Validate multiple Panels

Discussion in 'ASP .Net' started by Brybot, Jul 11, 2007.

  1. Brybot

    Brybot Guest

    I have a form that i've split up into multiple asp:panels, each panel
    has a number of validators which work correctly.

    At on the last panel, i want to commit the data collected to a
    database. I figured since all the panel data is still being sent
    through the postbacks, instead of using Sessions, or HttpContext, I
    could just take the values from the textboxes.

    This all works fine, except for security. I realized that I could
    inject new values into the POST data. Once a page has been validated,
    its not validated again before committing to the database, in essence,
    making the validators on the other panels useless.

    To fix this, before committing, I would get a list of all the
    validators on the page, re-validate each, and if all of them were
    still valid, commit. That way any injected POST variables would
    become invalid and the commit would not happen. Code:

    foreach (IValidator validator in Page.Validators)
    {
    validator.Validate();
    if (!validator.IsValid)
    return;
    }

    This gets a list of all the validators across all the panels, but
    Validate() does not update the IsValid property and the injected
    variables are allowed through. ... How come Validate() is not
    updating? Testing, if I set a textbox.text = "" after it initally
    validates, the textboxes custom validator which checks for length > 5
    validates to true, even though it is not.

    Any help would be greatly appreciated!
     
    Brybot, Jul 11, 2007
    #1
    1. Advertising

  2. Brybot

    bruce barker Guest

    the validators only update themselves. to test if valid the page does
    the same loop you do.

    you could make one custom validator that does the loop, then
    Page.IsValid would call this one.

    -- bruce (sqlwork.com)


    Brybot wrote:
    > I have a form that i've split up into multiple asp:panels, each panel
    > has a number of validators which work correctly.
    >
    > At on the last panel, i want to commit the data collected to a
    > database. I figured since all the panel data is still being sent
    > through the postbacks, instead of using Sessions, or HttpContext, I
    > could just take the values from the textboxes.
    >
    > This all works fine, except for security. I realized that I could
    > inject new values into the POST data. Once a page has been validated,
    > its not validated again before committing to the database, in essence,
    > making the validators on the other panels useless.
    >
    > To fix this, before committing, I would get a list of all the
    > validators on the page, re-validate each, and if all of them were
    > still valid, commit. That way any injected POST variables would
    > become invalid and the commit would not happen. Code:
    >
    > foreach (IValidator validator in Page.Validators)
    > {
    > validator.Validate();
    > if (!validator.IsValid)
    > return;
    > }
    >
    > This gets a list of all the validators across all the panels, but
    > Validate() does not update the IsValid property and the injected
    > variables are allowed through. ... How come Validate() is not
    > updating? Testing, if I set a textbox.text = "" after it initally
    > validates, the textboxes custom validator which checks for length > 5
    > validates to true, even though it is not.
    >
    > Any help would be greatly appreciated!
    >
     
    bruce barker, Jul 11, 2007
    #2
    1. Advertising

  3. Brybot

    Brybot Guest

    On Jul 11, 12:41 pm, bruce barker <> wrote:
    > the validators only update themselves. to test if valid the page does
    > the same loop you do.
    >
    > you could make one custom validator that does the loop, then
    > Page.IsValid would call this one.
    >
    > -- bruce (sqlwork.com)
    >
    > Brybot wrote:
    > > I have a form that i've split up into multiple asp:panels, each panel
    > > has a number of validators which work correctly.

    >
    > > At on the last panel, i want to commit the data collected to a
    > > database. I figured since all the panel data is still being sent
    > > through the postbacks, instead of using Sessions, or HttpContext, I
    > > could just take the values from the textboxes.

    >
    > > This all works fine, except for security. I realized that I could
    > > inject new values into the POST data. Once a page has been validated,
    > > its not validated again before committing to the database, in essence,
    > > making the validators on the other panels useless.

    >
    > > To fix this, before committing, I would get a list of all the
    > > validators on the page, re-validate each, and if all of them were
    > > still valid, commit. That way any injected POST variables would
    > > become invalid and the commit would not happen. Code:

    >
    > > foreach (IValidator validator in Page.Validators)
    > > {
    > > validator.Validate();
    > > if (!validator.IsValid)
    > > return;
    > > }

    >
    > > This gets a list of all the validators across all the panels, but
    > > Validate() does not update the IsValid property and the injected
    > > variables are allowed through. ... How come Validate() is not
    > > updating? Testing, if I set a textbox.text = "" after it initally
    > > validates, the textboxes custom validator which checks for length > 5
    > > validates to true, even though it is not.

    >
    > > Any help would be greatly appreciated!


    Thanks Bruce, that is essentially what I am doing, more specifically,
    my problem is that validator.Validate() is not actually re-
    validating. Even if the validator should no longer validate,
    validator.isValid stays true.
     
    Brybot, Jul 11, 2007
    #3
  4. Brybot

    Brybot Guest

    On Jul 11, 1:31 pm, Brybot <> wrote:
    > On Jul 11, 12:41 pm, bruce barker <> wrote:
    >
    >
    >
    > > the validators only update themselves. to test if valid the page does
    > > the same loop you do.

    >
    > > you could make one custom validator that does the loop, then
    > > Page.IsValid would call this one.

    >
    > > -- bruce (sqlwork.com)

    >
    > > Brybot wrote:
    > > > I have a form that i've split up into multiple asp:panels, each panel
    > > > has a number of validators which work correctly.

    >
    > > > At on the last panel, i want to commit the data collected to a
    > > > database. I figured since all the panel data is still being sent
    > > > through the postbacks, instead of using Sessions, or HttpContext, I
    > > > could just take the values from the textboxes.

    >
    > > > This all works fine, except for security. I realized that I could
    > > > inject new values into the POST data. Once a page has been validated,
    > > > its not validated again before committing to the database, in essence,
    > > > making the validators on the other panels useless.

    >
    > > > To fix this, before committing, I would get a list of all the
    > > > validators on the page, re-validate each, and if all of them were
    > > > still valid, commit. That way any injected POST variables would
    > > > become invalid and the commit would not happen. Code:

    >
    > > > foreach (IValidator validator in Page.Validators)
    > > > {
    > > > validator.Validate();
    > > > if (!validator.IsValid)
    > > > return;
    > > > }

    >
    > > > This gets a list of all the validators across all the panels, but
    > > > Validate() does not update the IsValid property and the injected
    > > > variables are allowed through. ... How come Validate() is not
    > > > updating? Testing, if I set a textbox.text = "" after it initally
    > > > validates, the textboxes custom validator which checks for length > 5
    > > > validates to true, even though it is not.

    >
    > > > Any help would be greatly appreciated!

    >
    > Thanks Bruce, that is essentially what I am doing, more specifically,
    > my problem is that validator.Validate() is not actually re-
    > validating. Even if the validator should no longer validate,
    > validator.isValid stays true.


    Heres a code snippet:

    private void Button1_Click(object sender, System.EventArgs e)
    {
    this.TextBoxVar.Text = "";
    this.CustomValidatorCheckLength.IsValid = false;
    Page.Validate();
    if (Page.IsValid)
    Response.Write("Valid");
    }

    private void CustomValidatorCheckLength_ServerValidate(object source,
    System.Web.UI.WebControls.ServerValidateEventArgs args)
    {
    if (this.TextBoxVar.Text.Length > 5)
    args.IsValid = true;
    else
    args.IsValid = false;
    }

    If I enter a value of length greater then 5 then submit form, this
    always evaluates to true, even when I specifically set it so that it
    should not validate...
     
    Brybot, Jul 11, 2007
    #4
  5. Brybot

    Brybot Guest

    On Jul 11, 2:26 pm, Brybot <> wrote:
    > On Jul 11, 1:31 pm, Brybot <> wrote:
    >
    >
    >
    > > On Jul 11, 12:41 pm, bruce barker <> wrote:

    >
    > > > the validators only update themselves. to test if valid the page does
    > > > the same loop you do.

    >
    > > > you could make one custom validator that does the loop, then
    > > > Page.IsValid would call this one.

    >
    > > > -- bruce (sqlwork.com)

    >
    > > > Brybot wrote:
    > > > > I have a form that i've split up into multiple asp:panels, each panel
    > > > > has a number of validators which work correctly.

    >
    > > > > At on the last panel, i want to commit the data collected to a
    > > > > database. I figured since all the panel data is still being sent
    > > > > through the postbacks, instead of using Sessions, or HttpContext, I
    > > > > could just take the values from the textboxes.

    >
    > > > > This all works fine, except for security. I realized that I could
    > > > > inject new values into the POST data. Once a page has been validated,
    > > > > its not validated again before committing to the database, in essence,
    > > > > making the validators on the other panels useless.

    >
    > > > > To fix this, before committing, I would get a list of all the
    > > > > validators on the page, re-validate each, and if all of them were
    > > > > still valid, commit. That way any injected POST variables would
    > > > > become invalid and the commit would not happen. Code:

    >
    > > > > foreach (IValidator validator in Page.Validators)
    > > > > {
    > > > > validator.Validate();
    > > > > if (!validator.IsValid)
    > > > > return;
    > > > > }

    >
    > > > > This gets a list of all the validators across all the panels, but
    > > > > Validate() does not update the IsValid property and the injected
    > > > > variables are allowed through. ... How come Validate() is not
    > > > > updating? Testing, if I set a textbox.text = "" after it initally
    > > > > validates, the textboxes custom validator which checks for length > 5
    > > > > validates to true, even though it is not.

    >
    > > > > Any help would be greatly appreciated!

    >
    > > Thanks Bruce, that is essentially what I am doing, more specifically,
    > > my problem is that validator.Validate() is not actually re-
    > > validating. Even if the validator should no longer validate,
    > > validator.isValid stays true.

    >
    > Heres a code snippet:
    >
    > private void Button1_Click(object sender, System.EventArgs e)
    > {
    > this.TextBoxVar.Text = "";
    > this.CustomValidatorCheckLength.IsValid = false;
    > Page.Validate();
    > if (Page.IsValid)
    > Response.Write("Valid");
    >
    > }
    >
    > private void CustomValidatorCheckLength_ServerValidate(object source,
    > System.Web.UI.WebControls.ServerValidateEventArgs args)
    > {
    > if (this.TextBoxVar.Text.Length > 5)
    > args.IsValid = true;
    > else
    > args.IsValid = false;
    >
    > }
    >
    > If I enter a value of length greater then 5 then submit form, this
    > always evaluates to true, even when I specifically set it so that it
    > should not validate...


    Whew! Figured it out.

    Even though I am looping through each Validator, the panel it is in
    has to be set to visible=true for the validator to be forced to run.
    Therefore, as in the above Button1 Click event, if I add
    this.panelX.Visible = true; for each panel that contains a validator,
    they we re-validate.

    Awesome!
     
    Brybot, Jul 11, 2007
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Chris Nunciato

    Problem with Validation Using Panels

    Chris Nunciato, Jul 1, 2003, in forum: ASP .Net
    Replies:
    0
    Views:
    332
    Chris Nunciato
    Jul 1, 2003
  2. Jonas
    Replies:
    3
    Views:
    498
    Jonas
    Jan 26, 2005
  3. flupke
    Replies:
    1
    Views:
    4,640
    enoola
    Feb 9, 2009
  4. Multiple Panels

    , Apr 21, 2008, in forum: Java
    Replies:
    5
    Views:
    2,172
    Knute Johnson
    Apr 23, 2008
  5. Jonas

    Page validation with multiple panels

    Jonas, Jan 25, 2005, in forum: ASP .Net Web Controls
    Replies:
    2
    Views:
    148
    Jonas
    Jan 26, 2005
Loading...

Share This Page