Electronic Screw

.NET :: Do[t]he NET

Trust levels in ASP.NET Application

clock December 27, 2006 02:19 by author gnineth
When you are hosting your application in a shared hosting environment, you need to think about the trust levels that you need to set for your application.

Apart from the security to your web application and the files ASP.NET provides, trust levels are those, which are used to sucure the files and application in the hosting environment.  The trust levels are set in the web.config file and can be set at machine, site and application levels.

What is Trust?
The application runtime, can be set to configure trust levels, which are used to contrain what an application can do. That is, if an application is running on full trust, it means, it allows the native code to execute, can look at a process, to find or corrupt or delete data from other applications. A trust level of minimum means, its a highly restrictive and a full trust means, there are no restrictions at all. The default trust level for asp.net applications is full trust.

In a full trust level application, its even possible to walk through the directories, retrieve a listing of files in specified folder outside of the root where the code executes.

With medium trust level, asp.net places a number of restrictions on the application. The application file access is restricted within the virtual directory where the application resides.

Trust level specification in web.config

<trust level="[Full|High|Medium|Low|Minimal]" originUrl="URL"processRequestInApplicationTrust = "[True|False]" />
For more information on trust level check this link: trust element (ASP.NET Settings Schema)

Be the first to rate this post

  • Currently 0/5 Stars.
  • 1
  • 2
  • 3
  • 4
  • 5


Readonly property of Textbox in ASP.NET

clock December 25, 2006 01:58 by author gnineth

Yesterday I was looking at a post in ASP.NET Forums regarding the read-only property of a textbox and found it interesting to post it in my blog.

A browser is not supposed to postback the values of the disabled formfields, which means they are not successfull form-fields. A non successfull form-field cannot post the data back to the server. A detailed explanation of what is a successfull and non-successfull form fields is given in this link http://www.w3.org/TR/REC-html40/interact/forms.html#h-17.12

In a simple page, if you are having a textbox with its ReadOnly property set to true, and set the value of the textbox using a client script on body load, and try to access the textbox value in code-behind will result in null value.

This is the sample code which results in this:

[code:html]
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>Untitled Page</title>
    <script language="javascript" type="text/javascript">


        function setText() {
            document.getElementById("TextBox1").value = 'a different value';
        }
    </script>
</head>


<body onload="setText()">
    <form id="form1" runat="server">
    <div>
        <asp:TextBox ID="TextBox1" runat="server" ReadOnly="true" ></asp:TextBox>&nbsp;
        <asp:Button ID="Button1" runat="server" OnClick="Button1_Click" Text="Button" />
    </div>
    </form>
</body>
</html>
[/code]

and in the code behind:

[code:c#]
"Arial" size="2">protected void Button1_Click(object sender, EventArgs e)
{
    Response.Write(TextBox1.Text);
}

[/code]

wont write any text to the browser.  This is because, form-fields that are disabled are not posted back to the server, and asp.net take the previous page value or value stored in view state and the users changes (changes that are made through the client-script) to the form field will be lost. Check the remarks part of this link for a better understanding http://msdn2.microsoft.com/en-us/library/system.web.ui.webcontrols.textbox.readonly.aspx

For the problem, sure there are a couple of workarounds. One simple way is, instead of setting the ReadOnly property to true in the properties window, add Attribute (readonly) to the textbox in the page_load

[code:c#]
protected void Page_Load(object sender, EventArgs e)
{
    TextBox1.Attributes.Add("readonly","readonly");
}

[/code]

Another way, which i didnt try is to set the attribute submitdisabledcontrols to true on the form tag.

[code:html]
<form id="form1" runat="server" submitdisabledcontrols="true">
[/code]

One thing, which i found interesting after reading a couple to articles was, the same textbox (with readonly property set to true) will post the client changes to the server, if referred by Request.Form in code behind. I give the code for this :

html listing:

[code:html]
<form id="form1" runat="server">
    <asp:TextBox ID="TextBox1" runat="server" ReadOnly="True">TextValue</asp:TextBox>
    <asp:Button ID="Button1" runat="server" Text="Submit" />
</form>


<script language="javascript" type="text/javascript">
function setText() {
    document.getElementById("TextBox1").value = 'client-side value';
}
</script>
[/code]


and in the code:

[code:c#]
protected void Page_Load(object sender, EventArgs e)
{
    if (IsPostBack)
        Response.Write(Request.Form(this.TextBox1.ClientID);
}
[/code]


E Screw

Currently rated 3.8 by 4 people

  • Currently 3.75/5 Stars.
  • 1
  • 2
  • 3
  • 4
  • 5


Search

Calendar

<<  November 2008  >>
SuMoTuWeThFrSa
2627282930311
2345678
9101112131415
16171819202122
23242526272829
30123456

Archive

Tags

Categories


Blogroll

    Disclaimer

    The opinions expressed herein are my own personal opinions and do not represent my employer's view in anyway.

    © Copyright 2008

    Sign in