Using Action Filters on MVC C# using query String

Question

Im using class name RightCheckerAttribute to check user permission in MVC3 application... So the RightCheckerAttribute class is like this...

    public bool isAdmin { get; set; }

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        HttpContextBase context = filterContext.HttpContext;

        bool result = Convert.ToBoolean(context.Request.QueryString["isAdmin"].ToString());

        if (isAdmin != result) 
        {
            RouteValueDictionary redirecttargetDictionary = new RouteValueDictionary();
            redirecttargetDictionary.Add("action", "NoPermission");
            redirecttargetDictionary.Add("controller","Singer");
            filterContext.Result = new RedirectToRouteResult(redirecttargetDictionary);

        }

        //base.OnActionExecuting(filterContext);
    }

So in Method i applying this have head as..

[RightChecker (isAdmin=true)]

Im Executing this method as this..

http://localhost:5576/Singer/DeleteSinger?isAdmin=true

The problem is whether I'm passing true or false... I got result variable as false... And I'm getting:

Exception[Null Object references]...

bool result = Convert.ToBoolean(context.Request.QueryString["isAdmin"].ToString()); line gives a Exception — Tharindu Lakshitha
– Tharindu Lakshitha, Commented May 15, 2012 at 4:50
Checking the query string to determine if a user is an administrator isn't secure. You might want to store that in the session insead. — Daniel Little
– Daniel Little, Commented May 15, 2012 at 4:58

Prashanth Thurairatnam · Accepted Answer · 2012-05-15 05:25:27Z

It seems you are not passing the isAdmin=false or isAdmin=true in your query string. It works for me. However you will need to handle the situation where you are not passing the querystring parameter. Check my implementation. As mentioned in the comments section of the question, it is not secured enough to pass this through a query string.

        public class RightChecker : ActionFilterAttribute
        {
            public bool IsAdmin;            

            public override void OnActionExecuting(ActionExecutingContext filterContext)
            {

               bool result = false;
               if (filterContext.HttpContext.Request.QueryString["isAdmin"] != null)
               {
                       bool.TryParse(filterContext.HttpContext.Request.QueryString["isAdmin"].ToString(), out result);
               }

               if (IsAdmin != result) 
               {
                   //your implementation
               }
            }
        }

Your action method

    [RightChecker(IsAdmin=true)]
    public ActionResult AttCheck()
    {
        return View();
    }

Community · Accepted Answer · 2017-05-23 12:25:33Z

1

check rights from querystring is not really safe. you can try this: [link] "Security aware" action link?

but due to mvc 3 api changes , some code obsoleted in ActionIsAuthorized Method , you can fix it youself , see my question asked here [link] https://stackoverflow.com/questions/10545018/how-to-get-authorizationfilters-from-filterproviders

edited May 23, 2017 at 12:25

CommunityBot

11 silver badge

answered May 15, 2012 at 5:51

dfang

1,40618 silver badges41 bronze badges

Comments

Soliah · Accepted Answer · 2012-05-15 04:49:47Z

0

Seems like maybe the context.Request.QueryString["isAdmin"].ToString() is causing a NullReferenceException.

Try

var param = context.Request.QueryString["isAdmin"] as string ?? "false";
var result = param == "true";

answered May 15, 2012 at 4:49

Soliah

1,4062 gold badges14 silver badges24 bronze badges

3 Comments

Asif Mushtaq Over a year ago

The author is saying that he is passing the parameter but still get the error. localhost:5576/Singer/DeleteSinger?isAdmin=true

Soliah Over a year ago

@Asif Author's comment indicates that the NullReferenceException is being thrown when ToString() is called. So I'm guessing that for some reason the query parameter isn't being passed along. There should be a check for null anyway which my answer I believe takes care of.

Asif Mushtaq Over a year ago

I think that's his question that why its null if he passes the param.

Emmie Lewis-Briggman · Accepted Answer · 2012-05-15 07:15:55Z

0

Pass this in your ViewData shown below:

public ActionResult Test(bool testParam)
{
   ViewData["isAdmin"] = testParam;
   return View();
}

answered May 15, 2012 at 7:15

Emmie Lewis-Briggman

8554 silver badges12 bronze badges

Collectives™ on Stack Overflow

Using Action Filters on MVC C# using query String

4 Answers 4

Comments

Comments

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related