Franc Stratton's .NET (TM) Web Application, OOP, and SOA Architecture & Programming Site

A site devoted to ASP.NET (TM), SilverLight (TM) and Browser-Based WPF (TM) Applications, IIS Services, and OOP Architectures

Home     Architecture Overview     WF/WCF/WPF     Data Store     Standards     .NET Security     Resources     jQuery     Silverlight     Developer Tips     Blog     Site Map      
Input validation
Authentication
Forms Authentication
Authorization
Configuration Mgt
Sensitive Data
Session Mgt
Cryptography
Parameters
Exception Mgt
Auditing/Logging
SQL Injection
Cross-site Scripting
String Validation
Good measures to prevent parameter manipulation by: query string manipulation, form field manipulation, cookie manipulation, HTTP header manipulation.
 

All parameters below are fully checked and validated in all ways possible prior to passing to another layer. The next layer should validate as well in an abbreviated but appropriate manner.

 

///---------------------------------------------------------------------------

/// <summary>

/// Method Name: btnAddAll_Click

/// Description: Calls the ParseAndRetrieveUsers Method if all criteria met.

/// </summary>

///

/// <param name="object">sender</param>

/// <param name="ImageClickEventArgs">e</param>

///---------------------------------------------------------------------------

protected void btnAddAll_Click(object sender, EventArgs e)

{

    if (Session["AppID"] != null)

    {

        this.appID = Convert.ToInt32(Session["AppID"].ToString());

        if (Page.IsValid)

        {

            if (this.txtUserIDList.Text.Trim() != string.Empty || this.txtUserIDList.Text.Trim().Length < 8)

            {

                if (this.txtUserIDList.Text.IndexOf(";", 0) != -1)

                {

                    UserImportBLL uiBLL = new UserImportBLL();

                    if (uiBLL.ValidateText(this.txtUserIDList.Text.Trim()) == true)

                    {

                        string text = this.txtUserIDList.Text.Trim();

                        int textLength = text.Length - 1;

                        if (text.Substring(textLength, 1) == ";")

                        {

                            try

                            {

                                ParseAndRetrieveUsers(this.appID);

                                BP.ShowMessageBox(this.Page, "Users in the grid cannot be added until the ADD FOUND USERS has been selected and clicked from the Action drop down list. Users not found will not be added to the application.");

                                this.lblMessage.Text = "Only users found in the database but have no current access can be added by clicking on the Action Drop Down List";

                            }

                            catch (Exception ex)

                            {

                                    BP.ShowMessageBox(this.Page, ex.Message.ToString());

                            }

                        }//if (text.Substring(textLength, 1) == ";")

                        else

                        {

                            BP.ShowMessageBox(this.Page, "Please enter User IDs with letters and numbers - ONLY - separated by and ending with semi-colons (no spaces) before clicking on the Add All button. E.g., DE01X00;DE01X01;");

                        }//if (text.Substring(textLength, 1) == ";")

                    }//if (uiBLL.ValidateText(this.txtUserIDList.Text.Trim()) == true)

                    else

                    {

                        BP.ShowMessageBox(this.Page, "Please enter User IDs with letters and numbers - ONLY - separated by and ending with semi-colons (no spaces) before clicking on the Add All button. E.g., DE01X00;DE01X01;");

                    }//if (uiBLL.ValidateText(this.txtUserIDList.Text.Trim()) == true)

                }//if (this.txtUserIDList.Text.IndexOf(";", 0) != -1)

                else

                {

                    BP.ShowMessageBox(this.Page, "Please enter User IDs with letters and numbers - ONLY - separated by and ending with semi-colons (no spaces) before clicking on the Add All button. E.g., DE01X00;DE01X01;");

                }//if (this.txtUserIDList.Text.IndexOf(";", 0) != -1)

            }//if (this.txtUserIDList.Text.Trim() != string.Empty || this.txtUserIDList.Text.Trim().Length < 8)

            else

            {

                BP.ShowMessageBox(this.Page, "Please enter User IDs with letters and numbers - ONLY - separated by and ending with semi-colons (no spaces) before clicking on the Add All button. E.g., DE01X00;DE01X01;");

            }//if (this.txtUserIDList.Text.Trim() != string.Empty || this.txtUserIDList.Text.Trim().Length < 8)

        }//if (this.txtAppID.Text.Trim() != string.Empty)

        else

        {

            BP.ShowMessageBox(this.Page, "An application ID error has occurred. Please exit this screen and return to try this action again.");

        }

    }//if (Page.IsValid)

}//protected void btnAddAll_Click(object sender, EventArgs e)