Part 19 Unintended updates in mvc
Why Stack Overflow recommends it
Stack Overflow users link it when explaining that making a field read-only in the view does not stop tampered POST data, and that the controller must restrict which properties get bound.
Recommended by 1 people across 1 different months, 2014 to 2019.
What it is
Part 19 of kudvenkat's ASP.NET MVC tutorial series, an 8-minute screencast on how unintended updates (over-posting) can happen in MVC. It shows making the Name field non-editable with DisplayFor and HiddenFor, then how a tool like Fiddler can still alter the POSTed data.
What people said
Recommends Harshil Shah · 2016-05 · Stack Overflow · on “Can users access the whole model object properties i am passing to my view, even if i am not generating HTML for some properties”
If you want certain fields read only to user you can do that by changing @EditorFor to @DisplayFor by doing this user will only able to see those fields but can't change directly. If those field are required it will give you error validation message and to get rid of that you need to use @hiddenFor in you code. Now, with this change your code is still hack-able using fiddler tool.To avoid that you will need to modify your controller where it is binding your data to object. use UpdateModel's 4th overloded version where you can specify properties which will get updated explicitly. for example UpdateModel(employee, new string[]{"ID","Gender","City","BirthDate"}); here, employee is object that i
Cites Gábor Imre · 2014-10 · Stack Overflow · on “How is BLL (CRUD and Business Object) typically structured?”
Based on my experience I'd rather use the first one. If there is a more sophisticated business logic then definitely. Usually I have the following layers in a complex application: View. Razor pages Model. Models are Data Transfer Objects [LINK] that represent something to be displayed , not something from the database . Controller. Controllers can be light-weight [LINK] , only connecting the presentation and the business logic. Business Logic. I prefer putting the BL into a separate library (BLL). The business logic communicates with the MVC controllers (through DTOs) and the data layer. Data Layer. Manipulated through EF. DTOs can be created from several DB objects; they can also be a parti
Cites Juan Carlos Oropeza · 2019-08 · Stack Overflow · on “Preventing unintended CRUD actions in mvc”
To give some context on what I know. I learn some time ago from this tutorial [this video] even when you set a field from your model READ ONLY on the View how easy is use tools like fiddler [LINK] to alter the POST data and change the value. [LINK] What you do in this case is use Model Binding to specify the list of fields you want Edit and ignore the rest [HttpPost] [ActionName("Edit")] public ActionResult Edit_Post(int id) { EmployeeBusinessLayer employeeBusinessLayer = new EmployeeBusinessLayer(); Employee employee = employeeBusinessLayer.Employees.Single(x => x.ID == id); UpdateModel(employee, new string[] { "ID", "Gender", "City", "DateOfBirth" }); ^^^ Name isnt updated if (ModelState.IsVali