you can specify the value of the variable on the individual page.