Code-blocks are not allowed in this file: Using Server-Side Code with SharePoint

  • Article

If you use the Microsoft Office SharePoint Designer to add a new page to your site, you will see that it looks just like any other ASP.NET page. Open up your site with the SharePoint Designer, and then go to the Pages folder. Right-click the Pages folder and choose New / ASPX. That will generate a new ASP.NET page with the following default template:

<%@ Page Language="C#" %>

<html dir="ltr">

<head id="Head1" runat="server">

<META name="WebPartPageExpansion" content="full">

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

<title>Untitled 1</title>

</head>

<body>

<form id="form1" runat="server">

</form>

</body>

</html>

You can see this is the same ol' ASP.NET. There is a Page directive, and the familiar form element with the runat attribute set to "server". Yep, same ASP.NET code. The first thing I tried to do was to add some server-side code to my new page and see it actually work.

<script runat="server">

protected void Page_Load(object sender, EventArgs e)

{

form1.InnerHtml = "<h1>Hello</h1>";

}

</script>

When I hit F5, though, I got this error message:

"An error occurred during the processing of /Pages/test.aspx. Code blocks are not allowed in this file."

Hmm… yeah, code blocks are allowed in ASP.NET pages. What's going on? Oh yeah! SharePoint disables the ability to create server-side script by default, you have to turn it on. You do that in the web.config file, in the configuration/SharePoint/PageParserPaths configuration section:

<PageParserPaths>

  <PageParserPath VirtualPath="/pages/test.aspx" CompilationMode="Always" AllowServerSideScript="true" />

</PageParserPaths>

Success! Now, when I view the page in the browser, the page shows the Hello message as an H1 element instead of that error message about "code blocks are not allowed in this file", because we explicitly enabled code blocks in the web.config file.

A word of caution, here. The VirtualPath attribute accepts wildcards. Be cautious about allowing any ol' page to have server side script, you can restrain to a single page (as I did above) or only a subset of pages or directories.