For technical articles, it's often useful to be able to have html code in the wiki content. However, I noticed that the WIKI doesn't support xml content in the body. I figured out the html contents were being htmlDecoded and re-encoded in this routine:
Private Function FilterStrings(ByVal strInput As String) As String
'setup up list of search terms as items may be used twice
Dim TempInput As String = strInput
Dim listStrings As New List(Of String)
listStrings.Add("<script[^>]*>.*?</script[^><]*>")
...
listStrings.Add(" ")
listStrings.Add("alert[\s( )]*\([\s( )]*'?[\s( )]*[""(")]?")
Dim options As RegexOptions = RegexOptions.IgnoreCase Or RegexOptions.Singleline
Dim strReplacement As String = " "
'check if text contains encoded angle brackets, if it does it we decode it to check the plain text
If TempInput.Contains(">") = True And TempInput.Contains("<") = True Then
'text is encoded, so decode and try again
TempInput = HttpContext.Current.Server.HtmlDecode(TempInput)
For Each s As String In listStrings
TempInput = Regex.Replace(TempInput, s, strReplacement, options)
Next
'Re-encode
TempInput = HttpContext.Current.Server.HtmlEncode(TempInput)
The problem with this is it converts content like this:
<html><body>
<myCode>
HelloWorld();
<myCode>
</body></html>
into content like this:
<html><body>
<myCode>
HelloWorld();
</myCode>
</body></html>
The data is then decoded and stored away. When it's later loaded back up, the myCode part will never be escaped properly. As a simple solution, I just removed the NoScripting flag like such:
Private Sub SaveAndContinue()
Dim objSec As New DotNetNuke.Security.PortalSecurity
'SaveTopic(objSec.InputFilter(HttpUtility.HtmlDecode(Me.teContent.Text), DotNetNuke.Security.PortalSecurity.FilterFlag.NoScripting).Replace("iframe", ""), Me.AllowDiscuss.Checked, Me.AllowRating.Checked)
'HttpUtility.HtmlDecode(objSec.InputFilter(Me.teContent.Text, PortalSecurity.FilterFlag.NoScripting))
SaveTopic(Me.teContent.Text, _
Me.AllowDiscuss.Checked, _
Me.AllowRating.Checked, _
objSec.InputFilter(Me.txtTitle.Text.Trim(), PortalSecurity.FilterFlag.NoMarkup), _
objSec.InputFilter(Me.txtDescription.Text.Trim(), PortalSecurity.FilterFlag.NoMarkup), _
objSec.InputFilter(Me.txtKeywords.Text.Trim(), PortalSecurity.FilterFlag.NoMarkup) _
)
End Sub
My thoughts are this looks like a bug in the InputFiltering routine of DNN. The sample presented obviously doesn't have any script, but yet the routine produces an unwanted side affect. Some other workaround solution might be to have a module setting to allow what type of content are allowed in the wiki.