asp.net - Prevent users from changing the parameter ID in the Edit action method -


so url on edit/details method looks http://localhost:1234/movies/edit?id=3. if db table contains records belongs else 1, 2, 4, 5, 6. there nothing stopping user directly typing , accessing record 6 (eg /movie/edit/6).

how can prevent happening? 

        // get: /movie/edit/id     public actionresult edit(int id = 0)     {         movie movie = db.movies.find(id);         if (movie == null)         {             return httpnotfound();         }         return view(movie);     }      //     // post: /movie/edit/id     [httppost]     public actionresult edit(movie movie)     {         if (modelstate.isvalid)         {             db.entry(movie).state = entitystate.modified;             db.savechanges();             return redirecttoaction("index");         }         return view(movie);     }

well depends want restrict , want them restrict editing privileges, i'm going give generic answer. can request authorization each of methods or entire class. can give authorization in general registered users or users particular role using [authorize]

generic authorization(must registered , signed in):

    // get: /movie/edit/id     [authorize]     public actionresult edit(int id = 0)     {         movie movie = db.movies.find(id);         if (movie == null)         {            return httpnotfound();         }          return view(movie);     }       //post: /movie/edit/id     [httppost]     [authorize]     public actionresult edit(movie movie)     {         if (modelstate.isvalid)         {             db.entry(movie).state = entitystate.modified;             db.savechanges();             return redirecttoaction("index");         }         return view(movie);     }

authorization based on roll (you can set user lets 'admin' role can access these methods):

        // get: /movie/edit/id         [authorize(role="admin")]         public actionresult edit(int id = 0)         {             movie movie = db.movies.find(id);             if (movie == null)             {                return httpnotfound();             }              return view(movie);         }           //post: /movie/edit/id         [httppost]         [authorize(role="admin")]         public actionresult edit(movie movie)         {             if (modelstate.isvalid)             {                 db.entry(movie).state = entitystate.modified;                 db.savechanges();                 return redirecttoaction("index");             }             return view(movie);         }

Comments

Post a Comment

Popular posts from this blog

php - failed to open stream: HTTP request failed! HTTP/1.0 400 Bad Request -

this code i'm using find latitude , longitude of place: function coords($address){ echo $url="http://maps.googleapis.com/maps/api/geocode/json?address=".$address; $json = file_get_contents(urlencode($url)); $data = json_decode($json, true); print_r($data['results'][0]['geometry']['location']['lat']); print_r($data['results'][0]['geometry']['location']['lng']); } however returns warning: failed open stream: http request failed! http/1.0 400 bad request if use above code in simple procedure works fine not in function. note: have tried curl_init()... method produced same result? instead of encoding whole url encode address part. following code work fine $add='jamshoro phase 2'; $url="http://maps.googleapis.com/maps/api/geocode/json?address=".urlencode($add); $json = file_get_contents($url); $data = json_decode($json, true); print_r($data['r
Read more

java - How to filter a backspace keyboard input -

i have code gives message when key number pressed: txtvalueofclause.addeventfilter(keyevent.key_typed, new eventhandler<keyevent>() { @override public void handle(keyevent t) { char ar[] = t.getcharacter().tochararray(); char ch = ar[t.getcharacter().tochararray().length - 1]; if (!(ch >= '0' && ch <= '9')) { system.out.println("the char entered not number"); t.consume(); } } }); now if press on wrong button , press backspace remove it, error message. how can add backspace input if statement? i have found answer: txtvalueofclause.addeventfilter(keyevent.key_typed, new eventhandler<keyevent>() { @override public void handle(keyevent t) { char ar[] = t.getcharacter().tochararray(); char ch = ar[t.getcharacter().tochar
Read more

java - Show Soft Keyboard when EditText Appears -

i have code in android app, alert dialog , keyboard, , when dialog shown want keyboard appear. not , not sure why? here code: final alertdialog.builder alert = new alertdialog.builder(this); alert.settitle("title"); alert.setmessage("message"); final edittext input = new edittext(this); input.setinputtype(inputtype.type_class_number); alert.setview(input); input.setonfocuschangelistener(new view.onfocuschangelistener() { @override public void onfocuschange(view v, boolean hasfocus) { if (hasfocus) { log.i(tag, "in focus"); inputmethodmanager inputmethodmanager = (inputmethodmanager) getsystemservice(context.input_method_service); inputmethodmanager.showsoftinput(input, inputmethodmanager.show_implicit); } } }); but keyboard not appear though edit text in focus, , tell appear why, doesn't come up? thanks in advance.
Read more