charset issue

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

Please do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.

This forum is for discussing mojoPortal development

You can monitor commits to the repository from this page. We also recommend developers to subscribe to email notifications in the developer forum as occasionally important things are announced.

Before posting questions here you might want to review the developer documentation.

Do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.

This thread is closed to new posts. You must sign in to post in the forums.

3/13/2014 10:42:42 PM

mahua

Total Posts 36

View Posts

charset issue

Hi Joe,

Charset vulnerability issue has been reported by Aperia solution and PCI compliance failed for my site. I did some research and found that they have reproduced this issue on IE 7 and OS is vista.

It happens when a browser assumes a page is UTF-7 almost all modern browsers assume UTF-8 so this is a vulnerability that occurs only in old browsers you can't reproduce it if you use a modern browser. I tried to reproduce this issue on IE 7 and found one problem.

I am aware that mojoPortal add meta tag <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> but this is after title tag. As per the solution available on internet to fix this issue we should add charset = utf-8 before title tag. So we added <meta charset="utf-8"> in my layout.master page of my skin folder. And after doing some analysis we found two issues:

Though we didn't add end tag but still in view source it is displayed as <meta charset="utf-8" />. So I think this could be an issue since old browsers(IE 8 and below) do not ignore this end tag and hence it is considering it as incorrect syntax. I am not sure why this end tag is added.
In browsers IE 8 and below meta tag is displayed below title tag even though we added above title tag.

Can you please help us in this regard.

3/14/2014 10:22:34 AM

Joe Audette

Total Posts 18439

View Posts

Re: charset issue

Hi,

You have complete control over this, to change it as you desire with the encoding before the title then look for this in layout.master file of the skin:

change it like this:

DisableContentType as true will turn off the charset that would be added automatically by the MetaContent control, allowing you to put it in yourself.

Note also that there is a difference in what you will see using view source and inspect element, view source should be the raw markup but inspect element can be different because it shows what the browser interprets the markup as, so the browser may show it with the closing /> even if the raw markup does not have the closing tag.

Hope that helps,

Joe

You must sign in to post in the forums. This thread is closed to new posts.