"Peter and the case of the ASP.NET developer"

User Controls and the Publish Web Site command

2011-11-28T19:51:02Z

Visual Studio 2010’s Publish Web Site command offers the option “Allow this precompiled site to be updatable”. When used and your application has User Control (.ascx) files, the published application no longer contains your user controls! Instead, the \bin folder contains new files ending in the .compiled extension, one for each User Control. Your User Controls still work though, just through some hidden behaviors that I will discuss here.

First, the Page.LoadControl() method still works. LoadControl() creates a User Control on demand. In the past, it had to build it from the User Control’s file contents. Without the file present, it knows about the missing files through those new files in the .bin folder.

In my case, I was calling LoadControl after checking for a specific User Control file via a FileExists() function. I used System.Web.Hosting.VirtualPathProvider.FileExists() function. It turns out that VirtualPathProvider.FileExists() does not support the .compiled files and always returns false.

The solution comes from how ASP.NET Dynamic Data v4 does it: Use the System.Web.Compilation.BuildManager.GetObjectFactory() method. Always pass false for the ThrowException parameter and test the result for null. If not null, the file exists.

Here is a method that replaces the Page.LoadControl() method, loading a User Control if it exists. It works with the Publish Web Site feature as discussed.

     public System.Web.UI.WebControls.UserControl LoadUserControlIfExists(string pVirtualFilePath)

    {

        if (System.Web.Compilation.BuildManager.GetObjectFactory(pVirtualFilePath, false) != null)

            return Page.LoadControl(pVirtualFilePath);

        return null;

    }

More with ajax control toolkit’s combobox and Modalpopupextender

2011-09-16T16:16:00Z

One idiosyncrasy of the ModalPopupExtender is that its HTML content is actually visible while the page is loading, until the $create() call initializes it. If you have a lengthy load time, as I did with a ListView full of records, the visibility is noticeable.

One simple solution to this is to assign the style=”display:none” to the Control containing your content.

     <asp:Panel id="AdvancedFiltersContainer" runat="server" CssClass="AdvSch_PopupControl" Style="display:none;" >

        content

    </asp:Panel>

    <act:ModalPopupExtender id="Modal1" runat="Server" PopupControlID="AdvancedFiltersContainer" >

    </act:ModalPopupExtender>

However, I’ve learned that once an Ajax Control Toolkit ComboBox control is present, IE 9 (and presumably earlier browsers) reports a JavaScript error as the Combobox is being initialized. When the HTML for the combobox is hidden, its elements have an offsetWidth, offsetHeight, clientWidth, and clientHeight of 0. The ComboBox calculates a value based on offsetWidth, subtracts the size of the border, and assigns the result to a Style.width object.

Here is a snippet from the function, _getOptionListWidth, where the issue resides.

    // first, default to the clientWidth of the container

    var bestWidth = this.get_comboTableControl().offsetWidth;

    // subtract borders from the offsetWidth

    bestWidth -= (leftBorder + rightBorder);

    // in order for ths list's scrollWidth to be correct, must set its width

    var originalWidth = style.width;

    style.width = bestWidth + 'px';

If you are paying attention, you’ll notice that when style.width is set, the value it gets is a negative number (0 – border width). That throws a JavaScript exception in IE 9. I’ve found that even assigning style.width to “0px” throws this exception.

As a result, you cannot use style=”display:none;” to fix the problem I’ve raised, at least on IE 9.

Here’s my simple solution.

Assign style=”position:absolute;left:100000px;” instead. This will leave the ModalPopup visible, but way off screen. When ModalPopup initializes itself, it overwrites both position and left styles to fit its needs.

    <asp:Panel id="AdvancedFiltersContainer" runat="server" CssClass="AdvSch_PopupControl" Style="position:absolute;left:100000px;" >

        content

    </asp:Panel>

    <act:ModalPopupExtender id="Modal1" runat="Server" PopupControlID="AdvancedFiltersContainer" >

    </act:ModalPopupExtender>

Fixing combobox from ajax control toolkit

2011-09-14T14:36:00Z

I was using the ComboBox control of Microsoft’s Ajax Control Toolkit and ran into two issues.

When its initially hidden (its inside something with a style of display:none) and you make it visible, the toggle button and actual dropdown list are incorrectly sized to be almost meaningless.
how it should look:

how it actually looks

Notice the toggle button has virtually disappeared. That grey underline is the dropdown list.
When its in a ModalDialog created by the ModalPopupExtender, the dropdown lists appear far away from where they belong.
Here the Category dropdown toggle was clicked. The list should be flush with the bottom of the Category’s textbox.

I created the following class to solve both of these problems. It was developed with v3.0.30512.1 of the AjaxControlToolkit.dll. (Get it as a zip file here)

        1: /// <summary>

       2: /// These static methods fix bugs related to the AjaxControlToolkit's ComboBox.

       3: /// </summary>

       4:    public class ComboBoxFixer

       5:    {

       6: /// <summary>

       7: /// Use this when adding ACT Comboboxes that may be initially hidden when loaded.

       8: /// It registers all comboboxes into a client-side array. If the user writes

       9: /// scripts that make the ACT Comboboxes visible, they should call

/// ActComboBoxMadeVisible_All(), a client-side method.

/// </summary>

      public static void RegisterComboBox(AjaxControlToolkit.ComboBox pComboBox)

      {

         ClientScriptManager vClientScript = pComboBox.Page.ClientScript;

         if (!vClientScript.IsClientScriptBlockRegistered("ActComboBoxFixer"))

         {

            string vScript =

               "function ActComboBoxMadeVisible_All()\r\n" +

               "{\r\n" +

                "   if (window.gActComboboxes)\r\n" +

                "      for (var vI = 0; vI < window.gActComboboxes.length; vI++)\r\n" +

                "      {\r\n" +

                "         var vCB = $find(window.gActComboboxes[vI]);\r\n" +

                "         if (vCB)\r\n" +

                "         {\r\n" +

                "            ActComboBoxMadeVisible(vCB);\r\n" +

                "         }\r\n" +

                "      }\r\n" +  

               "}\r\n" +

               "function ActComboBoxMadeVisible(pCB)\r\n" +

               "{\r\n" +

                "  if (pCB && !pCB._optionListItemHeight)\r\n" +

                "  {\r\n" +

                "     var vBtn = pCB.get_buttonControl();\r\n" +

                "     vBtn.style.width = '';\r\n" +

                "     vBtn.style.height = '';\r\n" +

                "     pCB.initializeButton();\r\n" +

                "     pCB._optionListHeight = null;\r\n" +

                "     pCB._optionListWidth = null;\r\n" +

                "     pCB._optionListItemHeight = 21;\r\n" +

                "     pCB._getOptionListWidth();\r\n" +

                "     pCB._getOptionListHeight();\r\n" +

                "  }\r\n" +

               "}\r\n";

            vClientScript.RegisterClientScriptBlock(typeof(Page), "ActComboBoxFixer", vScript, true);

         }

         pComboBox.Page.ClientScript.RegisterArrayDeclaration("gActComboboxes", "'" + pComboBox.ClientID + "'");

      }

  

/// <summary>

/// Helps ModalDialogExtenders work with AjaxControlToolkit.ComboBox. Call for each ModalDialogExtender

/// that may have ComboBoxes. If you have more than one and they may appear simulateously, add them

/// in a specific order where the topmost one is added before those below it.

/// </summary>

/// <remarks>

/// <para>Requires each ComboBox is passed to ComboBoxFixer.RegisterComboBox.</para>

/// </remarks>

/// <param name="pModalExtender"></param>

      public static void RegisterModalPopupExtender(AjaxControlToolkit.ModalPopupExtender pModalExtender)

      {

         ClientScriptManager vClientScript = pModalExtender.Page.ClientScript;

         vClientScript.RegisterArrayDeclaration("gACTModalDEIDs", "'" + pModalExtender.ClientID + "'");

  

         if (!vClientScript.IsClientScriptBlockRegistered("ActComboBoxInMDE"))

         {

   // The basic idea: Replace AjaxControlToolkit._popupShown with ActComboBoxInMDE_PopupShown.

   // ActComboBoxInMDE_PopupShown is a clone of _popupShown, but inserts code to change x,y

   // when a ModalDialogExtender is visible. 

   // MDEs are registerd in the client-side array gACTModalDEIDs.

   // This allows multiple MDEs and will only evaluate the first whose content element (called _foregroundElement)

   // is visible. So if there are nested MDEs, register the topmost one first and bottommost last.

            string vScript =

            "function ActComboBoxInMDE_Init()\r\n" +

            "{\r\n" +

            "   if (window.gActComboboxes)\r\n" +

            "      for (var vI = 0; vI < gActComboboxes.length; vI++)\r\n" +

            "      {\r\n" +

            "         var vCB = $find(gActComboboxes[vI]);\r\n" +

            "         if (vCB.InitedMDE) continue;\r\n" +

            "         vCB._popupShown = ActComboBoxInMDE_PopupShown;\r\n" +

            "         vCB._popupShownHandlerFix = Function.createDelegate(vCB, ActComboBoxInMDE_PopupShown);\r\n" +

            "         vCB._popupBehavior.add_shown(vCB._popupShownHandlerFix);\r\n" +

            "         vCB.InitedMDE = 1;\r\n" +

            "      }\r\n" +

            "}\r\n" +

            "function ActComboBoxInMDE_PopupShown() {\r\n" +

            "\r\n" +

            "   this.get_optionListControl().style.display = 'block';\r\n" +

            "\r\n" +

            "   // check and enforce correct positioning.\r\n" +

            "   var tableBounds = Sys.UI.DomElement.getBounds(this.get_comboTableControl());\r\n" +

            "   var listBounds = Sys.UI.DomElement.getBounds(this.get_optionListControl());\r\n" +

            "   var textBoxBounds = Sys.UI.DomElement.getBounds(this.get_textBoxControl());\r\n" +

            "   var y = listBounds.y;\r\n" +

            "   var x;\r\n" +

            "\r\n" +

            "   if (this._popupBehavior.get_positioningMode() === AjaxControlToolkit.PositioningMode.BottomLeft\r\n" +

            "      || this._popupBehavior.get_positioningMode() === AjaxControlToolkit.PositioningMode.TopLeft) {\r\n" +

            "      x = textBoxBounds.x;\r\n" +

            "   }\r\n" +

            "   else if (this._popupBehavior.get_positioningMode() === AjaxControlToolkit.PositioningMode.BottomRight\r\n" +

            "      || this._popupBehavior.get_positioningMode() === AjaxControlToolkit.PositioningMode.TopRight) {\r\n" +

            "      x = textBoxBounds.x - (listBounds.width - textBoxBounds.width);\r\n" +

            "   }\r\n" +

            "\r\n" +

            "   if (window.gACTModalDEIDs)\r\n" +

            "      for (var vI = 0; vI < gACTModalDEIDs.length; vI++)\r\n" +

            "      {\r\n" +

            "         var vMDE = $find(gACTModalDEIDs[vI]);\r\n" +

            "         if (vMDE._foregroundElement.style.display == '')\r\n" +

            "         {\r\n" +

            "            var vMDBounds = Sys.UI.DomElement.getBounds(vMDE._foregroundElement);\r\n" +

            "            x = x - vMDBounds.x;\r\n" +

            "            y = (textBoxBounds.y + textBoxBounds.height) - vMDBounds.y;\r\n" +

            "            break;\r\n" +

            "         }\r\n" +

            "      }\r\n" +

            "   Sys.UI.DomElement.setLocation(this.get_optionListControl(), x, y);\r\n" +

            "\r\n" +

            "   // enforce default scroll\r\n" +

            "   this._ensureHighlightedIndex();\r\n" +

            "   this._ensureScrollTop();\r\n" +

            "\r\n" +

            "   // show the option list\r\n" +

            "   this.get_optionListControl().style.visibility = 'visible';\r\n" +

            "\r\n" +

            "}\r\n";

            vClientScript.RegisterClientScriptBlock(typeof(Page), "ActComboBoxInMDE", vScript, true);

  

            vClientScript.RegisterStartupScript(typeof(Page), "ActComboBoxInMDEInit",

               "Sys.Application.add_load(ActComboBoxInMDE_Init);\r\n", true);

  

            // on MDE popup, also fix comboboxes

            vScript =

            "function ActComboBoxInMDE_MDEPopupInit()\r\n" +

            "{\r\n" +

            "   if (window.gACTModalDEIDs)\r\n" +

            "      for (var vI = 0; vI < gACTModalDEIDs.length; vI++)\r\n" +

            "      {\r\n" +

            "         var vMD = $find(gACTModalDEIDs[vI]);\r\n" +

            "         vMD.add_shown(ActComboBoxInMDE_MDEPopupShown);\r\n" +

            "      }\r\n" +

            "}\r\n" +

            "function ActComboBoxInMDE_MDEPopupShown(sender, args)\r\n" +

            "{\r\n" +

            "   if (window.ActComboBoxMadeVisible_All)\r\n" +

            "      ActComboBoxMadeVisible_All();\r\n" +

            "}\r\n";

            vClientScript.RegisterClientScriptBlock(typeof(Page), "ActComboBoxInMDE_MDEPopupInitBlock", vScript, true);

            vClientScript.RegisterStartupScript(typeof(Page), "ActComboBoxInMDE_MDEPopupInit",

               "Sys.Application.add_load(ActComboBoxInMDE_MDEPopupInit);\r\n", true);

         }

      }

   }

You can retrieve a zip file with C# and VB versions of this code here.

Here is how to use this class:

Call ComboBoxFixer.RegisterComboBox(combobox) for each ComboBox that is initially hidden. Generally this is done in Page_Load or if inside of a Databound control like ListView or FormView, from their ItemCreated event.
Call ComboBoxFixer.RegisterModalPopupExtender(modalpopupextender) for each ModalPopupExtender that contains ComboBoxes. If you have nested ModalDialogs, register the topmost first.
If you have a button that makes the comboboxes visible, add this javascript to its client-side onclick event. It must be run after the comboboxes are visible.
```
ActComboBoxMadeVisible_All();
```

A little background on what these scripts do:

The ComboBox initializes the sizes of its toggle button and list when the page is first loaded. If this happens when the control is hidden, its calculations do not get the correct sizing information as the clientWidth and clientHeight properties of DOM elements are usually 0 in this case. The ActComboBoxMadeVisible(cb) function resets properties that determine width. It explicitly calls a function to recalculate the button size and lets the ComboBox’s _popupShowing() method use the rest to know to recalculate.
The ComboBox’s _popupShown() method calculates the x and y coordinates for the dropdownlist using the offset of its textbox from the upper left of the browser window. It uses style=”position:absolute;top:x;left:y;” to position it. This works well until the ModalPopupExtender gets involved. The ModalPopupExtender uses style=”position:fixed” and this appears to impact positioning. _popupShown() needs to position from the upper left of the <div> using that style=”position:fixed”.
To fix this, _popupShown() is replaced by a clone generated by ComboBoxFixer.RegisterModalPopupExtender(). This new function inserts code that detects if a ModalPopupExtender is visible and adjusts the x and y coordinates based on its location.

Defending against Lizamoon Attack

2011-04-03T18:47:00Z

Lizamoon is the name of a SQL Injection attack heavily reported in the press since the end of March 2011. It inserts a <script> tag into your database that when returned, redirects to another site (sometimes with the domain name Lizamoon). That site uses social engineering to entice the user to download what they think is antivirus software, and later to get them to provide credit card information to pay for it. At that point, the hackers have stolen their credit card information.

You can read more with these articles:

pcworld, April 1: “Millions of Sites Hit with Mass-Injection Cyberattack”

eweek, April 1, “'LizaMoon' Mass SQL Injection Attack Escalates Out of Control”

Based on this thread from last September amongst Stackoverflow.com users, I think this attack has existing long before the March 28 date reported in the press:

Attack on ASP site that uses a SQL server database (starts on Sept 10, 2010)

Users of Peter’s Input Security (a module within my Peter’s Data Entry Suite) have the tools to defend against this attack. But just having the tools, doesn’t mean you are protected. As a rule, you must evaluate any inputs of each page to determine if they are secure or not. A web page has these “inputs” which hackers use to attack: data entry controls like textboxes, cookies, hidden fields, and query string parameters. (They also can use web services.)

This post discusses how to check your Peter’s Input Security settings to defend against the Lizamoon attack.

If you are on a DES 4 version below 4.0.6, get to DES 4.0.6 and apply a hotfix. Future releases will have the hotfix incorporated. The hotfix introduces a new feature that further assists in protecting you, but is not required. If you are using VAM or do not want to use the hotfix, I’ve included instructions for you below.

Getting v4.0.6 and the hotfix

Note: This hotfix has a minor breaking change to Peter’s Input Security that is described in step 5 of “Protecting yourself with the DetectDatabaseElementNamesInQueryString property”, below.

You must use DES 4.0.6 to apply this hotfix.
If you do not have it installed, go to http://www.peterblum.com/getupdate.aspx, login and download it. If you do not know your login, get your serial number and contact Peter at PLBlum@PeterBlum.com to request it.
Run the .msi to install 4.0.6.
Run the v4.0.6 Web Application Updater with the option "Update a web application (service release)". This application is found in your Start menu and the folder where you installed DES.
Get the hotfix at http://www.peterblum.com/hotfixes/PeterBlum.DES4_0_6_5000.zip.
Note: This hotfix rolls up all previous hotfixes for v4.0.6.
Unzip the file.
Replace the PeterBlum.DES.dll in your web application. Be sure that your Visual Studio project has a reference to this new assembly.
Clear your IE9 RC1 browser's cache if you were already using 4.0.6.

Understanding the new feature of the hotfix

The new feature is the DetectDatabaseElementNamesInQueryString property on the PageSecurityValidator manager. When this property is true (the default), the PageSecurityValidator evaluates every query string parameter for any value defined in the <databaseelementnames> node of the [web app]\DES\Security Config Files\master.config file and report an error if found.

This feature detects lizamoon because the attack incorporates the names of tables and columns from you database, previously extracted through another hack directed at your databases’s master tables. Here is its SQL attack pattern:

update [your table name] set [your field name] = REPLACE(…)

The <databaseelementnames> section of master.config is intended to hold names of tables and important column names that you do not want to appear within your inputs. It works best when your table and column names are not spoken languages, such as using “tbl_client” instead of “client” for a table of clients. Here is an example of this node. (The file is here: [web app]\DES\Security Config Files\master.config)

<databaseelementnames>
   <item action="add" >tbl_products</item>
   <item action="add" >tbl_orders</item>
   <item action="add" >tbl_categories</item>
</databaseelementnames>

Protecting yourself with the DetectDatabaseElementNamesInQueryString property

By default, DetectDatabaseElementNamesInQueryString is true, which means the feature is active. Yet, it does nothing if you have not setup the page correctly.

1. If you are new to Peter’s Input Security, follow the directions of the Input Security Installation Guide. This will enable loading the various config files, have you describe key elements about your app, and install a logging feature to capture attacks.

2. If you have not setup the page for Peter’s Input Security, follow the steps in the “Securing a Page” section of the Input Security User’s Guide. There are many actions to lock down all inputs. Be prepared to spend some time protecting each page.

3. At this point, your page has a PageSecurityValidator with the DetectDatabaseElementNamesInQueryString set to true (the default). If you do nothing else, this attack will be prevented.

4. Query string parameters that accept string values may have legal values blocked by the DetectDatabaseElementNamesInQueryString property. Review those parameters against the values in the <databaseelementnames> node of [web app]\DES\Security Config Files\master.config. If there is a legal value, set DetectDatabaseElementNamesInQueryString to false. Then add a ParameterRule object to the QueryStringRules object with its DataType=String and DetectInjection=true (the default). Also adjust the SQLDetectionLevel property, which defaults to the highest protection.

<des:PageSecurityValidator ID="PageSecurityValidator1" runat="server" DetectDatabaseElementNamesInQueryString="false" >
   <QueryStringRules>
      <des:ParameterRule Name="search" DataType="String" DetectInjection="true" SQLDetectionLevel="MediumLow" />
   </QueryStringRules>
</des:PageSecurityValidator>

5. The hotfix also introduced a breaking change by changing the default of the DetectInjection property from false to true on the HiddenFieldRule, ParameterRule, and QueryStringRule objects. This breaking change only applies to Rules that:

do not set DetectInjection, thus using the default.
has its DataType property set to Ignore or String, or does not set DataType (which defaults to Ignore)

Look through your PageSecurityValidators to locate Rules that are now using DetectInjection=true. If you do not want that behavior, set its DetectInjection property to false.

Protecting yourself with VAM or without the DES hotfix

This topic helps users who have Professional Validation and More (“VAM”) as well as DES without the hotfix.

3. Review the QueryStringRules collection of each PageSecurityValidator to be sure that every query string parameter used by this page is listed, with the appropriate rules. When a ParameterRule has its DataType property set to Ignore or String, or it does not declare the DataType property are candidates for this attack. Your defense is to set DetectInjection to true.

<des:PageSecurityValidator ID="PageSecurityValidator1" runat="server" >
   <QueryStringRules>
      <des:ParameterRule Name="search" DataType="String" DetectInjection="true" />
   </QueryStringRules>
</des:PageSecurityValidator>

Exploring Dynamic Data: Other attributes for business logic

2009-12-29T22:21:00Z

Index to this series of articles

Business logic is applied to your Entity classes (objects that describe individual tables where columns are the properties) through metadata. Typically this metadata is defined by applying attributes from the System.ComponentModel.DataAnnotations namespace.

To successfully let business logic drive the user interface, you need an extensive library of business rules. Here are the additional business rules available as attributes. In my “Peter’s Soapbox”, you will find attributes that I feel need to be provided to complete the library.

DefaultValueAttribute – Supplies the initial value for the column when creating a new record. Generally this value is assigned to the user interface to establish a default. ASP.NET Dynamic Data supports it in the FieldValue property of FieldTemplateUserControl class. FieldValue is generally assigned to the data entry control when generating the HTML output. If in Insert mode, it uses the default. Otherwise it uses the value previously stored.
DisplayFormatAttribute – Column values that need to be displayed as strings use the DisplayFormatAttribute to assist in converting from its native type to the string.
DisplayColumnAttribute – Applied to the Entity class definition, it specifies which column to display in lists, such as those shown in filters or in foreign key links. For example, you may want to show the Last Name column in lists. By default, Dynamic Data uses the first column of type string that it finds. It also lets you change the default sorting, to specify a different column and sort order.
EditableAttribute - Introduced in .net 4, it's a bit like a security oriented attribute. It tells the client application whether a column can be made editable or not. It also tells the client application whether insert mode allows an entry. Typically its used to define a read only column and perhaps to express that the user can still enter a value in insert mode.
KeyAttribute – When your Entity class is not generated by Entity Framework or LINQ to SQL, use this attribute to identify columns that are primary keys. Primary keys have special behaviors in the user interface.

Peter’s Soapbox

Is that it? A handful of Validation attributes, 2 DataTypeAttributes, and the rest mentioned in the last few postings? I’ve already mentioned in those posts where I felt the attributes were lacking. Here’s some more.

Security roles attributes

Role-based security restrictions to tables and columns is industry standard stuff. Where’s the support?

My next release of Peter’s Data Entry Suite introduces the ColumnRestrictionAttribute and TableRestrictionAttribute. For example:

[DES.ColumnRestriction("Admin", DES.DenyAccess.None)]
[DES.ColumnRestriction("Sales", DES.DenyAccess.Insert | DES.DenyAccess.Edit)]
[DES.ColumnRestriction("Support", DES.DenyAccess.View)]
public object Photo { get; set; }

Dependency attributes

Often on field is required based on the state of another. For example, when the column “CustomerType” has a value of “Other”, the OtherDescription field should require a value. The user interface would enable and disable both the textbox and validator associated with the OtherDescription field based on the setting of the CustomerType DropDownList. It’s a pretty standard thing and not too difficult to create attributes to describe.

This is already supported in my Peter’s Data Entry Suite.

[DES.RequiredDependency(ColumnNames="PrinterType|FaxType",
    MultipleMode=PeterBlum.DES.MultipleRequiredControlsMode.AtLeastOne)]
public object OutputHeading {get; set; }

Column is sortable attribute

The column headers of the ListView and GridView can usually be clicked to sort them. Another user interface would be to offer a dropdownlist of sortable fields. These user interfaces should be driven by the business logic through a SortableColumnAttribute. It not only determines if sorting is active, but also specifies the Sort Expression to apply.

Again, already supported in my Peter’s Data Entry Suite.

[DES.SortableColumn(false)]
public object Notes { get; set; }

Using the CategoryAttribute

The System.ComponentModel.CategoryAttribute can be used in creative ways. Take a look at my earlier posting on the subject: The CategoryAttribute and Dynamic Data.

Text entry attributes

Often the only difference between string column values is the pattern and character set permitted. Both can be used by textboxes to enhance entry. In addition, they are used by validators. Here’s how.

Pattern. Think of the “masked textbox” concept. Let’s suppose that you declare:
```
[TextMask("999-999-9999")]
public object SocialSecurityNumber { get; set; }
```
The Text_Edit.ascx Field Template can use this to establish the MaskedEdit Extender control on it’s textbox. With a converter routine, it can also be converted into a regular expression that is applied to the RegularExpressionValidator in the Field Template. (Or the Field Template can create a MaskedEditValidator.)

I think the TextMaskAttribute should be a subclass of DataTypeAttribute so there can be a standard Field Template called TextMask_Edit.ascx.
Character set. Many strings don’t have a pattern, but have a limited character set. For example, a person’s first name may be limited to upper and lower case letters. Again the Field Template establishes the necessary javascript to apply the character set, and sets up the RegularExpressionValidator to limit to those characters.
```
[CharacterSet(Digits=true, Othercharacters="-")]
public object SocialSecurityNumber { get; set; }
```

Injection attack attributes

Business logic determines what’s legal within strings. Hackers employ SQL Injection and Cross Site Scripting attacks through your web form’s inputs. String type fields should determine what HTML patterns and SQL statements are allowed or rejected.

Field Templates should use these attributes to generate a CustomValidator control that invokes your Injection detection code (server side only). What? You don’t have one? There’s one in my Peter’s Data Entry Suite called Peter’s Input Security.

Once again: “Is that all?”

I highly doubt that’s all of the business rules for entity objects. Feel free to describe your own cases in the comments.

Index to this series of articles

Exploring Dynamic Data: Scaffolding attributes for business logic

2009-12-23T22:13:00Z

Index to this series of articles

Scaffolding is a term that describes letting the business logic determine the list of columns and tables displayed in your user interface. You see it in action when using Dynamic Data’s Page Templates. Yet, it is fine to explicitly define the list of columns in your user interface code, especially when you need flexibility in your layout from column to column.

The ScaffoldColumnAttribute and DisplayAttribute are both used to identify if a column is included or excluded. ScaffoldColumnAttribute was introduced first and has fewer capabilities. DisplayNameAttribute is new to .net 4, adding the Order and GroupName properties to the scaffolding rules.

[ScaffoldColumn(true)]
public object Picture { get; set; }

[Display(AutoGenerateField=true)]
public object Picture { get; set; }

You can read about my complaints of the DisplayAttribute’s design in the previous post. See the “Peter’s Soapbox” section.

When no attribute is supplied

When neither of these attributes are assigned, the Dynamic Data scaffolding engine determines if the field shows based on the following rules:

Included: A Field Template name is specified in the UIHintAttribute.
Excluded: MetaColumn.IsForeignKeyComponent = true (Part of a ForeignKeyColumn)
Excluded: MetaColumn.IsGenerated = true (The column’s data is generated by the database)
Included: MetaColumn.IsPrimaryKey = true (The column is a primary key)
Excluded: MetaColumn.IsCustomProperty = true (The column was created in the EntityTable class, but does not exist in the database)
Included: MetaColumnType is one of these: string, char, integer, floating point, bool, DateTime, TimeSpan, or DateTimeOffset.
Excluded: Anything not listed above.

Ordering the scaffolded columns

By default, Dynamic Data shows the columns in the same order they appear in the Entity class. If you want to change the order, use the DisplayAttribute. Its Order and GroupName properties are used by the scaffolding engine to sort the columns.

Scaffolding Tables

Like columns, Dynamic Data can provide a specific list of tables to show. Use the ScaffoldTableAttribute to exclude a table. When initializing Dynamic Data in Application_Start(), use the ScaffoldAllTables property to include all tables that are not set to [ScaffoldTableAttribute(false)].

DefaultModel.RegisterContext(typeof(NorthwindModel.Entities), 
    new ContextConfiguration() { ScaffoldAllTables = true });

This attribute impacts two features of Dynamic Data:

The “entry point” web form, which is Default.aspx, initially, can show this table. It internally uses the MetaModel.VisibleTables property to get a list of tables. Be aware that this list is ordered by how the Tables were defined by the ModelProvider class to the MetaModel class. If you want to control the ordering yourself, create a list of MetaTables in the desired order instead of using MetaModel.VisibleTables.
Url Routing will prevent Urls that contain table names that are not scaffolded.

Scaffolding for Filters

List oriented interfaces often have filters to let the user modify the query used to generate the list. Your business logic can assist your user interface in building filters with these two attributes:

DisplayAttribute – Use the AutoGenerateFilter property to include or exclude the column from your filter interface.
FilterUIHintAttribute – Specifies an alternative Filter Template file (a violation of the separation of concerns).

ASP.NET Dynamic Data uses this with its QueryableFilterRepeater control to generate a user interface based on business logic.

When no DisplayAttribute is supplied

When the DisplayAttribute is not assigned, the Dynamic Data scaffolding engine determines if the filter shows based on the following rules:

Included: A Filter Template name is specified in the FilterUIHintAttribute.
Excluded: The column is not scaffolded (see the earlier scaffolding rules for fields)
Excluded: MetaColumn.IsCustomProperty = true (The column was created in the EntityTable class, but does not exist in the database)
Included: MetaColumnType is one of these: bool, enumerated type
Excluded: Anything not listed above.

Index to this series of articles

Exploring Dynamic Data: Textual attributes for business logic

2009-12-21T22:07:00Z

Index to this series of articles

Each column has a name taken from the database. Yet there are many ways to display text about the column which does not match the column’s name. The DisplayAttribute (introduced in ASP.NET 4) provides the following properties that are available to your user interface:

Name – The column’s name corrected to reflect language and formatting issues.
ShortName – A shorter version of the Name.
Description – A description that may appear in a hint, tooltip or help label.
Prompt – A description that works well as a prompt, such as in a wizard or the label preceding a textbox.

This attribute supports resource based localization.

[Display(Name="Category", Prompt="Enter the category name")]
public object CategoryName { get; set; }

If you are still using ASP.NET 3.5, you can define the Name and Description from the System.ComponentModel.DisplayNameAttribute and System.ComponentModel.DescriptionAttribute classes. The rest are not available.

Naming for tables

Like a column, each table has a name taken from the database. If you want to display the table name, it may need an alternative version that reflects language and formatting issues.

[DisplayName("Categories")]
public class Category 
{ 
}

Peter’s Soapbox

I have mixed feelings about the DisplayAttribute introduced in .net 4. I feel it mixes too many concepts together and these concepts already had their own attributes.

Text – Already in DisplayNameAttribute and DescriptionAttribute. No support for ShortName and Prompt in the past though.
Scaffolding (the “AutogenerateField” property) – Allows business logic to dictate if the column appears. There already exists ScaffoldColumnAttribute, although this new version introduces the Order and GroupName properties to determine the column’s position.
I think that the new properties should have been added to the ScaffoldColumnAttribute. I foresee are additional rules for scaffolding which should appear in the framework, such as defining a list of columns that match a specific category. The ScaffoldColumnAttribute makes sense for this kind of growth.
Filter scaffolding (the “AutoGenerateFilter” property). Its another aspect to scaffolding that impacts generating a list of filters in the QueryableFilterRepeater control. This probably belongs in the ScaffoldColumnAttribute so it can share the Order and GroupName properties.
Again, there are probably other rules for scaffolding to come for filters. One is already defined in a separate attribute, FilterUIHintAttribute, which helps select the user interface used for filtering, such as setting up a range or a checkboxlist.

Index to this series of articles

Exploring Dynamic Data: The DataTypeAttribute for Business Logic

2009-12-16T22:00:00Z

Index to this series of articles

The DataTypeAttribute impacts the “data type” of a column. When defined in the database or a programming language, data types are integers, decimals, strings, etc. We use these to hold all kinds of real world types. Examples:

Integers: percentage, enumerated type, age
Decimals: currency, duration, distance, weight
Strings: phone number, postal code, email address, URL
DateTime: Date, time, Month/Year (credit card expiration), Birthday (day and month).

Each of these real-world data types have differences in their business rules. The user interface should respect these differences by using different data entry controls (like DateTextBox, Calendar, IntegerTextBox, etc) and validators.

Use the DataTypeAttribute to specify the real world type. Its parameter takes either a value from System.ComponentModel.DataAnnotations.DataType or a string. When the DataType enumerated list lacks the desired type, specify it as a string.

[DataType(DataType.Date)]
public object BirthDate { get; set; }
[DataType("Longitude")]
public object Longitude { get; set; }

Making DataTypeAttribute impact validation

Validation is a very important feature of business rules, and DataTypeAttribute is heavily involved. That’s why DataTypeAttribute is subclassed from System.ComponentModel.DataAnnotations.ValidationAttribute. Yet DataTypeAttribute’s implementation of the IsValid() method is to return true every time.

I recommend subclassing DataTypeAttribute for each data type where validation is needed and implementing the IsValid() method. For example:

public class DateAttribute : DataTypeAttribute
{
    public override bool IsValid(object instance)
    {
        if (instance is DateTime)
            return true;
        if (instance is string)
        {
            DateTime vTemp;
            return DateTime.TryParse((string)instance, out vTemp)
        }
        return false;
    }
}
public class EmailAddressAttribute : DataTypeAttribute
{
    public override bool IsValid(object instance)
    {
        if (instance is string)
        {
            return Regex.IsMatch((string) instance,
                "^[\w-\.]+@([\w-]+\.)+[\w-]{2,4}$");
        }
        return false;
    }
}

How Dynamic Data uses the DataTypeAttribute

ASP.NET Dynamic Data uses the DataTypeAttribute to select a Field Template. Field Templates are User Control files that define the user interface for a specific data type in a specific situation. The situation includes the mode – read-only, edit, or insert – and other ways the user interface may change. Field Templates for edit and insert mode should create Validation web controls based on the business logic.

Here are some guidelines for creating Field Templates which respect DataTypeAttributes:

The file name of the Field Template should be the same as the value passed into the DataTypeAttribute’s parameter, plus “_Edit” or “_Insert” for the desired mode. For example, DataTypeAttribute(DataType.EmailAddress) should have a Field Template named “EmailAddress_Edit.ascx”.
The data entry control should be suitable for the data type. Generally you will use a TextBox for string-types, although its not a requirement.
When using a textbox, always define a Validator web control that will enforce the data type. Typically you will add the CompareValidator, RegularExpressionValidator, or CustomValidator.
- The CompareValidator works for non-string types. Set its Operator property to the desired type. If the Operator doesn’t match the type you need, use one of the other two validators.
- The RegularExpressionValidator works for string types that have a pattern. Your business logic may specify the RegularExpressionAttribute to deliver a regular expression to this validator, letting Dynamic Data automatically connect the two. As a result, there will be two attributes: DataTypeAttribute and RegularExpressionAttributes. It would be nice to combine these two.
- The CustomValidator handles everything else.

The EnumDataTypeAttribute

The EnumDataTypeAttribute is a DataTypeAttribute subclass for one very common case: Enumerated types. It can be assigned to properties whose type is an enumerated type, a string, or integer.

The EnumDataTypeAttribute maps a list of strings to the value stored in the data. It gets those strings from the actual enumerated type definition. For example:

public enum Movement
{
    Stop,
    Slow,
    Normal,
    Fast,
    Excessive
}

[EnumDataType(typeof(Movement))]
public int VehicleMovement { get; set; }

Dynamic Data provides the Enum.ascx and Enum_Edit.ascx Field Templates to display the list of strings from this attribute. In edit mode, it gives you a DropDownList.

Peter’s soapbox

While its easy to setup, I dislike supplying the list of strings from the enumerated type. Values in the type are usually not correct for the language and lack formatting. In my Peter’s Data Entry Suite, I created an EnumeratedAttribute to handle this. While it can be setup using the enumerated type, you can also define strings explicitly, including culture specific strings.

Index to this series of articles

Exploring Dynamic Data: Validation attributes for business logic

2009-12-14T22:01:00Z

Index to this series of articles

Validation attributes focus on evaluating data to report errors. The base class is System.ComponentModel.DataAnnotations.ValidationAttribute. It defines the IsValid() method, which is always overriden to evalutate the data. It also supplies the ErrorMessage property, where you can describe the error reported. (I have complaints about using the error message here. See Where does this go? Applying SoC to dynamic data – Part 2.)

The namespace defines the following attributes to validate your data.

RequiredAttribute – Marks the field as required. If your database already defines the column as “not nullable”, Dynamic Data knows that the field is required. Yet, since your Entity classes may be used outside of Dynamic Data, always consider assigning this.
```
[Required()]
public object Name { get; set; }
```
Concerns

This attribute is limited to testing text returned from the browser and is generally mapped to the RequiredFieldValidator web control.

It is further limited to considering only the empty string is invalid, whereas you can use the InitialValue property on RequiredFieldValidator to recognize another case (a watermark in the textbox).
RegularExpressionAttribute – Evaluates text against a regular expression. Dynamic Data maps this attribute to the RegularExpressionValidator web control.
```
[RegularExpression("^\d{5}$")]
public object ZipCode { get; set; }
```
Concerns

Like with the RegularExpressionValidator, this attribute has no way to set the “ignore case” or “multiline” options, which are useful in developing regular expressions.

When this expression is used with server side validation, it will use the .net framework’s regular expression engine. When it is used within the browser, it uses javascript’s regular expression engine. Javascript has a simpler syntax. Take care to define your expressions with the Javascript syntax when using Dynamic Data. See Javascript RegExp class guide.
StringLengthAttribute – Evaluates the length of text to confirm it has not exceeded a maximum value. If your database already defines the length on a textual column, Dynamic Data has access to that value. Yet, since your Entity classes may be used outside of Dynamic Data, always consider assigning this.
```
[StringLength(10)]
public object SocialSecurityNumber { get; set; }
```
Concerns

None of the Field Templates actually include a validator web control for this attribute. Those that have single-line textboxes (like Text_Edit.ascx) set their TextBox control’s MaxLength property. If you are using a multiline textbox, you will need to introduce a validator. I recommend using the RegularExpressionValidator with its expression programmatically set in the Field Template’s Page_Load method to a pattern like this:
```
^[\s\S]{0,#}$
```
where # is replaced by the value from the Field Template’s Column.MaxLength property. Do NOT attach your validator to the FieldTemplateUserControl’s class by using the SetupValidator() method as that try to associate it with the RegularExpressionAttribute. It will either have its expression updated or be disabled.

Instead, I recommend creating a method in the Field Template that sets it based on the StringLengthAttribute and if not found, sets the Validator’s Enabled property to false.
RangeAttribute – Confirms that the value is between a low and high value of a range. Dynamic Data maps this attribute to the RangeValidator web control.
If you only want to compare greater than or equal to a value, just set the low (the Minimum property). Similarly set Maximum to compare less than or equal to the high value.
```
[Range(0, 100)]
public object Percentage{ get; set; }
```
CustomValidationAttribute – (requires ASP.NET 4). Lets you add a method to your Entity class which will be invoked to validate the column in some way. It can also evaluate multiple columns of an entity. The CustomValidationAttribute only validates on the server side. Dynamic Data uses its DynamicValidator web control to report errors.
See my earlier posting, “The CustomValidationAttribute”.

While Dynamic Data installs validator web controls into the user interface, your Entity class should never assume that validation was handled elsewhere. It should always run a final validation against the validation rules that you have created. Use the System.ComponentModel.DataAnnotations.Validator class to run that validation. Typically you will call its TryValidateObject() method. It throws an exception for the first error

In this example, the Products table has a method called OnValidate() which invokes it. (OnValidate() is defined in Linq to SQL Entities automatically, but the call to TryValidateObject is not.)

public class Product
{
    public void OnValidate(System.Data.Linq.ChangeAction pAction)
    {
        List<ValidationResult> vErrors = new List<ValidationResult>();
        Validator.TryValidateObject(this,
            new ValidatorContext(this, null, null), vErrors);
        if (vErrors.Count > 0)
            throw new Exception(vErrors[0].ErrorMessage)
    }
}

Peter’s Soapbox

As many of you know, I have been developing an enhanced validation framework for ASP.NET for years. I’ve found and fixed numerous limitations. Not surprisingly, I find that many of my concerns remain unresolved within the Validation Attributes. I have worked to fix all of the complaints listed in this posting in my Peter’s Data Entry Suite. You’ll learn more here.

Field Templates cannot setup “compare two field” validators

One of the most common validation rules is not available as a ValidationAttribute: comparing two fields. For example, BirthDate < HireDate. This expression is easily represented with the CompareValidator in the web form level:

<asp:CompareValidator id="CompareBirthToHire" runat="server" 
    ControlToValidate="BirthDateTextBox" ControlToCompare="HireDate" 
    Operator="LessThan" Type="Date" />

Field Templates are supposed to automatically setup Validator web controls like this based on the ValidationAttributes. I’d like to see something like:

[CompareColumn(OtherColumn="HireDate", Operator="LessThan")]
public DateTime BirthDate { get; set; }

Without this, you can still use the CustomValidatorAttribute on the class definition, but it is strictly server side. Field Templates do not manage a validator web control associated with it.

There are a few issues to fixing this problem, including:

Property-level validation only passes in the value of the property itself, not the overall object, to the IsValid() property. Therefore IsValid cannot see the second property’s value. Yet this is fixable because IsValid actually can be passed a second value, the entire instance, in the ValidationContext property. This issue requires a change to the DynamicValidator class. More importantly, if the goal is to convert the CompareColumnAttribute into a CompareValidator web control, we really don’t care about the IsValid method.
The two columns are converted into HTML using separate Field Templates. Each is a User Control, which means it uses a separate Naming Container. As a rule, properties on web controls take an ID to controls in the same naming container. So the CompareValidator cannot locate the two textboxes. My own Validator classes allow attaching to the textbox object as an alternative. You can learn more about my philosophy here: Improving ASP.NET: Finding Controls.

There are many more common validation rules

My validation suite includes around 25 Validator web controls. There are so many reusable ways to validate. In my Dynamic Data solution, I’ve created numerous ValidationAttributes.

Field Templates may not be coded to handle every ValidationAttribute

The Field Template must create a Validator web control for each ValidationAttribute declared on the column. Its easy to introduce a new ValidationAttribute on your business logic without it impacting the Field Template for which it was intended. For example, the default field template for strings, Text_Edit.ascx, lacks a validator for the StringLengthAttribute. Your Entity class should still catch errors prior to saving by using the System.ComponentModel.DataAnnotations.Validator class. But the Validator class is strictly server side.

In my solutions, I chose to abandon defining Validator web controls in the Field Template. Instead, the user drops in a new control called ColumnValidationManager. This control evaluates the list of ValidationAttributes on the column and creates all validators it needs. To work, the ValidationAttribute class must help out. My extensions to the ValidationAttribute class include methods to return an instance of the web control that will be used. If you do the same, be sure to also add the DynamicValidator in your validator generator code.

Here’s my version of Text_Edit.ascx Field Template:

<%@ Control Language="C#" AutoEventWireup="true" Inherits="PeterBlum.DES.DynamicData.TextEditFTUC" %>
<%@ Register assembly="PeterBlum.DES.DynamicData" namespace="PeterBlum.DES.DynamicData" tagprefix="desDD" %>
<script runat="server">   1:  
   2:    protected void Page_Init(object sender, EventArgs e)
   3:    {
   4:       SetUpEditableDataControl(TextBox1);
   5:       SetUpColumnValidatorManager(ColumnValidatorManager1);
   6:    }
</script>
<des:FilteredTextBox ID="TextBox1" runat="server" ></des:FilteredTextBox>
<desDD:ColumnValidatorManager ID="ColumnValidatorManager1" runat="server" />

Index to this series of articles

Exploring Dynamic Data: Article Index

2009-12-14T21:31:00Z

This is the index to a series of articles, to be published periodically, about the elements of ASP.NET Dynamic Data. It focuses on specific technologies, especially the web controls you use to build a Dynamic Data-based web form. As the author of Peter’s Data Entry Suite, I have identified limitations and gaps in Dynamic Data which I will also discuss. My commercial solution resolves many of those limitations and gaps.

Data Source controls to interact with your business logic – Discusses which DataSource web controls are best for good separation of concerns between UI and business logic.
Validation attributes for business logic. A look at the Validation attributes in System.ComponentModel.DataAnnotations.
DataTypeAttribute for business logic.
Textual attributes for business logic. The many ways to associate text with column and table elements.
Scaffolding attributes for business logic. What is scaffolding and how to manage it.
Other attributes for business logic. Includes my thoughts on what business logic attributes are missing.
Field Templates – Pending. The user interfaces for each data type.
DynamicControl and DynamicField – Pending. The mainstay web control for a user interface of a column in your business logic.
DynamicValidator control – Pending. Displays errors generated by your business logic.
Entity Templates – Pending. A user interface with webcontrols (including DynamicControls) and HTML to describe typical situation, such as a two column row in a detail record, an email entry, and a street address entry.
DataBound controls – Pending. ListView, FormView, GridView, and DetailsView are DataBound controls. Dynamic Data requires one as a container for any DynamicControl or DynamicField.
DynamicDataManager control – Pending. Connects Dynamic Data technology to the DataBound control.
DynamicFilter, FilterRepeater, and DynamicFilterRepeater – Pending. For building filtering user interfaces.
DataPager control – Pending. More than just for Dynamic Data, but central to managing list-based DataBound controls.
QueryExtender – Pending. Connects DynamicFilterRepeater with the DataSource control.
Page Templates – Pending. Provides nearly instant applications completely driven by scaffolding and other business logic attributes.
DynamicHyperlink control – Pending. Delivers a hyperlink that defines its URL based on URL routing rules.
What’s missing – Pending. Other elements that I’ve implemented to make Dynamic Data more robust.

Reflection on a method with an out parameter

2009-12-10T19:47:00Z

As I code my commercial Dynamic Data libraries for ASP.NET 4 support, I’ve elected to deliver one assembly compiled under .net 3.5 SP 1 that also supports new features of ASP.NET 4. 3.5SP1 is the initial release of Dynamic Data. To interact with the new properties and methods in ASP.NET 4, I am using .net Reflection.

I have long used .net reflection, so I didn’t think there were many more things to learn. Today I encountered a new case, a method that has an out parameter.

Here’s the method I wanted to call. It's on the class System.Web.DynamicData.DynamicDataExtensions:

public static bool TryGetMetaTable(this INamingContainer control, out MetaTable table);

To call a function using .reflection, you take these actions:

Call a GetMethod(“methodname”) method on the specific type.
Call the Invoke method on the MethodInfo object that was returned by GetMethod.

If this function did not have an out parameter, the code would look like this:

Type[] vTypes = new Type[] { typeof(INamingContainer), typeof(MetaTable) };
MethodInfo vTGMTMI = typeof(DynamicDataExtensions).GetMethod("TryGetMetaTable", BindingFlags.Public | BindingFlags.Static,  
   null,  vTypes, null);
if (vTGMTMI == null)
   throw new NotImplementedException("Must use ASP.NET 4.0 or higher.");

object[] vParms = new object[] { GridView, null };
bool vResult = (bool) vTGMTMI.Invoke(null, BindingFlags.InvokeMethod, null, vParms, null);
if (vResult)
  // metatable returned is in vParms[1]

The GetMethod() method gets more complex with that out parameter. You must pass the output parameter TYPE as a reference to the intended type.

Approach 1 - Using Type.MakeByRefType

As pointed out in the comments, the Type class has the tools needed. Use the method MakeByRefType() like this:

Type[] vTypes = new Type[] { typeof(INamingContainer), typeof(MetaTable).MakeByRefType() };

Approach 2 - Using GetType("string")

Before learning of the MakeByRefType() method, I used this technique. I wanted to keep it in the post because I educates on how to use GetType("string") for an out parameter.

Pass the fully qualified type name into the Type.GetType(“string of the type”) method. The type within the string must be:

full name
end with “&” to indicate its a pointer

Here is the MetaTable class as a full qualified name, including type, &, and assembly name:

Type.GetType("System.Web.DynamicData.MetaTable&, System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35")

Here’s the corrected code, allowing the MetaTable's type supply both full names.

Type vMetaTableP = Type.GetType(typeof(MetaTable).FullName + "&," + typeof(MetaTable).Assembly.FullName);
Type[] vTypes = new Type[] { typeof(INamingContainer), vMetaTableP };

The big trick is to avoid using typeof(MetaTable).AssemblyQualifiedName, because it omits the “&”.

Putting it all together

This is the complete code using my preferred solution, MakeByRefType().

Type[] vTypes = new Type[] { typeof(INamingContainer), typeof(MetaTable).MakeByRefType() };

MethodInfo vTGMTMI = typeof(DynamicDataExtensions).GetMethod("TryGetMetaTable", BindingFlags.Public | BindingFlags.Static,  
   null,  vTypes, null);
if (vTGMTMI == null)
   throw new NotImplementedException("Must use ASP.NET 4.0 or higher.");

object[] vParms = new object[] { GridView, null };
bool vResult = (bool) vTGMTMI.Invoke(null, BindingFlags.InvokeMethod, null, vParms, null);
if (vResult)
  // metatable returned is in vParms[1]

Note that the GetMethod takes a parameter of type ParameterModifier. It certainly is involved with out parameters, but only when calling COM functions. In this case, the last parameter for GetMethod is null instead of a ParameterModifier array.

The CategoryAttribute and Dynamic Data

2009-12-09T16:08:00Z

The System.ComponentModel.CategoryAttribute has long been around. It’s generally used for annotating properties on web controls so that design mode’s Property Editor can organize your properties.

I think the CategoryAttribute makes a lot of sense as business logic in your Entity classes. By categorizing properties, your user interface can get creative:

Automatic scaffolding can be generated based on matched categories. This requires writing a custom FieldGenerator class.
Field Templates can customize themselves. For example, the Text.ascx Field Template uses a default style sheet class on its <asp:Label> control. When the Category is set to “Title”, the Field Template can change the style sheet class to one that uses a different font.

The CategoryAttribute takes one value, a string. This is supposed to represent a single category.

[Category("Title")]
public object Name { get; set; }

I recommend allowing multiple categories in a pipe character delimited list:

[Category("Title|ProperName")]
public object Name { get; set; }

This allows much more flexibility.

The CategoryManager class

Add this class to your application. It checks your requested category names against those in the CategoryAttribute.

using System.Web.DynamicData;
using System.ComponentModel;
using System.Text.RegularExpressions;
using System.Linq;
public static class CategoryManager
{
/// <summary>
/// Checks the MetaColumn's CategoryAttribute against the filtering rules to determine if there is a match.
/// </summary>
/// <remarks>
/// <para>Works as a Extender method on the MetaColumn class.</para>
/// </remarks>
/// <param name="pColumn">The MetaColumn that has a list of attributes. They are searched for the CategoryAttribute.</param>
/// <param name="pCategories">A pipe delimited list of Categories that must either be present or absent based
/// on pExcludeCategories.</param>
/// <param name="pExcludeCategories">When true, none of the category names in pCategories must be in the CategoryAttribute.</param>
/// <param name="pCategoriesWithNoMatchAreExcluded"> Determines what happens when 
/// pCategories does not contain a matching name to the CategoryAttribute’s value, 
/// including when the MetaColumn lacks a CategoryAttribute.</param>
/// <returns>When true, keep the column</returns>
public static bool CheckCategories(this MetaColumn pColumn, string pCategories, bool pExcludeCategories, bool pCategoriesWithNoMatchAreExcluded)
{
    CategoryAttribute vCA = pColumn.Attributes.OfType<CategoryAttribute>().FirstOrDefault();
    return CheckCategories(vCA, pCategories, pExcludeCategories, pCategoriesWithNoMatchAreExcluded);
} // CheckCategories
/// <summary>
/// Checks the CategoryAttribute against the filtering rules to determine if there is a match.
/// </summary>
/// <param name="pCategoryAttribute">The CategoryAttribute. Can be null.</param>
/// <param name="pCategories">A pipe delimited list of Categories that must either be present or absent based
/// on pExcludeCategories.</param>
/// <param name="pExcludeCategories">When true, none of the category names in pCategories must be in the CategoryAttribute.</param>
/// <param name="pCategoriesWithNoMatchAreExcluded"> Determines what happens when 
/// pCategories does not contain a matching name to the CategoryAttribute’s value, 
/// including when the CategoryAttribute is null.</param>
/// <returns>When true, the rules matched the CategoryAttribute.</returns>
public static bool CheckCategories(CategoryAttribute pCategoryAttribute, string pCategories, bool pExcludeCategories, bool pCategoriesWithNoMatchAreExcluded)
{
    if (pCategoryAttribute == null)
        return !pCategoriesWithNoMatchAreExcluded;
    // Both CategoryAttribute.Value and pCategories are pipe delimited lists
    // Convert CategoryAttribute.Value to a regex that can find one match in Categories.
    string vPattern = cPipeDelimitedLeft + pCategories + cPipeDelimitedRight;
    if (Regex.IsMatch(pCategoryAttribute.Category, vPattern, RegexOptions.IgnoreCase))
        return !pExcludeCategories;
    return pCategoriesWithNoMatchAreExcluded;
}
/// <summary>
/// When searching a pipe delimited list for a match, this regex should appear
/// first, before the string containing the list.
/// </summary>
    const string cPipeDelimitedLeft = @"(^|[\|])(";
/// <summary>
/// When searching a pipe delimited list for a match, this regex should appear
/// last, after the string containing the list.
/// </summary>
    const string cPipeDelimitedRight = @")($|[\|])";
}

Automatic Scaffolding using Categories

Here is a basic implementation of IAutoFieldGenerator with support for category attribute searches.

using System.Collections;
using System.Web.DynamicData;
using System.Web.UI;
using System.Web.UI.WebControls;

public class CategoryFieldsGenerator : c
{
   private MetaTable _metaTable;

/// <summary>
/// The mode used by the caller: ReadOnly, Edit, Insert.
/// </summary>
   public DataBoundControlMode Mode { get; set; }
/// <summary>
/// Is the interface a list or item?
/// </summary>
   public ContainerType ContainerType { get; set; }

/// <summary>
/// When true, ignore the MetaColumn.IsScaffold property. Just use the CategoryAttribute
/// even if [ScaffoldColumnAttribute(false)].
/// When false, limit to those that are MetaColumn.IsScaffold = true
/// </summary>
   public bool IgnoreScaffold { get; set; }


/// <summary>
/// A pipe delimited list of the categories either to include or exclude in the list of 
/// DynamicFields returned.
/// </summary>
/// <value>
/// <para>Use a Pipe delimited list for multiple items; matching is case insensitive.</para>
/// </value>
   public string Categories { get; set; }

/// <summary>
/// Determines what happens when the Categories property contains a matching name 
/// to the CategoryAttribute’s value. Normally when the Category name is found 
/// in the CategoryAttribute, that NamedStyle is a match. This property can make 
/// that NamedStyle not match.
/// </summary>
/// <value>
/// <para>When true, exclude data fields with any of these category names.</para>
/// <para>When false, include data fields with any of these category names.</para>
/// </value>
   public bool ExcludeCategories { get; set; }

/// <summary>
/// Determines what happens when the Categories property does not contain a matching name to the CategoryAttribute’s value, 
/// including when the data field lacks a CategoryAttribute.
/// </summary>
/// <value>
/// <para>When true, the DynamicField is omitted.</para>
/// <para>When false, the DynamicField is included.</para>
/// </value>
   public bool CategoriesWithNoMatchAreExcluded { get; set; }

   public CategoryFieldsGenerator(MetaTable table, DataBoundControlMode mode, ContainerType containerType,
      string categories, bool excludeCategories, bool categoriesWithNoMatchAreExcluded)
   {
      _metaTable = table;
      Mode = mode;
      ContainerType = containerType;
      Categories = categories;
      ExcludeCategories = excludeCategories;
      CategoriesWithNoMatchAreExcluded = categoriesWithNoMatchAreExcluded;
   }
   public CategoryFieldsGenerator(MetaTable table, DataBoundControlMode mode, ContainerType containerType,
      string categories) : this (table, mode, containerType, categories, false, true)
   {
   }

   public ICollection GenerateFields(Control control)
   {

      List<DynamicField> fields = new List<DynamicField>();
      IEnumerable<MetaColumn> columns = IgnoreScaffold ? _metaTable.Columns : _metaTable.GetScaffoldColumns(Mode, ContainerType);
      foreach (MetaColumn column in columns)
      {
         if (CategoryManager.CheckCategories(column, Categories, ExcludeCategories, CategoriesWithNoMatchAreExcluded))
            fields.Add(CreateField(column));
      }

      return fields;
   }

   protected virtual DynamicField CreateField(MetaColumn column)
   {
        DynamicField dynamicField = new DynamicField();
        dynamicField.DataField = column.Name;
        dynamicField.HeaderText = ContainerType == ContainerType.List ? column.ShortDisplayName : column.DisplayName;
        return dynamicField;
   }
}

In your web form’s Page_Init() method, create the CategoryFieldGenerator and assign it to the GridView.ColumnsGenerator or DetailsView.RowsGenerator. This example includes all columns that have the category “Small”, so long as they are also scaffoldable. (IgnoreScaffold property is false.)

table = LinqDataSource1.GetTable();
GridView1.ColumnsGenerator = new CategoryFieldGenerator(table, DataBoundControlMode.ReadOnly, ContainerType.List, "Small");

Changing the Style Sheets within Field Templates

In Page_Load, update the CssClass property on the desired controls based on the category. This example looks for “Title” and switches to the alternate style sheet.

<script runat="server">
   1:  

   2: public override Control DataControl { get { return FieldValueLabel; }}

   3: protected void Page_Load(object sender, EventArgs e)

   4: {

   5:     if (CategoryManager.CheckCategories("Title", false, false))

   6:         FieldValueLabel.CssClass = "TitleLabel";

   7:     else

   8:         FieldValueLabel.CssClass = "StndLabel";

   9: }
</script>
<asp:Label ID="FieldValueLabel" runat="server" ></asp:Label>

Peter’s Soapbox

I encourage the ASP.NET Dynamic Data team to include support for the CategoryAttribute (or some variation of it) in a future release. I have no problem with MS or anyone else using the code of this posting. I consider it public domain and does not require a license.

The CustomValidationAttribute

2009-12-07T17:31:00Z

.net 4 introduces the CustomValidationAttribute, a member of System.ComponentModel.DataAnnotations that supports validation of your business logic. Until now, validation rules were limited based on the available attributes (required, stringlength, regex, and range) plus those you created by subclassing System.ComponentModel.DataAnnotations.ValidationAttribute. CustomValidationAttribute lets you define new validation rules directly on your Entity class (or the class of your choice) without having to subclass from ValidationAttribute.

Unfortunately at this time, the documentation on this attribute is limited. This posting is an attempt to document it better.

The CustomValidationAttribute can validate an individual property or the complete object (the Entity instance). This is an example using the Category table from Northwind DB and LINQ to SQL.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.ComponentModel.DataAnnotations;
using System.Text.RegularExpressions;

[MetadataType(typeof(CategoryMetadata))]
[CustomValidation(typeof(Category), "FinalCheck")]
public partial class Category
{
   public class CategoryMetadata
   {
      [CustomValidation(typeof(Category), "TestCategoryName")]
      public object CategoryName { get; set; }
   }

   // method defined by LINQ to SQL on every Entity class.
   partial void OnValidate(System.Data.Linq.ChangeAction action)
   {
      List<ValidationResult> vErrors = new List<ValidationResult>();

      // validate class-level attributes
      // When the last parameter is true, it also evaluates all ValidationAttributes on this entity's properties
      Validator.TryValidateObject(this, new ValidationContext(this, null, null), vErrors, true);

      // handle errors
      if (vErrors.Count > 0)
         throw new ValidationException(vErrors[0], null, this);

   }

   public static ValidationResult FinalCheck(Category pCategory, ValidationContext pValidationContext)
   {
      if (pCategory.Description.Length < 10)
         return new ValidationResult("Description must be at least 10 characters.", new List<string> { "Description" });
      return ValidationResult.Success;
   }

   public static ValidationResult TestCategoryName(string pNewName, ValidationContext pValidationContext)
   {
      if (Regex.IsMatch(pNewName, @"^\d")) // cannot start with a digit
         return new ValidationResult("Cannot start with a digit", new List<string> { "CategoryName" });
      return ValidationResult.Success;
   }
}

Understanding the CustomValidatorAttribute definition

It can be placed on the class or property definition. Both are shown above.
The class that contains your validation method must always be declared, even if the method is in the same class this attribute is assigned.
You may want to create a separate class for all validation rules of your entity, such as “class CategoryValidation”.
The method name property must be a case sensitive match your method name.

Understanding the method definition

The method itself must be static and public.
The first parameter is the value to evaluate.
- When the method is associated with the class, it will be passed an instance of the Entity. It can be typed to match the class of the Entity, such as it is with “Category” above. It can also be typed to “object”.
- When the method is associated with a property, it will be passed the value of the property. It can be typed to match the type of the property, such as it is with “string” above. It can also be typed to “object”.
The second parameter, ValidationContext, describes other details about the activity. It’s more important when validating a property since it supplies the instance of the Entity (ObjectInstance property) and the property name (MemberName property). It’s also possible that this parameter will be null, but that generally occurs when using .net 3.5 libraries. So test for that.
Always return an instance of System.ComponentModel.DataAnnotations.ValidationResult. When there is no error, just return the static property ValidationResult.Success, as shown above. Otherwise return a description and optionally the property name(s) with errors.

Invoking Validation

Your CustomValidation methods are not called automatically (despite what the documentation presently says in the “Remarks” section). ASP.NET Dynamic Data knows to evaluate the property-based ValidationAttributes when there is a DynamicValidator control on the page. But since your Entity class may be reused, do not assume that Dynamic Data has done the job. Create a method on your Entity class to validate both class and property-level CustomValidationAttributes. Use System.ComponentModel.DataAnnotations.Validator.TryValidateObject() to do the job, as is shown above. Always pass true as the last parameter to insure the properties are validated. (If you pass false or omit the parameter, it will only validate the RequiredAttributes on properties.)

The OnValidate() method above is part of LINQ to SQL. Each Entity class has a partial method called OnValidate(). You create the other partial method in your code and LINQ to SQL will call it automatically. If you are using Entity Framework or another system, you must create and invoke your own “OnValidate()” method.

Communicating Errors to the User Interface

Your error messages from the ValidationResult class somehow have to be shown in the user interface. A method like OnValidate() has no direct way to pass up the list of ValidationResults. Instead, it throws a System.ComponentModel.DataAnnotations.ValidationException. (Unfortunately, it does not pass the list of ValidationResults in that exception class. You may want to build another Exception class to deliver them.)

The user interface should catch the exception and route the messages to its error display. When using ASP.NET with Dynamic Data, make sure you have a ValidationSummary and DynamicValidator control on the page, and Dynamic Data will take care of the rest. The Page Templates are setup this way.


<asp:ValidationSummary ID="ValidationSummary1" runat="server" 
    HeaderText="List of validation errors" />
<asp:DynamicValidator runat="server" ID="DetailsViewValidator" 
    ControlToValidate="FormView1" Display="None" />
<asp:FormView runat="server" ID="FormView1" >

Suppose you are creating a new Category and enter a name starting with a digit. Your validation rules will report an error like this:

Validating CheckBoxLists when using ClientIDMode=Predictable

2009-12-04T20:00:00Z

A common question on the www.asp.net forums asks how to validate a CheckBoxList control. There are two cases:

Require at least one checkbox
Require a specific number of checkboxes

In the past, I’ve answered this question in a way that now breaks when the new ClientIDMode property is set to Predictable. (For more, see “The impact of ClientIDMode=Predictable”.)

The old way

Look at the HTML generated by the CheckBoxList control. It has a specific pattern where every <input type="checkbox"> tag has an ID based on the ClientID of the control.

<span id="CheckBoxList1">
    <input type="checkbox" id="CheckBoxList1_0" >
    <input type="checkbox" id="CheckBoxList1_1">
    <input type="checkbox" id="CheckBoxList1_2">
    <input type="checkbox" id="CheckBoxList1_3">
</span>

I recommended using a CustomValidator. The server side code is easy.

protected void RequiredCBL(object source, ServerValidateEventArgs args)
{ 
    int count = 0; 
    CustomValidator val = (CustomValidator) source; 
    CheckBoxList cbl = (CheckBoxList) val.FindControl(val.ControlToValidate); 
    foreach (ListItem item in cbl.Items) 
        if (item.Selected) 
            count++; 
    args.IsValid = (count > 0);
}

The client-side code I used to recommend looked like this:

<script type='text/javascript'>

function RequiredCBL(sender, args)
{
    var count = 0;
    for (var i = 0; true; i++)
    {
        var listitem = document.getElementById(sender.controltovalidate + "_" + i.toString());
        if (!listitem)
            break; //!done
        if (listitem.checked)
            count++;
    }
    args.IsValid = count > 0;
}

</script>

ClientIDMode=Predictable can change the id= attributes of the <input type='checkbox'> elements by appending “_row#” when the control is inside ListView and FormView.


<span id="CheckBoxList1">
    <input type="checkbox" id="CheckBoxList1_0_0" >
    <input type="checkbox" id="CheckBoxList1_1_0">
    <input type="checkbox" id="CheckBoxList1_2_0">
    <input type="checkbox" id="CheckBoxList1_3_0">
</span>

Unfortunately, you cannot use the previous client-side script as this breaks:

var listitem = document.getElementById(sender.controltovalidate + "_" + i.toString());

and you cannot just do this:

var listitem = document.getElementById(sender.controltovalidate + "_" + i.toString() + "_0");

because the additional component depends on the row number.

The new way

Microsoft’s web validation code has to handle this for RadioButtonLists. It does so by searching the child HTML tree of the CheckBoxList. Let’s use that technique, but my implementation creates an array of DHTML input elements once to be reused.

<script type='text/javascript'>


function RequiredCBL(sender, args)
{
    var count = 0;
    var checkboxes = GetBtnList(document.getElementById(sender.controltovalidate));
    for (var i = 0; i < checkboxes.length; i++)
    {
        if (checkboxes[i].checked)
            count++;
    }
    args.IsValid = count > 0;
}
// Returns a list of input elements contained within a CheckBoxList or RadioButtonList control's HTML
// The first call creates that list through a search of the child node tree.
// The result is an array of input elements in the order they were found.
function GetBtnList(pFld)
{
    function FindChildren(array, parent)
    {
        for (var vI = 0; vI < parent.childNodes.length; vI++)
        {
            var vC = parent.childNodes[vI];
            if (vC.tagName == "INPUT")
                array[array.length] = vC;
            else
                FindChildren(array, vC); // RECURSIVE
        } // for
    }

    var vCB = pFld.childbuttons;
    if (!vCB)
    {
        vCB = new Array();
        FindChildren(vCB, pFld);
        pFld.childbuttons = vCB;
    }
    return vCB;
} // GetBtnList

</script>

The impact of ClientIDMode=Predictable

2009-12-02T16:45:00Z

ASP.NET 4 introduces a new property on all controls: ClientIDMode. It lets web form developers minimize the size of the id= attribute written into HTML tags. It also helps them dictate the actual form of the ID, avoiding the mangled naming of previous versions when controls are inside of naming containers.

As a commercial web control developer, I’ve studied my products when the user sets ClientIDMode to something other than AutoID (which is that mangled format.) Unfortunately, the Predictable setting can break things.

Predictable is documented as follows:

This algorithm is used for controls that are in data-bound controls. The ClientID value is generated by concatenating the ClientID value of the parent naming container with the ID value of the control. If the control is a data-bound control that generates multiple rows, the value of the data field specified in the ClientIDRowSuffix property is added at the end. For the GridView control, multiple data fields can be specified. If the ClientIDRowSuffix property is blank, a sequential number is added at the end instead of a data field value. Each segment is separated by an underscore character (_).

Since we are talking about the ClientID property, we really are focused on how our client-side javascript code interacts with the HTML generated by the web controls. My controls heavily use javascript, and always grabbing HTML elements by anticipating the id= attribute. For example, suppose you have this TextBox inside of a UserControl whose ID is “UserControl1”.

<asp:TextBox id="TextBox1" runat="server" />

ASP.NET generates this HTML when ClientIDMode=AutoID.

<input type='text' id="UserControl1_TextBox1" />

To get this DHTML element, the Javascript should do this:

var fld = document.getElementById("UserControl1_TextBox1");

This script breaks if the Textbox is inside of a ListView or FormView control when ClientIDMode=Predictable. It’s that ClientIDRowSuffix property, mentioned in the docs above, that is causing the problem. It appends a “_row#” pattern to the overall id= output, like this:

<input type='text' id="UserControl1_TextBox1_0" />

Note: MS has told me that FormView won’t be a problem in the RTM of ASP.NET 4, but for Beta 2, it is.

There is NO problem if you always get the value for the id from the ClientID property itself. For example:

var fld = document.getElementById('<% = FindControl("TextBox1").ClientID %>');

My web controls do something a little different. They have child controls and their IDs have a specific pattern. Take my DateTextBox control. It uses an Image control to toggle a popup calendar.

It is generated this way:

public class DateTextBox : System.Web.UI.WebControls.TextBox
{
    protected override void CreateChildControls()
    {
        System.Web.UI.WebControls.Image image = new System.Web.UI.WebControls.Image();
        image.ID = this.ID + "_Img";
        this.Controls.Add(image);
    }
}

Here’s where it breaks

My javascript attaches some event handlers to the <img> HTML tag generated by the Image control by using the ClientID from the TextBox and appending “_Img” like this:

var img = document.getElementById('<% = FindControl("TextBox1").ClientID %>' + "_Img");

This no longer works when using Predictable mode if the control is inside a ListView or FormView because the image tag has that suffix:

<img id="FormView1_UserControl1_TextBox1_Img_0" />

To solve this, I created the following function that I wanted to share. It handles getting the correct ID, whether or not there is that suffix. It should be used only when a child web control is named in the pattern shown here.

// When joining [ClientID] + "_const", ClientIDMode=Predictable causes problems
// It adds "_#" to the end ([ClientID]_const_0).
// It will move _# from the end of [ClientID] to the end of the combined id.
// This function detects the pattern and copies the "_#" from the ClientId to the end of the overall id
// It returns the new ID.
// pID – The ClientID of the parent control
// pExt – The string appended to the ClientID of the parent, such as “_Img”
// pMode - int. 
// 0 = Normal. Move the ClientID extension to the end of the overall Id.
// 1 = use pId + pExt exactly.
// 2 = the HTML tag was hardcoded with an ID (Literal control written out)
// instead of being generated by a webcontrol's ID. 
function PrepIdExt(pId, pExt, pMode)
{
    if (pMode == 1)
        return pId + pExt;
    if (!gGBIRE)
        gGBIRE = new RegExp("_\\d+$"); // _ followed by 1 or more digits followed by the end of text
    var vM = gGBIRE.exec(pId);
    if (vM != null) // found it. Revise the ID
    {
        pId = pId.substr(0, pId.length - vM[0].length) + pExt;
        if (!pMode)
        pId = pId + vM[0];
    }
    else
        pId = pId + pExt;
    return pId;
} // PrepIdExt
var gGBIRE;

Here’s how to use it:

var img = document.getElementById(PrepIdExt('<% = FindControl("TextBox1").ClientID %>', "_Img", 0));

Some concluding thoughts

There are other ways to create IDs within the web controls to avoid this. Most common is to implement INamingContainer on your base control and establish child control IDs without adding the parent (image.ID = "_Img" as opposed to image.ID = this.ID + "_Img")
If you always use the ClientID property to specify the exact child control, your code will work. I don’t like that because you have to pass every ID you need from the server side, and the ID strings can be lengthy, impacting the page transmission time. I like to pass a single ClientID of the base control and let the javascript know how to work from there.
Peter’s soapbox: I do not feel its right for the end-user of my controls to take control over how my child controls are generated. My web control should have complete control over that. Right now, the end-user can set ClientIDMode and impact my scripts. I have no problem with their dictating the value of the ClientID of the main control’s HTML, just the child controls. Microsoft should change the design to allow web controls to ignore ClientIDMode’s impact on their children.
If you cannot modify existing code to support ClientIDMode, you can either document to set AutoID on the containing NamingContainer’s ClientIDMode property or make your web control’s code set ClientIDMode=AutoID on every child control.