Custom GridView Control – Postback Problems

[Amadeus Consulting]

I am developing a control in ASP.NET 2.0 that is derived from GridView. This
control handles paging on its own and thus renders custom paging buttons. It
also add some other functionality to the GridView by overriding Render() and
rendering other controls alongside the GridView’s HTML.

When I click one of the pager buttons (of type ImageButton), I receive the
following error:

Invalid postback or callback argument. Event validation is enabled using
<pages enableEventValidation="true"/> in configuration or <%@ Page
EnableEventValidation="true" %> in a page. For security purposes, this
feature verifies that arguments to postback or callback events originate
from the server control that originally rendered them. If the data is valid
and expected, use the ClientScriptManager.RegisterForEventValidation method
in order to register the postback or callback data for validation.


I have searched for other people that have encountered this error, and the
common suggestion is to specify <pages enableEventValidation=â€false†/> to
remedy the problem. I would like to avoid this solution. I’m sure there is a
way to have my controls behave nicely with event validation.

Any help will be appreciated. Thanks!

 

[Phillip Williams]

Hi Steve,

Most likely, you have a control (e.g. a textbox control that rendered an
HTML input object) that holds HTML markup or JavaScript in it (your custom
code) that is being posted back. The EnableEventValidation setting prevents
a malicious user from manipulating the PostBack script to send arbitrary post
events to server controls. It attempts to verify that any script posted back
was created by the ASP.NET controls that were on the page before the PostBack
happened.

To solve the problem, avoid creating custom objects that PostBack scripts to
the server.

 

[Steven Cheng[MSFT]]

Thanks for Phillip's inputs.

Hi Steve,

I agree with Phillip, the ASP.NET 2.0 by default will enable valiation to
the clientside postback script and the submit form fields, it ensure that
all the post back script and form fields are generated by the Page's script
interface (Page.ClientScripts.xxxx) or the Page's Control structure.....

So I think your custom webcontrol should be a Rendering control(put the
html output code in Render method) rather than a composite control (using
CreateChildControls to construct control structure....) or you've manually
output some client scripts, yes?

If so, my suggestion is try best to use Composite control instead of
rendering control and always use the Page's script interface to generate
scirpts....(e.g: ClientScript.GetPostBackEventReference .......) , and
makesure all the HtmlForm's <input ..... > elements are created through
Control instance rather than rendering through Response.Write("<input
.......") ....

#Creating Custom Web Controls with ASP.NET 2.0
http://msdn.microsoft.com/library/en-us/dnvs05/html/custwebcon.asp?frame=tru
e

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)







--------------------
| Thread-Topic: =?Utf-8?Q?Custom_GridView_Control_=E2=80=93_Postba?=
| =?Utf-8?Q?ck_Problems?=
| thread-index: AcYBy2v9mJ7Av0jdRqCyYcOKxQvDfA==
| X-WBNR-Posting-Host: 64.253.156.46
| From: "=?Utf-8?B?UGhpbGxpcCBXaWxsaWFtcw==?="
<[email protected]>
| References: <[email protected]>
| Subject: =?Utf-8?Q?RE:_Custom_GridView_Control_=E2=80=93_Po?=
| =?Utf-8?Q?stback_Problems?=
| Date: Thu, 15 Dec 2005 15:01:02 -0800
| Lines: 48
| Message-ID: <[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 8bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.dotnet.framework.aspnet.webcontrols
| NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGXA03.phx.gbl
| Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.aspnet.webcontrols:31824
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.webcontrols
|
| Hi Steve,
|
| Most likely, you have a control (e.g. a textbox control that rendered an
| HTML input object) that holds HTML markup or JavaScript in it (your
custom
| code) that is being posted back. The EnableEventValidation setting
prevents
| a malicious user from manipulating the PostBack script to send arbitrary
post
| events to server controls. It attempts to verify that any script posted
back
| was created by the ASP.NET controls that were on the page before the
PostBack
| happened.
|
| To solve the problem, avoid creating custom objects that PostBack scripts
to
| the server.
| --
| HTH,
| Phillip Williams
| http://www.societopia.net
| http://www.webswapp.com
|
|
| "Amadeus Consulting" wrote:
|
| > I am developing a control in ASP.NET 2.0 that is derived from GridView.
This
| > control handles paging on its own and thus renders custom paging
buttons. It
| > also add some other functionality to the GridView by overriding
Render() and
| > rendering other controls alongside the GridView’s HTML.
| >
| > When I click one of the pager buttons (of type ImageButton), I receive
the
| > following error:
| >
| > Invalid postback or callback argument. Event validation is enabled
using
| > <pages enableEventValidation="true"/> in configuration or <%@ Page
| > EnableEventValidation="true" %> in a page. For security purposes, this
| > feature verifies that arguments to postback or callback events
originate
| > from the server control that originally rendered them. If the data is
valid
| > and expected, use the ClientScriptManager.RegisterForEventValidation
method
| > in order to register the postback or callback data for validation.
| >
| >
| > I have searched for other people that have encountered this error, and
the
| > common suggestion is to specify <pages enableEventValidation=â€
false�/> to
| > remedy the problem. I would like to avoid this solution. I’m sure
there is a
| > way to have my controls behave nicely with event validation.
| >
| > Any help will be appreciated. Thanks!
| >
| > --
| > Steve Loper
| > Amadeus Consulting
|

 

[Amadeus Consulting]

Steven,

Thanks for the response. We have done what you suggested (created the
composite control), and that works for the most part.

Most of what we are tring to do is display some customs via the
PagerTemplate. This is now working very well when there is more than one page
of data. If there is only one page of data, the PagerTemplate is not
displayed. This appears to be the default behaviour of the GridView control.
Is there any way to force the GridView control to display the PagerTemplate
when there is only a single page of data?

Thanks,